Notes ·
Cloudflare Is Treating MCP Like Network Traffic That Needs a Firewall
Cloudflare has added network-level detection and controls for MCP traffic, which is a notable approach to securing AI agents.
The problem is straightforward: connecting an agent to an MCP server can take a single configuration line. Someone can give Codex, Claude Code, Cursor or another agent access to an external server without the security team knowing what tools it exposes or what information is being sent there. Cloudflare calls this shadow MCP.
Cloudflare Gateway can now recognize MCP traffic on TLS-inspected connections, identify the user and destination, log it, apply data-loss-prevention rules and block connections that do not follow an approved path.
The particularly useful part is MCP Portals.
An organization can put approved MCP servers behind one managed endpoint with identity controls, an approved tool catalog and auditing. Gateway can then enforce a simple rule:
MCP traffic goes through the portal, or it does not go out.
That prevents someone from bypassing the managed MCP endpoint and connecting directly to the upstream server.
The latest MCP protocol makes this easier. MCP 2026-07-28 puts the protocol version, method and tool name into HTTP headers on each request. That means ordinary gateways and security infrastructure can recognize operations such as tools/call without first parsing the entire JSON-RPC body.
This is the direction MCP security needs to go.
Do not depend entirely on the model behaving correctly.
Do not depend on every developer configuring every client correctly.
Put controls between the agent and the things it can touch.
There are limits. Gateway cannot see local stdio MCP servers, traffic outside the managed network, or encrypted connections excluded from TLS inspection. Server-side authorization and client controls are still necessary. Cloudflare explicitly recommends using these layers together.
That is actually what I like about the design.
MCP gives AI agents access to increasingly powerful tools. Cloudflare is treating those connections the same way we eventually learned to treat every other privileged network connection:
identify it, authenticate it, constrain it, inspect it and log it.
That is much safer than hoping the agent asks nicely before doing something stupid.