New network controls target unmanaged MCP use
Cloudflare says it is adding Cloudflare One capabilities that detect inspected Model Context Protocol traffic and help administrators distinguish approved MCP Portal use from direct connections. The update is aimed at a growing security problem around AI agents: tool access that was originally designed for human-paced decisions can now be invoked repeatedly by automated systems. The practical value is visibility first, enforcement second. The limits are just as important: the controls depend on managed paths, TLS inspection and traffic that actually traverses Cloudflare Gateway.Why MCP traffic is hard to govern
Model Context Protocol servers give AI agents a common way to discover and call tools backed by SaaS products, internal applications and APIs. Cloudflare frames the risk as a change in decision speed and agency: permissions that let a senior engineer deploy code, query a sensitive database or change access can be exercised by an agent that may repeat a plausible but wrong action many times before a person intervenes.The operational issue is that MCP use can be easy to create and difficult to recognize. Cloudflare says an employee can point tools such as Claude Code, Codex, Cursor, OpenCode, VS Code or another AI harness at an MCP server with a small configuration change. The resulting network traffic may not include a predictable hostname or a path such as /mcp, so a direct MCP connection can resemble an ordinary HTTPS API call. For security teams, that makes inventory and approval workflows harder than blocking a known application domain.
Gateway detection moves from URL clues to protocol signals
Cloudflare says Gateway can now classify MCP traffic using protocol-level indicators rather than relying only on URL patterns. Earlier approaches searched logs for hostnames containing “mcp” or common paths such as /mcp and /sse, but Cloudflare says those signals can miss MCP servers at ordinary API URLs and can also match unrelated services.The newer signal is tied to the protocol itself. Cloudflare says conforming Streamable HTTP clients send the MCP-Protocol-Version header after initialization, while the MCP 2026-07-28 specification places more information on each request, including headers such as Mcp-Method and Mcp-Name. Gateway inspects the MCP-Protocol-Version header on TLS-inspected requests and classifies the traffic accordingly. Cloudflare says Zero Trust customers can see MCP indications in Gateway HTTP logs and use a boolean selector, experimental.is_mcp == true, in allow or block policies.
That design gives administrators a broader detection mechanism than maintaining lists of MCP-looking domains. It also creates a cleaner investigation path: which user generated the traffic, which server received it, and whether the connection followed an approved access route.
Portals separate approved use from direct bypass
Cloudflare separates two problems that can otherwise look similar in logs. “Shadow MCP” is use of a server the organization has not approved. Portal bypass is different: the server may be approved, but a user connects directly to its upstream URL and skips the Portal’s access policy, curated tool catalog, data loss prevention checks and tool-level audit trail.The company says its MCP traffic dashboard shows total MCP requests, unique users, unique servers, per-server request counts, traffic by on-ramp, top servers seen outside Portals and top users by request volume. Administrators can filter by server, user or on-ramp type and move into Gateway HTTP logs for deeper investigation.
For enforcement, Cloudflare says MCP Portal traffic routed through Gateway carries an mcp_portal Traffic Source. That allows policy to distinguish Portal-proxied requests from direct employee connections. A common implication is that an organization can observe direct MCP behavior first, then block detected MCP traffic that did not originate from a Portal while leaving Portal traffic unaffected.
OAuth and private server support widen the governed path
Cloudflare also describes changes intended to make more approved MCP servers usable through Portals. The company says MCP Portals now support pre-registered OAuth clients, which matters because many OAuth providers require an administrator to register an application with a fixed client ID, client secret, callback URL and scopes rather than relying on Dynamic Client Registration.Under that model, an administrator can configure manual OAuth credentials, register the callback URL shown in the dashboard with the upstream provider and enter client credentials. Cloudflare says each user still authorizes access to their own upstream data sources, while the stored client secret is used only to fetch updated tool and prompt lists.
Private MCP servers remain a work in progress. Cloudflare says MCP Portals currently must be able to resolve and reach an upstream server over the public Internet, so servers reachable only through private DNS or private IP space are not yet reachable by Portals. The company says private connectivity through Cloudflare Gateway routing and the Cloudflare One network is in active development.
Limits security teams still have to account for
The announcement does not make Gateway a universal MCP sensor. Cloudflare says direct encrypted traffic must pass through TLS decryption before Gateway can inspect the relevant headers. Local stdio servers, off-network connections, Do Not Inspect traffic and requests that never traverse Gateway remain outside this view.The protocol signal is also a strong positive indicator rather than a complete detector. Cloudflare says older protocol versions did not define the MCP-Protocol-Version header, a legacy client’s initial request may not contain it, and custom or nonconforming traffic may never carry it. That means absence of the header does not prove a request is not MCP.
Cloudflare’s broader model is layered control: client hooks can see tool decisions before network serialization, Gateway can identify remote traffic on managed paths, and server-side middleware can authorize specific tools before execution. Used together, those layers can reduce unmanaged agent access, but each layer has coverage gaps.
Conclusion
Cloudflare’s update is best read as a governance feature for organizations already routing managed device traffic through Gateway, not as a standalone answer to agent security. It gives security teams a way to find inspected MCP traffic, compare it with approved servers, route more use through MCP Portals and block direct paths that should not exist.The security implication is practical: AI agent tool use is becoming a network and access-control problem, not only an application-development problem. Detection based on protocol behavior should reduce dependence on brittle URL clues, while the stated limitations keep the deployment question clear. Teams still need approved server lists, Portal adoption, server-side authorization and decisions about where TLS inspection is appropriate.
Sources
Editorial Team - CoinBotLab