Companies that have rolled out AI coding assistants now have a way to see when
those assistants quietly connect to internal tools and data sources. Cloudflare
said on August 14 that it has added detection for Model Context Protocol (MCP)
traffic to its Cloudflare One Gateway product, giving administrators a
network-level signal for the calls AI agents make to third-party and internal
services (Cloudflare announcement).
The company also shipped a dashboard that names the users and servers generating
that traffic and flags connections that skip its approved-access portals.
The problem Cloudflare is addressing is visibility. MCP has become a common way
for agents such as Claude Code, Codex, and Cursor to discover and invoke tools
backed by SaaS products, internal APIs, and databases. Unlike a normal web app,
an MCP server does not have to sit on a predictable hostname or path, so a direct
agent-to-server connection can look like any other HTTPS API call. An employee
can point an AI client at an MCP server with a single line of configuration,
often without security review, and because agents act without human pacing, a
single mistaken decision can repeat thousands of times before anyone notices
(Cloudflare announcement).
Cloudflare’s answer runs at the network edge. Its secure web gateway already
inspects TLS-decrypted traffic from managed devices, and it can now classify MCP
requests by reading protocol headers rather than guessing from URLs. The
2025-11-25 MCP specification says clients must include an MCP-Protocol-Version
header on every HTTP request after initialization, and the 2026-07-28 revision
goes further by requiring it on every POST and placing the operation name on the
request through Mcp-Method and Mcp-Name headers
(Cloudflare announcement).
Those signals let ordinary load balancers and security products identify a tool
call without parsing the JSON-RPC body, and they underpin the new detection.
Cloudflare One, the company’s SASE platform, provides the gateway and client
pieces that route managed-device traffic for inspection
(Cloudflare One overview).
Administrators get a new boolean selector, experimental.is_mcp == true, to allow
or block detected MCP traffic in Gateway policies without maintaining a
hand-curated list of MCP-looking domains. Cloudflare notes the view only covers
traffic that passes through TLS decryption on managed paths; local stdio servers,
off-network connections, and “Do Not Inspect” traffic stay invisible to it.
The accompanying dashboard separates two distinct risks. “Shadow MCP” is a
connection to a server the organization never approved, while “portal bypass”
happens when an employee reaches an approved server’s upstream URL directly,
skipping the portal’s access policy, curated tool catalog, data-loss prevention,
and audit trail. Cloudflare’s MCP Server Portals centralize approved servers
behind one access-controlled endpoint, so the dashboard can show whether a
request traveled through a portal or around it
(MCP server portals docs).
At the server itself, Cloudflare describes an internal pattern called WriteGuard
that tiers each tool by risk and can pass a read through unchanged, attach agent
attribution and an audit event to an allowed write, or block a critical action
before its handler runs. Because that control lives at the server, a user cannot
evade it by switching clients or disabling a local hook.
For security teams, the practical takeaway is that agent traffic is now
observable as its own category rather than buried in generic API logs, but only
on the segments of the network Cloudflare actually controls. Organizations still
need client- and server-side controls to cover traffic that never crosses the
gateway.
Cloudflare has been building out an agent-focused platform beyond Gateway; its
Cloudflare OS effort frames the company’s network and compute as a shared
substrate for AI agents and the apps that call them
(Cloudflare OS at zBrandco).
