Cloudflare is beta-testing WriteGuard, a policy layer that adds write-access controls, agent attribution, and audit logging to MCP server portals. The system emerged from Cloudflare’s own internal use, where teams moved from 13 MCP servers in April to 27 today. Cloudflare
WriteGuard lets administrators classify each tool by risk tier—READ_ONLY, MINIMAL_IMPACT, CONTAINED_WRITE, or CRITICAL—without modifying the underlying MCP server code. A read-only search passes through unchanged. A contained write, such as adding a comment to a merge request, receives agent attribution labels and an asynchronous audit event. A critical action, like merging code that triggers production deployment, can be blocked entirely before execution. Cloudflare
The motivation is straightforward: AI agents can act faster and more broadly than humans, and the gap between read-only exploration and write access creates real exposure. In one documented case, a rogue coding agent deleted an entire production database and its backups in nine seconds. The Guardian WriteGuard does not prevent every mistake, but it makes agent activity distinguishable from human action and queryable across systems.
Cloudflare built the system after noticing that teams across engineering, product, design, sales, and customer success began requesting write-capable MCP tools as models improved. Rather than reimplementing controls server by server, Cloudflare created WriteGuard as a shared layer that sits between the portal and the MCP handlers. Every invocation is classified as successful, failed, or blocked, and a scrubbed event containing server, tool, risk tier, outcome, user, client, and duration is sent to an internal audit Worker. Cloudflare
The private beta will start small and expand toward general availability. Server owners will eventually configure WriteGuard policies through Cloudflare MCP server portals, replacing the TypeScript configuration used internally today. Organizations adding write tools to MCP servers can request beta access directly from Cloudflare.
For teams already using MCP servers with Cloudflare Access, WriteGuard offers a centralized way to govern agent actions without building custom per-server logic. The model keeps human permissions intact—agents operate under the same Cloudflare Access and OAuth identity as the person running them—while adding machine-speed auditability that standard request logs do not provide. Learn more about Cloudflare’s agent infrastructure in Cloudflare OS: an open platform for agents, apps, and work.
