Cloudflare announced new capabilities in Cloudflare One to help security teams detect and control Model Context Protocol (MCP) traffic, as AI agents have become capable of calling tools and executing actions quickly and at a scale that can cause a single mistake to be repeated thousands of times before it is noticed.
The new updates enable Cloudflare Gateway to identify MCP requests through protocol-level indicators, show the users and servers generating this traffic, and then apply policies that allow or block connections. In conjunction with MCP Server Portals, administrators can verify whether agents are using the approved path or connecting directly to a server while bypassing the controls in place.
Detecting MCP Traffic Without Relying on Distinctive Addresses
MCP does not require a specific hostname or fixed path such as /mcp, so direct connections may look like any HTTPS request to an API. Cloudflare previously relied on searching for hostnames or paths containing common indicators, but this method could miss servers using ordinary addresses or identify services unrelated to MCP.
Gateway now relies on protocol indicators, most notably the MCP-Protocol-Version header in requests passing through TLS decryption. Recent protocol versions can also use the Mcp-Method and Mcp-Name headers to identify the requested operation and tool without needing to fully analyze the request body.
As of the announcement date, all Cloudflare Zero Trust customers can see MCP traffic indicators in Gateway HTTP logs and can use the experimental.is_mcp == true selector in allow or block policies. This detection does not include encrypted traffic that has not undergone decryption, local MCP servers using stdio, connections outside the managed network, or requests that do not pass through Gateway.
A Dashboard for Monitoring Connections and Destinations
Cloudflare provides a dedicated dashboard for MCP traffic that displays, within a configurable time range:
- Total MCP requests and the number of unique users and servers.
- Servers providing MCP traffic, along with the number of requests for each server.
- Traffic distribution by connection point, distinguishing between MCP Portal traffic and direct connections from user devices.
- The MCP servers appearing most frequently outside approved portals, representing unmanaged MCP traffic.
- The users with the highest volume of MCP requests.
Administrators can filter results by server, user, or connection-point type, then navigate to the associated Gateway HTTP logs for deeper investigation.
Distinguishing Unauthorized Servers from Portal Bypass
Cloudflare distinguishes between two different issues. The first is Shadow MCP, which occurs when an employee adds a server not approved by the organization to an MCP client. The second is portal bypass, which occurs when an employee connects directly to the address of an approved server instead of using an MCP Portal, bypassing Access policies, the curated tool catalog, data loss prevention, and the audit log.
After discovering an unknown server, the organization can evaluate it and place it behind an MCP Portal. The portal provides a managed access point, Access identity, a curated tool catalog, and activity logging. Compatible connections can also be routed through Gateway to apply HTTP policies and prevent data loss, while exporting tool activity through Logpush.
To enforce portal-only use, Cloudflare added Traffic Source selectors to Gateway Network and HTTP policies. Traffic originating from an MCP Portal displays the mcp_portal source, allowing MCP requests that do not come from the portal to be blocked while requests arriving through the approved path remain allowed.
Expanding Compatibility with OAuth and Private Servers
MCP Portals now support pre-registered OAuth clients. Administrators can enter credentials manually, register the callback address with the service provider, and specify the authorization, token, revocation, and issuer endpoints when they cannot be discovered automatically. Each user remains responsible for authorizing access to their own data sources, while the stored secret is used only to retrieve updated tool lists and prompts.
Cloudflare is also enabling portals to access MCP servers located on private networks through Cloudflare Gateway routing, but this capability is still under active development. Agents SDK version v0.20.0 also supports the MCP specification dated 2026-07-28 as both a client and a server, with the ability to fall back to the legacy initialization mechanism when the server does not support the new stateless model.
Cloudflare recommends starting with visibility: inspect traffic passing through Gateway, compare destinations with approved servers, and move accepted servers into MCP Portals. Organizations can then enforce policies that block direct connections from managed devices and locations, while noting that the company plans to add more granular control over the use of specific tools and reports on tool usage across known and unknown MCP servers.