Cloudflare announced that it has begun making WriteGuard available in a private beta for its MCP server gateways, providing a centralized layer for controlling actions performed by AI-powered agents. The tool combines tool policies, user and agent identity, operation attribution, and centralized auditing, making it possible to pass a request through, enrich it with metadata, or block it before the handler responsible for executing it runs.
The Problem WriteGuard Targets
Cloudflare cites a scenario in which bug tickets begin closing at an accelerating rate, while the logs appear to show that the same engineer is performing all the operations. In the example, the engineer had multiple agents running in concurrent sessions, and one of them caused a cleanup task with an overly broad prompt to execute. It took half an hour to identify the responsible agent, and repairing the ticketing system’s state became more complicated because manual changes and agent changes were recorded under the same engineer’s name, while network logs did not distinguish between the different agent sessions.
Cloudflare believes the risks may be greater in other systems; an agent with access to contract-management software could modify an agreement, send hundreds of replies to customers through the support system, or delete entire tables from a database. For that reason, the company did not want to rely on every employee’s ability to configure every agent correctly or monitor every tool call.
MCP’s Role in the Internal Architecture
MCP stands for Model Context Protocol, a standard used to connect AI applications with external tools and data sources. An MCP server provides tools that connected clients can use, and each tool has a name, description, input schema, and handler that performs the task. When the agent selects a tool, the MCP client sends its call to the server, which in turn interacts with the downstream application or system.
Cloudflare uses MCP servers within the architecture supporting its internal agents, through local clients such as OpenCode and Cloudflare OS, in addition to long-running agent services. These servers operate behind Cloudflare Access and are reached through a single internal MCP server gateway. The gateway connected 13 servers when the company described its internal AI engineering architecture in April; the number had risen to 27 servers when the article was published, with teams continuing to launch new servers every month.
From Read-Only to Action Execution
The servers began in read-only mode, allowing teams to search Jira, GitLab, the wiki, and operational systems and view information without modifying it. As models improved and teams gained more experience using AI, employees in engineering, product, design, sales, and customer success requested tools capable of executing actions.
Before expanding write permissions, Cloudflare wanted to centrally control the write actions that agents could perform, display agent labels in downstream applications, and create an audit trail that would make investigating their activity easier. The company says that client-side controls, such as skills or clarification prompts, do not provide a sufficient foundation because their behavior varies by runtime environment and users can disable them.
Centralized Policies, Attribution, and Auditing
WriteGuard uses each tool’s settings and the request context to determine the appropriate action. It can pass the call through unchanged, add agent attribution data to supported write operations and create an audit event stripped of unnecessary data, or block the action before its handler runs.
The tool allows policy to be defined alongside each tool without modifying the underlying MCP server. Each tool receives a risk level, an enabled or disabled status, and labeling settings. Risk levels determine whether the action will be logged and whether the tool call is permitted, and they also allow queries in the audit log by risk level. Labeling settings make it possible to add agent attribution and choose the text format best suited to the downstream application, without requiring code changes to the MCP server itself.
Cloudflare explains that the currently available version is a private beta for MCP server gateways, and the source did not mention a date for general availability or provide additional details about the scope of access.