Cloudflare adds Gateway controls to spot and block unmanaged MCP traffic

Cloudflare has introduced new Cloudflare One controls intended to make Model Context Protocol traffic easier for security teams to find and govern. In an August 14 blog post, the company said Cloudflare Gateway can classify inspected MCP requests, show which users and servers are generating them, and help administrators block direct connections that bypass approved MCP Portals.

The development matters because MCP has become a common way for AI agents to reach outside tools, including SaaS products, internal services, databases, ticketing systems, and deployment workflows. Cloudflare frames the risk around speed and delegation: permissions that were originally assigned to a human can be exercised by an agent repeatedly, and a direct MCP server connection can look like ordinary HTTPS traffic if teams only search for obvious hostnames or paths.

What Changes For Administrators

Cloudflare says Gateway now evaluates protocol-level signals rather than relying only on URL patterns such as /mcp. For TLS-inspected traffic, administrators can use a new boolean selector, experimental.is_mcp == true, in allow or block policies. The company also described a dedicated dashboard that reports total MCP requests, unique users, unique servers, on-ramp breakdowns, servers seen outside approved Portals, and top users by request volume.

Cloudflare is also adding Traffic Source selectors so policies can distinguish Portal-proxied traffic from direct employee connections. A baseline rule can block detected MCP traffic unless it came through an mcp_portal route, leaving approved Portal traffic unaffected. The same post says MCP Portals now support pre-registered OAuth clients, which may help organizations connect more upstream services that require fixed client IDs, secrets, callback URLs, and scopes.

The Practical Catch

The signal is useful, but it is not universal. Cloudflare notes that Gateway needs TLS decryption to inspect the relevant headers, while local stdio servers, off-network use, Do Not Inspect traffic, custom transports, and nonconforming clients can remain outside this view. The MCP-Protocol-Version header is described as a strong positive indicator, not proof that unflagged traffic is harmless.

One likely effect is that enterprise MCP programs will start with discovery rather than a blanket ban. Teams can compare observed servers against an approved catalog, move common tools behind Portals, and then block direct connections that should not exist. It remains unclear how quickly this approach will cover the many older clients and private servers already in use, so policy rollout should probably start in reporting mode before enforcement touches developer workflows.

Sources

• blog.cloudflare.com

Cover photo by Brett Sayles on Pexels, used under the Pexels License.