How to Secure MCP Servers With Cloudflare WriteGuard

Cloudflare’s new WriteGuard layer allows you to restrict, audit, and mediate write actions for AI agents connecting to your internal systems. Announced in private beta on August 5, 2026, as part of the broader Agents Week releases, the tool solves the binary access problem inherent in the Model Context Protocol. You can now define specific risk tiers for individual tools rather than granting blanket read-only or full-write permissions to an agent.

WriteGuard functions as a centralized governance layer designed to stop autonomous agents from performing unintended destructive actions. Without granular controls, a runaway agent with write access could mass-delete database tables or close thousands of unresolved support tickets. By inserting a shared policy engine between the MCP client and the MCP server, WriteGuard enforces strict operational boundaries before the request ever reaches your internal infrastructure.

Architecture and The Policy Layer

The Model Context Protocol specification includes basic security considerations, but it lacks a native shared policy layer for complex enterprise environments. WriteGuard fills this gap by acting as an intermediary proxy. The MCP client sends a tool execution request, which WriteGuard intercepts, evaluates against your defined policies, and either blocks, pauses, or forwards to the MCP server.

This architecture prevents the emergence of Shadow MCP deployments. When developers spin up local or departmental MCP servers to test new agent capabilities, those servers often bypass corporate access controls. By routing all tool execution through Cloudflare MCP server portals equipped with WriteGuard, you centralize authorization. The system authenticates every action via Cloudflare Access and OAuth, eliminating the need to build custom authorization logic into every downstream application.

Configuring Tool Risk Tiers

WriteGuard replaces binary access controls with a four-tier risk model. You apply these tiers to individual tools exposed by your MCP servers, allowing you to tailor the security posture based on the specific action the tool performs.

Risk Tier	Execution State	Use Case
Read-only	Default state. No state changes allowed.	Fetching records, querying databases, reading wikis.
Attributed Write	Actions allowed but tagged with agent identity.	Appending notes, updating status fields, drafting replies.
Mediated Write	Actions require human approval.	Modifying production configurations, executing financial transactions.
Blocked	High-risk actions prevented entirely.	Destructive API endpoints, deprecated tools.

The Read-only tier serves as the default state for all new tools registered in the portal. To enable state changes, you must explicitly elevate a tool to one of the write tiers.

The Mediated Write tier introduces a mandatory human-in-the-loop approval workflow. When an agent attempts to execute a tool mapped to this tier, WriteGuard intercepts the payload, suspends the MCP session, and routes an approval request to the designated administrator or tool owner. The action only proceeds after explicit human authorization.

Implementing Agent Attribution

Identity management poses a significant challenge when AI agents interact with corporate systems. Standard service accounts obscure whether a human or an automated process initiated an action. WriteGuard solves this by enriching outgoing write requests with the agent’s identity, merging client data with session context.

When an agent updates a record, the downstream application receives modified headers detailing the exact origin of the request. Instead of a generic system user, the application logs record the human user and the specific agent instance. For example, if a developer named Joe runs an automated script, the system attributes the action to “Joe’s Cleanup Agent” rather than just “Joe”.

This enriched context flows directly into your existing infrastructure. Because WriteGuard handles the token exchange and identity assertion via enterprise-managed authorization, downstream applications like Jira or GitLab require zero code changes to record accurate attribution.

Centralized Auditing and Scrubbing

Tracking agent behavior across disparate systems typically requires consolidating logs from dozens of incompatible APIs. WriteGuard standardizes this process by producing normalized audit events for every intercepted tool execution.

The system automatically scrubs these audit events to remove sensitive payloads, credentials, and proprietary prompt data before writing them to your logging backend. This creates a consistent and secure trail of agent activity spanning Jira, GitLab, internal wikis, and custom internal systems. Security teams can query these logs to detect anomalous behavior, identify looping agents, or trace the origin of unauthorized modifications.

You can route these scrubbed events to the Identity-Aware AI Gateway, another tool released into public beta during the August updates. The gateway uses behavioral baselines generated from WriteGuard logs to flag rogue AI behavior and identify potential insider risks driven by agent misuse.

Infrastructure Context and Ecosystem

WriteGuard emerged from Cloudflare’s internal efforts to manage its rapidly expanding AI infrastructure. According to the beta documentation, Cloudflare scaled its internal MCP portal from 13 servers in April 2026 to 27 servers by August 2026. Managing the write access for this volume of tools necessitated a dedicated governance layer.

The release aligns with the new Agent Access Model, an architecture that mandates task-scoped identities for agents. Instead of sharing a single broad service account, WriteGuard ensures that agents request discrete and time-bound permissions for specific tasks. For organizations building their own autonomous workflows, Cloudflare also introduced Cloudflare OS, an open-source platform that natively integrates these WriteGuard policies into self-hosted agentic environments.

Limitations and Tradeoffs

WriteGuard is currently restricted to private beta users and exclusively supports traffic routed through Cloudflare MCP server portals. Organizations managing bare-metal MCP servers outside the Cloudflare ecosystem cannot leverage the shared policy layer at this time.

Additionally, the Mediated Write tier introduces latency into agent execution loops. Agents must be configured to handle asynchronous timeouts and long-polling states while waiting for human approval. If your MCP client lacks support for suspended execution states, mediated tools may trigger timeout errors in the agent’s context window.

Evaluate your existing MCP servers and catalog all tools capable of modifying state. Map these endpoints against the four risk tiers to ensure destructive actions are securely isolated behind the Mediated Write or Blocked policies before deploying agents to production.