How to Secure MCP Traffic With Cloudflare Gateway

On August 14, 2026, Cloudflare released new security capabilities for Cloudflare One to identify and govern Model Context Protocol (MCP) traffic. The Cloudflare security update provides protocol-level detection through Cloudflare Gateway, helping administrators control “shadow MCP” traffic generated when employees connect local AI agents to unvetted external servers. Here is how to configure Gateway policies using the new HTTP headers, deploy Access for Workers, and monitor usage via the AI Security Dashboard.

Detecting MCP Traffic With Gateway Policies

Prior versions of the Model Context Protocol were stateful and relied on JSON-RPC payloads. Inspecting these payloads at the network layer required full body parsing, making governance difficult for network administrators.

The MCP 2026-07-28 specification shifts to a stateless architecture and introduces mandatory HTTP headers. Cloudflare Gateway now uses these headers alongside specific heuristics to identify MCP requests natively. The primary headers used for detection are:

• Mcp-Protocol-Version: Identifies the protocol version in use.
• Mcp-Method: Specifies the agent’s intent, such as tools/call or resources/read.
• Mcp-Name: Identifies the specific tool or resource the agent is attempting to access.

To govern this traffic, Cloudflare has added the experimental.is_mcp selector to Gateway HTTP policies. You can use this selector to construct rules that block direct MCP connections to the open internet. Administrators typically configure Gateway to block all generic experimental.is_mcp traffic while explicitly allowing connections routed through approved enterprise MCP Server Portals.

Securing MCP Endpoints With Access for Workers

Security researchers recently detected over 21,000 internet-facing MCP server instances, noting that nearly 92% lack basic OAuth authentication. If you host custom MCP tools on Cloudflare infrastructure, exposing them directly creates a significant attack surface.

Launched alongside the Gateway updates, the new Access for Workers feature allows you to attach Cloudflare Access policies directly to Workers hosting MCP servers. This integration ensures that any endpoint, whether running on a .workers.dev subdomain or a custom domain, is protected by an identity-aware policy before the request reaches your tool logic.

When you Deploy Enterprise MCP with Cloudflare Workers, you can mandate enterprise identity provider (IdP) authentication for every tool call. This enterprise-managed authorization model replaces the need to implement per-user OAuth logic inside the MCP server itself.

Monitoring Usage in the AI Security Dashboard

Visibility into agent traffic requires dedicated metrics. Cloudflare surfaces MCP telemetry in the new AI Security Dashboard, located in the Cloudflare dashboard under Insights & Logs > Dashboards.

The dashboard provides a timeseries view of MCP server discovery. This acts as an early warning system for new shadow servers popping up across your corporate network. It also tracks aggregate metrics, including total MCP request volume, the number of unique internal users generating the traffic, and the specific third-party MCP servers they are connecting to.

Limitations and Tradeoffs

While Cloudflare Gateway provides robust enforcement for HTTP-based remote MCP connections, it cannot inspect or block traffic using the STDIO transport layer. When developers run AI agents locally on their machines and connect them to local command-line tools via STDIO, the traffic never touches the network.

Network-level controls are critical for governing remote tool access, but they do not mitigate the local execution risks associated with unvetted agent tools on developer workstations. For complete endpoint protection, administrators must combine Gateway policies with local endpoint management to restrict which processes can initiate STDIO MCP connections.

To further harden your deployment against unauthorized tool execution, review the guidance on how to Secure MCP Servers With Cloudflare WriteGuard for granular, state-aware access controls.