Loading…
How Cloudflare detects MCP traffic and helps secure it
CloudflareAJ Gerstenhaber
Summary
Traditional security boundaries assume human speed and judgment, but AI agents execute nondeterministic actions rapidly and can invoke unapproved Model Context Protocol servers through standard HTTPS traffic. To mitigate this shadow traffic, Cloudflare One introduces detection and inspection capabilities across clients, network boundaries, and MCP servers. Cloudflare Gateway leverages protocol-level headers and JSON-RPC inspection to identify direct MCP connections, verify managed paths, and enforce access through approved MCP Server Portals. Furthermore, Cloudflare Agents SDK v0.20.0 implements the stateless 2026-07-28 MCP specification while providing fallback handshakes for legacy servers. Organizations can combine Gateway traffic source rules with server middleware like WriteGuard to block unauthorized tool invocations before execution.
Context
AI agents execute nondeterministic tool calls at machine speed, creating risks where a single incorrect decision can rapidly trigger thousands of harmful actions. Model Context Protocol traffic often looks like ordinary HTTPS API calls without distinct hostnames or paths, allowing employees to configure unapproved shadow MCP servers across various AI clients without administrative visibility.
Approach / What changed
Cloudflare One introduces inspection capabilities across three control points: MCP clients, the network gateway, and MCP servers. Cloudflare Gateway classifies MCP requests using protocol headers and JSON-RPC payload inspection, blocks direct unapproved connections, and enforces routing through MCP Server Portals. Additionally, Cloudflare Agents SDK v0.20.0 adds support for the stateless 2026-07-28 MCP specification with backward-compatible fallbacks, while server-side middleware like WriteGuard enforces tool permissions and risk tiers before execution.
Takeaways
- MCP requests can be controlled at three distinct layers: inside the client hook before serialization, at the network boundary via a secure web gateway, and on the server before tool handler execution.
- Model Context Protocol requests carry inspection signals such as MCP-Protocol-Version, Mcp-Method, and Mcp-Name headers, alongside tool arguments encapsulated within the JSON-RPC envelope.
- Cloudflare Agents SDK v0.20.0 supports the stateless 2026-07-28 MCP specification using server/discover probes, while maintaining backward compatibility with legacy initialization handshakes.
Related reading
Everything we launched during Agents Week
Agents Week introduced a series of products and primitives across Cloudflare to support an Agentic Internet where autonomous software and humans interact. Developing capable agents requires addressing technical challenges spanning identity, communication, orchestration, memory, observability, and security. Cloudflare introduced the Agent Development Lifecycle alongside tools like Cloudflare Agents for live tracing, replay, and human-in-the-loop approvals. The releases also included programmable CI/CD pipelines capable of repairing failures, Cloudflare Wallets for agent transactions, and Kitesurf, an agent-first browser running in V8 isolates. New protocols and tools like WebMCP, MCPv2, and Cloudflare AI Search aim to make web data and applications readable, discoverable, and searchable by autonomous software.
Shelley JonesThe next generation of MCP
Model Context Protocol previously required stateful connections between clients and remote servers, creating operational complexity around sticky sessions, message replay, and open streams. The newly released MCP 2026-07-28 specification transitions MCP to a fully stateless protocol alongside updated SDKs across TypeScript, Python, Go, and C#. The protocol eliminates mandatory handshakes and session identifiers from core request paths while enabling servers to run on request-scoped infrastructure like Cloudflare Workers. Interactive elicitation is restructured through Multi Round-Trip Requests, which allow servers to return input requirements without sustaining persistent connections. Standardized headers for method names and improved OAuth authorization mechanisms further enable standard web infrastructure to inspect and manage MCP traffic efficiently.
Matt CareyThe Cloudflare Blog – Brought to you by EmDash
Cloudflare migrated its official blog to EmDash, an Astro-focused content management system, acting as internal Customer Zero to evaluate scaling and usability. To prepare for traffic spikes reaching thousands of requests per second, engineers used k6 to execute ramp, breakpoint, and burst load tests. The resulting production architecture runs EmDash on Cloudflare Workers, pairing it with Workers Cache, an object cache backed by Workers KV, and Hyperdrive connected to PlanetScale. This layered caching design serves 99.5 percent of static files and 70 percent of requests from cache, flattening p95 latency under real-world loads reaching 850 requests per second. The migration also introduced a frontend redesign using the Kumo design system and added Model Context Protocol servers for automated agent workflows.
Kody JacksonSecure all your internal vibe-coded applications — in one click
AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.
Chythra Malapati