How Cloudflare detects MCP traffic and helps secure it

Connecting an AI agent to an internal tool takes a single line of configuration, turning one subtle model mistake into thousands of automated actions before anyone notices. 👇

Traditional permission models assume actions happen at human speed with human judgment. AI agents change that threshold entirely by making nondeterministic decisions continuously. Worse, the Model Context Protocol (MCP) doesn't mandate standard URLs or `/mcp` path prefixes, making agent traffic look identical to normal HTTPS API calls.

Cloudflare updated Cloudflare One to detect MCP traffic at the network layer, differentiate managed agent paths from direct bypasses, and give security teams a way to block shadow MCP connections.

Controlling agent actions happens across three distinct layers:

* Inside the client: Hooks catch local tool calls early, but security teams must manually reproduce controls across every client like Cursor, VS Code, or Claude Code. * At the server: Server middleware validates schemas and permissions right before execution, but this only protects endpoints your team directly controls. * At the network boundary: Secure web gateways see all remote outbound traffic, making them ideal for catching unmanaged connections.

Network identification used to be difficult because older MCP specifications relied on stateful initialization handshakes that lacked standard HTTP headers. The newer MCP spec (2026-07-28) makes the protocol stateless, eliminating the handshake and requiring explicit headers like `MCP-Protocol-Version`, `Mcp-Method`, and `Mcp-Name` on requests.

Cloudflare Gateway inspects these protocol headers during TLS decryption. It exposes a boolean filter, `experimental.is_mcp == true`, which flags MCP requests without needing pre-configured lists of domain names or paths.

To separate safe traffic from policy violations, Cloudflare tags requests passing through managed MCP Portals with a `mcp_portal` traffic source. Security teams can write simple rules that permit MCP traffic only when it originates from a Portal, automatically blocking direct device connections and shadow MCP servers.

Cloudflare launched a dedicated dashboard that details total MCP requests, top user activity, and unapproved external destinations. Cloudflare's Agents SDK (v0.20.0) also added native support for the new stateless MCP spec while maintaining backward compatibility with legacy handshakes.