How Cloudflare detects MCP traffic and helps secure it

Cloudflare's MCP traffic controls address a visibility problem. The Model Context Protocol (MCP) is a common way for agents to call outside tools, and a connection to an MCP server can resemble ordinary web traffic. Cloudflare's Gateway, which decrypts and inspects traffic routed through it, reads MCP protocol headers, helping administrators identify tool servers and distinguish approved connections through a Portal (Cloudflare's managed MCP entry point) from direct access.

That view has boundaries. Local tool connections and traffic outside the inspected network path are invisible to it, and missing protocol headers do not prove a request is unrelated to MCP. Requiring use of an approved Portal also needs the upstream server to reject direct connections. Network detection supplies evidence and enforcement on managed paths; server-side restrictions close the bypass route.

“The introduction of AI agents changes both thresholds. Their decisions are nondeterministic, and they can take the same action (or invoke the same tool) indefinitely, without getting tired or stopping for lunch. A plausible — but incorrect — decision can become thousands of incorrect actions before a human notices.”

“The Model Context Protocol does not use a guaranteed hostname or require /mcp in the path, so a direct connection can look like any other HTTPS API call.”

“Its presence is a strong positive indicator of MCP; its absence does not prove that a request is not MCP.”

“Shadow MCP is a connection to a server the organization has not approved. An employee finds the server in a repository, a product guide, or a message from a colleague and adds it directly to their MCP client. The security team has no idea which tools it exposes or what data employees send to it.”

“Starting today, all Cloudflare Zero Trust customers see indications of MCP traffic in their Gateway HTTP logs and can explicitly block or allow that traffic with a new Gateway selector: experimental.is_mcp == true”