WriteGuard: fine-grained controls for MCP Servers
- Source
- blog.cloudflare.com
- Author
- Cloudflare
- Date
Context
Cloudflare's WriteGuard adds centrally enforced rules to tools exposed through MCP, the protocol used to connect AI applications to external systems. Its technical article describes a layer that can block a tool call before its handler runs, add attribution to supported writes, and record the outcome.
The agent still acts within the employee's permissions, but its session becomes distinguishable from the employee's other activity. This helps administrators answer both whether a write was allowed and which agent session made it. Cloudflare describes an internal implementation and a planned external private-beta rollout through its MCP server portals.
- Agents inherit the employee's identity instead of getting their own accounts: if Joe cannot close an issue, Joe's agent cannot either. That avoids a second permission set, at the cost that downstream systems see only Joe — so the layer injects agent session .
- Client-side were rejected on principle. Skills and elicitation prompts behave differently in every and users can switch them off, so policy has to sit in front of the tool handler where it cannot be disabled.
- The policy unit is the individual tool, not the server: each gets a risk tier and an on/off switch. Read-only calls pass through untouched, contained writes get attribution plus an audit event, and critical tools are blocked before their handler ever runs.
- Which tools are critical follows blast radius, not obviousness — merging a request is blocked because at Cloudflare a merge triggers a deploy pipeline. The same tool would be routine somewhere without that wiring.
- Audit events are written asynchronously and scrubbed of values under secret or sensitive keys, so logging adds zero latency to the call the agent is waiting on while still recording server, tool, risk tier, outcome, user, client, and duration.
- AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
- context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
- guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
- agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
“The system records all those changes under Joe regardless of whether it was him or his agent, and the network logs do not distinguish one agent session from another.”
“At Cloudflare, we knew we could not depend on every employee to configure every agent perfectly or watch every tool call.”
“If Joe cannot close a particular issue, Joe’s agent cannot close it either.”
“Because an agent can repeat an action much faster than a person, we also needed central auditing across every MCP server.”
Checking sign-in…
Loading comments…