The July 28 revision of the Model Context Protocol uses protocol headers on Streamable HTTP requests, including MCP-Protocol-Version
, Mcp-Method
, and, when applicable, Mcp-Name
. Cloudflare, founded by Matthew Prince (@eastdakota), Michelle Zatlyn (@zatlyn), and Lee Holloway, is using those protocol headers in Cloudflare One to identify MCP requests and block direct connections that bypass approved routes. The controls cover clients including Claude Code, Codex, Cursor, OpenCode, and VS Code when their traffic passes through Cloudflare Gateway with TLS inspection enabled. (Cloudflare's announcement)
Cloudflare can add that governance to Gateway and Access instead of asking customers to deploy a separate proxy for every AI client. Its MCP Server Portals documentation describes a centralized, Access-protected endpoint with logging, policy enforcement, and curated tool access.
The approach follows the shared-platform architecture Prince and Zatlyn described in their 2019 founders' letter: replace discrete network appliances with services delivered from one platform, then use the resulting traffic to improve additional products. Cloudflare began as an application for finding the source of email spam, and Zatlyn helped turn that visibility into the prevention service that became Cloudflare. (Cloudflare's company history)
New headers make MCP easier to identify
MCP gives AI agents a standard way to discover and invoke tools connected to SaaS services, internal applications, and APIs. An employee can add a remote server with a short configuration change, potentially giving an agent access to source code, customer records, or infrastructure operations before the security organization knows the connection exists. Cloudflare calls those unapproved connections "shadow MCP." (Cloudflare's announcement)
The detection problem has been harder than looking for a familiar domain or URL path. An MCP server can sit at an ordinary HTTPS endpoint with no "mcp" string in its hostname or path. Cloudflare's earlier approach searched Gateway logs for likely names, paths, and JSON-RPC methods, which could miss ordinary-looking endpoints and flag unrelated services. (Cloudflare's announcement)
The July 28, 2026 MCP revision uses protocol headers on Streamable HTTP requests, including MCP-Protocol-Version
, Mcp-Method
, and, when applicable, Mcp-Name
. Those headers give gateways a way to identify the operation without relying on the request body. (Streamable HTTP transport specification)
Cloudflare says Gateway can classify inspected MCP requests, show the users and servers generating them, and block direct connections outside approved routes. The traffic must pass through Gateway with TLS inspection enabled. Cloudflare also says Gateway can distinguish requests crossing an approved MCP Portal from direct connections to upstream servers, while a dashboard breaks activity down by user, server, and connection path. (Cloudflare's announcement)
Administrators can inventory destinations, decide which servers belong in an MCP Server Portal, attach identity and tool policies, and block detected MCP requests that arrive through another route.
Network controls compete with specialist agent gateways
In Cloudflare's announcement, AJ Gerstenhaber frames the threat around operational speed: an engineer can after an unexpected result, while an agent can repeat the same mistaken action thousands of times before a person intervenes.
Cloudflare is tying MCP detection to identity, logging, and data loss prevention. An MCP request can carry credentials, a tool name, and arguments containing code, customer information, or instructions to change infrastructure. Gateway can stop an inspected request before it reaches the server, while response inspection and logging can show what the tool returned to the agent. These are Cloudflare's stated capabilities; their usefulness depends on the request crossing a managed, decrypted network path. (Cloudflare's announcement)
Specialist vendors are approaching the same governance gap closer to the agent and tool layers. Runlayer said in June that it raised $30 million in a Series A to develop identity, approvals, discovery, and runtime controls for enterprise agents. SurePath AI says its policies govern which MCP servers and tools may be used before execution, with blocked tools removed from MCP payloads before they reach backend services. Those products emphasize agent-specific controls, while Cloudflare is using the secure web gateway, identity, and DLP systems its customers may already operate.
Cloudflare's December 31, 2025 filing counted about 332,000 paying customers. Cloudflare has not tied that figure to use of its MCP products or disclosed MCP-specific customers, revenue, pricing, adoption, traffic volumes, or measured detection rates.
The network view has hard edges
Cloudflare's network controls cannot see local stdio servers, off-network traffic, unmanaged devices outside the managed path, or traffic excluded from TLS inspection. Server-side authorization also remains necessary because the server has the execution context needed to decide whether a caller may invoke a specific tool. (Cloudflare's announcement)
The supplied materials do not establish the controls' general availability. Cloudflare's announcement establishes a network detection and enforcement capability without showing how accurately it identifies MCP traffic in production or how widely customers have adopted it.