Cloudflare uses MCP headers to detect and block unapproved agent connections

Cloudflare is using the July 28, 2026 Model Context Protocol (MCP) revision's protocol headers, including MCP-Protocol-Version, Mcp-Method, and Mcp-Name, to detect and block unapproved agent connections, a practice it calls 'shadow MCP.' The controls, available in Cloudflare One, cover clients such as Claude Code, Codex, Cursor, OpenCode, and VS Code when traffic passes through Cloudflare Gateway with TLS inspection enabled. Cloudflare's approach centralizes governance in Gateway and Access, avoiding the need for separate proxies per AI client.

The July 28 revision of the Model Context Protocol uses protocol headers on Streamable HTTP requests, including MCP-Protocol-Version , Mcp-Method , and, when applicable, Mcp-Name . Cloudflare https://cloudflare.com/?ref=runtimewire , founded by Matthew Prince @eastdakota https://x.com/eastdakota?ref=runtimewire , Michelle Zatlyn @zatlyn https://x.com/zatlyn?ref=runtimewire , and Lee Holloway, is using those protocol headers in Cloudflare One to identify MCP requests and block direct connections that bypass approved routes. The controls cover clients including Claude Code, Codex, Cursor, OpenCode, and VS Code when their traffic passes through Cloudflare Gateway with TLS inspection enabled. Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire Cloudflare can add that governance to Gateway and Access instead of asking customers to deploy a separate proxy for every AI client. Its MCP Server Portals documentation https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/?ref=runtimewire describes a centralized, Access-protected endpoint with logging, policy enforcement, and curated tool access. The approach follows the shared-platform architecture Prince and Zatlyn described in their 2019 founders' letter https://blog.cloudflare.com/founders-letter/?ref=runtimewire : replace discrete network appliances with services delivered from one platform, then use the resulting traffic to improve additional products. Cloudflare began as an application for finding the source of email spam, and Zatlyn helped turn that visibility into the prevention service that became Cloudflare. Cloudflare's company history https://www.cloudflare.com/our-story/?ref=runtimewire New headers make MCP easier to identify MCP gives AI agents a standard way to discover and invoke tools connected to SaaS services, internal applications, and APIs. An employee can add a remote server with a short configuration change, potentially giving an agent access to source code, customer records, or infrastructure operations before the security organization knows the connection exists. Cloudflare calls those unapproved connections "shadow MCP." Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire The detection problem has been harder than looking for a familiar domain or URL path. An MCP server can sit at an ordinary HTTPS endpoint with no "mcp" string in its hostname or path. Cloudflare's earlier approach searched Gateway logs for likely names, paths, and JSON-RPC methods, which could miss ordinary-looking endpoints and flag unrelated services. Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire The July 28, 2026 MCP revision uses protocol headers on Streamable HTTP requests, including MCP-Protocol-Version , Mcp-Method , and, when applicable, Mcp-Name . Those headers give gateways a way to identify the operation without relying on the request body. Streamable HTTP transport specification https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http?ref=runtimewire Cloudflare says Gateway can classify inspected MCP requests, show the users and servers generating them, and block direct connections outside approved routes. The traffic must pass through Gateway with TLS inspection enabled. Cloudflare also says Gateway can distinguish requests crossing an approved MCP Portal from direct connections to upstream servers, while a dashboard breaks activity down by user, server, and connection path. Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire Administrators can inventory destinations, decide which servers belong in an MCP Server Portal https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/?ref=runtimewire , attach identity and tool policies, and block detected MCP requests that arrive through another route. Network controls compete with specialist agent gateways In Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire , AJ Gerstenhaber frames the threat around operational speed: an engineer can pause after an unexpected result, while an agent can repeat the same mistaken action thousands of times before a person intervenes. Cloudflare is tying MCP detection to identity, logging, and data loss prevention. An MCP request can carry credentials, a tool name, and arguments containing code, customer information, or instructions to change infrastructure. Gateway can stop an inspected request before it reaches the server, while response inspection and logging can show what the tool returned to the agent. These are Cloudflare's stated capabilities; their usefulness depends on the request crossing a managed, decrypted network path. Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire Specialist vendors are approaching the same governance gap closer to the agent and tool layers. Runlayer https://www.runlayer.com/blog/series-A-30m-fundraise-felicis-khosla?ref=runtimewire said in June that it raised $30 million in a Series A to develop identity, approvals, discovery, and runtime controls for enterprise agents. SurePath AI says https://www.surepath.ai/blog/advances-real-time-mcp-policy-controls?ref=runtimewire its policies govern which MCP servers and tools may be used before execution, with blocked tools removed from MCP payloads before they reach backend services. Those products emphasize agent-specific controls, while Cloudflare is using the secure web gateway, identity, and DLP systems its customers may already operate. Cloudflare's December 31, 2025 filing https://www.sec.gov/Archives/edgar/data/1477333/000147733326000016/cloud-20251231.htm?ref=runtimewire counted about 332,000 paying customers. Cloudflare has not tied that figure to use of its MCP products or disclosed MCP-specific customers, revenue, pricing, adoption, traffic volumes, or measured detection rates. The network view has hard edges Cloudflare's network controls cannot see local stdio servers, off-network traffic, unmanaged devices outside the managed path, or traffic excluded from TLS inspection. Server-side authorization also remains necessary because the server has the execution context needed to decide whether a caller may invoke a specific tool. Cloudflare's announcement https://blog.cloudflare.com/mcp-security-updates/?ref=runtimewire The supplied materials do not establish the controls' general availability. Cloudflare's announcement establishes a network detection and enforcement capability without showing how accurately it identifies MCP traffic in production or how widely customers have adopted it.