Summary
In mid-August 2026 (changelog August 12, blog August 14), Cloudflare One gained the ability to detect Model Context Protocol traffic inside TLS-inspected sessions, surface it in a new AI Security dashboard, and enforce approved-Portal-only access, letting security teams find shadow MCP usage and block direct agent connections.
What changed
Cloudflare Gateway now inspects the MCP-Protocol-Version header on TLS-inspected requests, exposes an experimental.is_mcp selector in logs and policies, ships an AI Security dashboard of MCP hosts and users, and adds Traffic Source selectors distinguishing Cloudflare MCP Portal-proxied requests from direct connections.
Why it matters
MCP is becoming the default way agents reach tools and data; giving network and security teams visibility and enforcement over MCP traffic addresses a fast-growing shadow-IT and data-exfiltration risk in agentic deployments.
Evidence excerpt
Cloudflare Gateway identifies MCP requests using protocol-level heuristics. Security teams can use that signal to find shadow MCP traffic, enforce Portal-only access for approved servers, and block direct connections on managed network paths.