Cloudflare Enhances Security for AI Agent Traffic with New Cloudflare One Capabilities
Cloudflare has introduced new features within Cloudflare One to detect and secure Model Context Protocol (MCP) traffic, addressing the security risks posed by rapidly executing AI agents.
The proliferation of AI agents presents a significant security challenge, as their ability to execute actions at machine speed and with nondeterministic outcomes bypasses traditional security assumptions designed for human users. Unlike human operators who exercise judgment and act at a limited pace, AI agents can potentially perform thousands of incorrect actions before human oversight can intervene. Recognizing this shift, Cloudflare has announced new capabilities within its Cloudflare One platform aimed at providing enhanced visibility and control over Model Context Protocol (MCP) traffic, a standard protocol for AI agents to discover and invoke tools.
These new features allow administrators to identify which users and servers are generating MCP traffic, enforce controls on direct connections over managed network paths, and distinguish between legitimate MCP server access and potential bypass attempts. This is crucial because MCP servers, which provide agents access to third-party SaaS products, internal applications, and APIs, do not rely on fixed hostnames or specific URL paths, making their traffic difficult to distinguish from standard HTTPS API calls without deep inspection.
The Model Context Protocol itself facilitates agent interaction with various tools, but the underlying permissions granted to these tools remain a critical security concern. When an employee connects an AI agent to an MCP server, it can be as simple as a single line of configuration. Without proper controls, this can lead to unapproved access to sensitive resources, as the traffic lacks a distinct signature that network security tools can easily flag.
Cloudflare's approach focuses on three key areas for controlling MCP requests: within the MCP client, at the network boundary, and before the MCP server invokes a tool. Client-side hooks can intercept tool invocation decisions before a request is even sent, allowing for checks against allowlists or data sanitization. However, this requires standardization across all client applications used by an organization, which can be a significant challenge.
At the network boundary, secure web gateways can inspect HTTP requests after TLS decryption. This layer offers a broad view of remote MCP traffic on managed paths, enabling the identification and blocking of direct connections to unauthorized servers. Proxies can also perform data loss prevention scanning on request arguments, but they cannot monitor local stdio calls or traffic that bypasses the network perimeter.
The MCP server itself offers the richest context for security, as it has already authenticated the caller and parsed the MCP message. This is the final point of control before a tool is executed. Cloudflare's new capabilities aim to leverage signals within the MCP protocol, such as the MCP-Protocol-Version and Mcp-Method headers, along with the JSON-RPC envelope, to detect and enforce policies on MCP traffic.
By integrating these controls into Cloudflare Gateway, the platform can now use protocol signals to identify 'shadow' MCP traffic—traffic that is not using an approved path—and enforce access exclusively through MCP Portal-only connections to trusted MCP servers. This provides a much-needed layer of security and visibility for organizations grappling with the rapid adoption and potential risks of AI agents.