News · curated 16 Aug 2026
How Cloudflare detects MCP traffic and helps secure it
First reported cloudflare.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Unsanctioned 'shadow' MCP connections let AI agents invoke sensitive tools at machine speed without oversight, and Cloudflare's detection approach shows defenders how to surface and govern this otherwise-invisible agentic traffic.
Cloudflare announced new Cloudflare One capabilities to detect and secure Model Context Protocol (MCP) traffic, identifying inspected MCP traffic, showing which users and servers generate it, and controlling direct connections on managed network paths. The blog details the anatomy of an MCP tool call (JSON-RPC over HTTP with signals like Mcp-Method and Mcp-Name headers) and how Cloudflare Gateway uses protocol signals to find shadow MCP traffic and enforce MCP Portal-only access to trusted servers.