Cloudflare One Gateway adds MCP traffic detection and enforcement

Cloudflare added first-class identification, monitoring, and control of MCP traffic to its Zero Trust Gateway, targeting shadow-MCP discovery and blocking of unapproved servers. Detection keys on the MCP-Protocol-Version HTTP header: the MCP 2025-11-25 spec requires it, and the 2026-07-28 stateless spec puts it on every POST while adding Mcp-Method/Mcp-Name. A new experimental.is_mcp boolean selector is available to all Zero Trust customers, with a dedicated MCP dashboard. Traffic Source selectors enable Portal-only enforcement, and MCP Portals support pre-registered OAuth clients. Agents SDK v0.20.0 supports the stateless 2026-07-28 spec as both client and server.

For enterprise security teams, this is the first widely deployed network-level enforcement for MCP: they can discover and block shadow MCP servers without maintaining domain lists. It removes one of the main blockers to rolling out agents in the enterprise.