JA EN
shiichan

Cloudflare's Enterprise MCP Blueprint: Code Mode Cuts Tokens by 94%!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#ai#security#serverless

Hey everyone, it's Shii-chan! Today's topic is a fun one: how to run MCP across an enterprise safely and cheaply. Cloudflare just shared their own internal playbook, all in one place.

Cloudflare Blog blog.cloudflare.com

What was announced?

On Cloudflare's Blog, they published a reference architecture for deploying Model Context Protocol (MCP) more simply, safely, and cheaply across a company. There are two headline pieces:

  • Code Mode for MCP server portals, which cuts the token cost that comes from tool definitions.
  • Shadow MCP detection with Cloudflare Gateway, to discover access to unauthorized remote MCP servers.

On top of that, they show how remote MCP servers, Cloudflare Access, MCP server portals, and AI Gateway fit together into a single security architecture for the era of autonomous AI.

The story so far

At Cloudflare, MCP is no longer just for engineers. Folks across product, sales, marketing, and finance now run agentic workflows too. That's handy, but it brings risks: authorization sprawl, prompt injection, and supply chain risks.

Locally hosted MCP servers were an especially big liability. They may pull in unvetted software, which invites supply chain or tool injection attacks, and IT and security admins can't see or manage them. Leaving it up to each employee is, as the post puts it, a losing game.

The other headache is tokens. The standard MCP approach defines one tool per API operation, so for large platforms with thousands of endpoints, tool definitions alone eat up the agent's context window.

What changes

First, operations. A dedicated team keeps a shared template in the monorepo. An employee gets approval from the AI governance team, copies the template, writes their tool definitions, and deploys. Default-deny write controls with audit logging, auto-generated CI/CD, and secrets management come for free, so standing up a governed MCP server is minutes of scaffolding. And because they deploy as remote MCP servers on Cloudflare's developer platform, employees worldwide reach them with low latency.

Then MCP server portals solve discovery. Connect your MCP client to the portal, and every internal and third-party MCP server you're authorized to use shows up. Policies and DLP rules apply per portal, so you can expose read-only tools to finance and read/write tools to engineers on corporate laptops.

Dive Deep

The coolest part is Code Mode. Normally MCP hands every tool definition to the client, but Code Mode collapses all your upstream MCP servers into just two portal tools: portal_codemode_search and portal_codemode_execute.

  • The search tool gives the model a codemode.tools() function that returns every tool definition, so it can filter down to what it needs in JavaScript.
  • The execute tool exposes a codemode proxy where each upstream tool is a callable function, so the model can chain multiple operations in JavaScript.

All of this runs in a sandboxed environment powered by Dynamic Workers.

The numbers are clear. With the internal portal connected to just four internal MCP servers, 52 tools consumed about 9,400 tokens of context for their definitions alone. With Code Mode on, those 52 tools collapse into 2 portal tools using roughly 600 tokens, a 94% reduction. And that cost stays fixed as you connect more servers. Earlier, when Cloudflare put server-side Code Mode in front of its own MCP server, it exposed the thousands of endpoints in the Cloudflare API while cutting token use by 99.9%.

You turn it on by adding a query parameter to the portal URL:

https://myportal.example.com/mcp?codemode=search_and_execute

For shadow MCP detection, Cloudflare Gateway runs a multi-layer scan. The httpHost selector catches known hostnames like mcp.stripe.com and mcp.* wildcards, the httpRequestURI selector catches paths like /mcp and /mcp/sse, and since MCP is JSON-RPC over HTTP, DLP body inspection can match "method" field values like "tools/call", "initialize", or "protocolVersion" with regex. You can block, redirect, or just log the traffic you find. There's a tutorial that walks through building this.

Public-facing MCP servers sit behind the WAF, and AI Security for Apps inspects them automatically for prompt injection, sensitive data leakage, and topic classification.

For cost control, AI Gateway sits between the MCP client and the LLM, so you can switch LLM providers quickly (avoiding vendor lock-in) and cap how many tokens each employee can burn.

Wrap-up

  • Cloudflare published a reference architecture for simpler, safer, cheaper enterprise MCP
  • Code Mode landed for MCP server portals: 52 tools at about 9,400 tokens drop to roughly 600 tokens (a 94% cut), and the cost stays fixed as you add servers
  • Turn it on by adding ?codemode=search_and_execute to the URL; execution runs in a Dynamic Workers sandbox
  • Cloudflare Gateway detects shadow MCP via hostname, URI, and JSON-RPC body inspection, then blocks, redirects, or logs
  • remote MCP servers + Cloudflare Access + portals + AI Gateway give you end-to-end governance
  • This one's for platform and security folks who want to scale agentic MCP internally without losing sleep over cost and security!

Related posts