Stop the "Thousands of Tickets Closed" Disaster: Cloudflare's WriteGuard Guards MCP Server Writes with 4 Risk Tiers

Hi everyone, it's me! Today I want to tell you about a security feature Cloudflare has been battle-testing internally, and it's a little nerve-wracking in the best way. Giving an agent write access is so convenient, but also a bit scary, right? This announcement tackles exactly that.

Cloudflare Blog blog.cloudflare.com

What was announced?

On the Cloudflare Blog, Cloudflare announced WriteGuard, a new feature for MCP servers, now in private beta. According to the original post, WriteGuard is "a shared policy, attribution, and auditing layer." It lets Cloudflare allow, log, or block write operations (tool calls) that agents make through MCP servers, based on how risky each action is.

Until now, WriteGuard was purely an internal Cloudflare tool. The news here is that it's opening up to Cloudflare MCP Server Portals users through a private beta.

The story so far

Cloudflare runs an internal MCP server portal: the servers sit behind Cloudflare Access, and everything connects through a single internal portal. Per the post, 27 servers are connected as of publication, with teams shipping more every month.

At first, every server was read-only, letting people search Jira, GitLab, internal wikis, and operational systems. But as models got better and teams built up experience, requests for actionable tools started coming in from engineering, product, design, sales, and customer success alike.

The problem: once you open up write access, it gets hard to tell who actually did what. The post shares an unsettling example where an agent closes ticket after ticket, and by 4 p.m. thousands of tickets have been closed. Worse, the system records all of it under the human owner's name (the post calls him Joe), so there's no way to tell whether Joe or his agent did it. Cloudflare couldn't rely on every employee configuring every agent perfectly or watching every tool call, so it built WriteGuard before expanding write access.

What changes

With WriteGuard, every tool can be pre-classified by how risky it is. The post describes four risk tiers:

• Read Only: no logging, always allowed (e.g. Jira search, viewing an MR)
• Minimal Impact: logged, allowed (e.g. adding a reaction, marking a notification read)
• Contained Write: logged with attribution, allowed (e.g. adding a comment, opening an MR)
• Critical: blocked (e.g. merging an MR, deploying to production)

So it's a three-tier posture: let light actions through quietly, let moderate actions through with a log and a label, and stop dangerous actions from running at all. Authentication doesn't rely on separate agent accounts either — it uses the employee's own OAuth credentials, so the agent acts "as that person." That keeps permission management simple, while WriteGuard records which human and which agent session actually performed the action.

Dive Deep

The GitLab example in the post makes this concrete. Three tools, three different behaviors:

• get_merge_request (READ_ONLY): WriteGuard passes it through untouched
• create_mr_note (CONTAINED_WRITE): WriteGuard adds a label showing the action came from an agent (something like "via Agent") to the comment body before executing it, then logs an audit event asynchronously
• merge_mr (CRITICAL): since this can trigger a production deployment pipeline, WriteGuard blocks it before the handler ever runs, logging only the attempt

Right now, policies are configured in TypeScript inside Cloudflare's internal monorepo. The post shares an example like this:

const sendEmailTool = {
  tool: EmailMCP.sendEmailTool,
  writeGuard: {
    riskLevel: RiskLevel.CONTAINED_WRITE,
    enabled: true,
    labeling: {
      field: "body",
      supportedFormats: [
        LabelFormat.PLAIN_TEXT,
        LabelFormat.HTML,
      ],
    },
  },
};

Audit events record the server, tool, risk tier, outcome (success, failure, or blocked), user, client, and duration. Sensitive values are scrubbed before logging.

During the private beta, Cloudflare MCP Server Portals users will be able to configure similar policies themselves. The post is clear that "the beta will start small and expand over time, leading up to general availability." There's no pricing information in the post, so I'll be upfront that I can't tell you what it'll cost.

Wrap-up

• WriteGuard is a policy, attribution, and auditing layer that protects write operations on MCP servers
• Cloudflare has already deployed it across 27 internal MCP servers, and is now opening a private beta to external Portal users
• Tools are classified into four risk tiers — Read Only, Minimal Impact, Contained Write, and Critical — with dangerous actions blocked before they run
• Authentication uses the employee's own OAuth credentials, so agent actions are correctly attributed to a human
• It stops irreversible actions like merging an MR while letting lighter actions like adding a comment flow through smoothly
• This one's for platform and security teams who are trying to safely expand agent write access inside their own organizations