Cloudflare Gateway can now auto-detect MCP traffic, plus a new AI Security dashboard!

Hi, it's Shii! Today I found an announcement about AI agent security that caught my eye. The traffic AI agents generate inside company networks hasn't really been visible until now, and that's about to change!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Cloudflare Gateway can now automatically detect Model Context Protocol (MCP) traffic. MCP is the standard protocol AI agents use to connect to external tools and data sources. Gateway identifies MCP requests by inspecting protocol-specific headers and payload characteristics.

Alongside this, a new HTTP policy selector called experimental.is_mcp (currently in beta) lets you build rules that allow, block, or isolate MCP traffic. There's also a brand-new "AI security report" dashboard under Insights & Logs.

The story so far

Until now, Gateway policies could control traffic based on things like destination URL or application category, but there was no way to specifically identify whether traffic was an AI agent talking over MCP. That made it hard for organizations to get a real picture of which tools and servers their AI agents were actually reaching.

What changes

With the Is MCP selector, you can build policies like "block MCP traffic that doesn't arrive through an approved MCP portal." That makes it easier to stop rogue AI agents from freely reaching external MCP servers, while still letting traffic through approved routes.

The AI security report dashboard brings together:

• Total MCP request volume, unique users, and unique MCP servers
• A timeseries chart of unique MCP servers observed over time
• A summary of the Gateway policies that target MCP traffic

For security and network admins, being able to see, in numbers and charts, who inside the company is using which AI agent tools and how much, for the first time, is a genuinely big deal.

Dive Deep

The detection itself works by inspecting protocol-specific headers and payload characteristics, so it's not as simple as watching a fixed port number. It sounds like Gateway is looking at the actual nature of MCP communication to make the call.

The original post explicitly notes that the Is MCP selector is "currently in beta and may change before general availability," so if you're building it into production policies, it's worth assuming the behavior could shift before GA.

The announcement doesn't get into pricing or detailed setup steps, pointing readers to the "HTTP policies" documentation instead.

Wrap-up

• Cloudflare Gateway can now automatically detect MCP traffic based on header and payload characteristics
• The new Is MCP HTTP policy selector (experimental.is_mcp, in beta) lets you allow, block, or isolate MCP traffic
• A new "AI security report" dashboard visualizes MCP request volume, unique users, and unique MCP servers

If you're a security or network admin who's watched AI agent usage spread across your org with no real visibility into it, this one's for you!