JA EN
shiichan

Wait, you can now connect to MCP servers on your private network? Cloudflare's new feature is incredibly handy!

Cloudflare Changelog ★★★★★ View Markdown
#cloudflare#ai#security

Hey everyone, it's Shiichan! I've got news for anyone building MCP servers today!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that MCP server portals can now connect to MCP servers available only on your private network. The portal reaches private hostnames and IP addresses through Cloudflare Gateway, so you can use an MCP server without ever exposing it to the public internet.

Why it matters

MCP servers are powerful, but they often need access to internal systems or private data, and exposing that directly to the public internet is scary. On the other hand, connecting over a VPN by hand every time is a hassle too. Being able to keep your MCP server inside a zero trust setup while still using it is a big deal for anyone who wants to wire MCP into internal business systems.

What changes

If you connect your server's network to Cloudflare with Cloudflare Tunnel, Cloudflare Mesh, or another Cloudflare One connector, you can now safely expose an internal-only MCP server through an MCP server portal. Since it never touches the public internet, your attack surface shrinks significantly.

Dive Deep

Here's the setup flow:

  • Configure a private hostname or a CIDR route
  • Turn on "Route traffic through Cloudflare Gateway" when you add the server to the portal

There's one important catch, though: the OAuth authorization server endpoints (the authorization and token endpoints, plus the dynamic client registration endpoint if you use DCR) still need to stay reachable from the public internet. Only the authentication-related pieces need to remain externally accessible, which is worth remembering when you set this up.

Wrap-up

  • MCP server portals can now connect to MCP servers on your private network
  • Cloudflare Gateway reaches private hostnames and IPs, so the MCP server never needs public exposure
  • Connect your network with Cloudflare Tunnel, Mesh, or another connector, then enable Gateway routing when adding the server
  • OAuth authorization/token endpoints (and the DCR endpoint, if used) must stay publicly accessible

This is exactly what developers need if they want to safely expose MCP servers that talk to internal systems!

Related posts