Cloudflare has introduced new detection and control capabilities in Cloudflare One aimed at a growing blind spot: AI agents connecting directly to Model Context Protocol (MCP) servers without oversight. The company says these controls let administrators identify which users and servers are generating MCP traffic and enforce whether agents are using approved paths or quietly routing around them.
MCP servers give AI agents a standardized way to discover and call tools tied to SaaS products, internal applications, and APIs. Cloudflare notes that the underlying permissions are usually the same ones already granted to human employees, but the risk profile changes dramatically once an agent is making the decisions. Humans are slowed by judgment and physical limits; an AI agent can repeat the same flawed decision thousands of times before anyone notices.
Connecting an agent to an MCP server can take a single configuration line, and tools such as Claude Code, Codex, Cursor, OpenCode, and VS Code can all be pointed at a server without any approval check. Because MCP does not require a fixed hostname or a predictable URL path, this traffic can blend in with ordinary HTTPS API calls, making it difficult to spot with conventional network monitoring.
How an MCP request reveals itself
Cloudflare breaks down the anatomy of an MCP tool call into three stages: the client’s decision to invoke a tool, the resulting HTTP transaction carrying a JSON-RPC message, and the server-side execution of the tool handler. Useful signals appear throughout, including headers like MCP-Protocol-Version, Mcp-Method, and Mcp-Name, along with the JSON-RPC payload itself. The arguments inside that payload are the most sensitive part of the exchange, since they can carry search queries, source code, customer data, or instructions to take an action like creating a ticket or modifying infrastructure.
Three points of control
Cloudflare identifies three places security teams can intervene: inside the MCP client itself, at the network boundary, and at the MCP server. Client-side hooks can catch a call before it is even serialized for the network, but they require consistent deployment across every AI tool employees might use, and they miss local stdio-based MCP servers that never touch the network at all.
The network layer, Cloudflare argues, offers the broadest visibility. A secure web gateway with TLS decryption can associate MCP requests with a specific user and device, inspect protocol headers, and apply policy regardless of which client generated the traffic. This lets Cloudflare Gateway detect “shadow” MCP traffic, meaning direct connections to servers that bypass an organization’s approved MCP Portal, and block them before they reach their destination. Where supported, data loss prevention scanning can also inspect JSON-RPC methods and arguments for sensitive data in transit.
For WordPress hosts and agencies experimenting with AI coding assistants or automation agents, the underlying lesson applies broadly: any credential or API access granted to a human user should be re-evaluated for the blast radius it creates when handed to an agent that can act continuously and without pause.