Cloudflare Announces New Security Capabilities for MCP Traffic

What happened

Cloudflare is introducing new Cloudflare One capabilities to identify inspected MCP traffic, show which users and servers generate it, and control direct connections on managed network paths. These controls help administrators see if agents are using an approved path or bypassing it. The update includes a dedicated MCP traffic dashboard, a `experimental.is_mcp == true` Gateway selector, and support for the new stateless MCP 2026-07-28 specification in the Agents SDK v0.20.0.

Why it matters

AI agents pose new security risks because they can make nondeterministic decisions and act indefinitely without human oversight. MCP traffic is difficult to detect as it mimics standard HTTPS calls. Cloudflare's new tools allow security teams to detect shadow MCP traffic, enforce Portal-only access, and stop unauthorized actions before they execute.