Cloudflare announced new Cloudflare One and Gateway capabilities to detect Model Context Protocol (MCP) traffic and help security teams govern it. Gateway can now classify TLS-inspected requests as MCP using the MCP-Protocol-Version header via a new experimental.is_mcp selector, distinguishing shadow MCP (unapproved servers) from Portal bypass (approved servers accessed directly, skipping the MCP Portal). A new MCP traffic dashboard shows hosts, users, and Portal vs direct traffic, and new Traffic Source selectors let admins write Gateway policies that block direct MCP connections not routed through an MCP Portal. The post also covers MCP Portals adding support for pre-registered OAuth clients (since MCP 2026-07-28 deprecated Dynamic Client Registration), upcoming private network connectivity for MCP Portals, and Cloudflare Agents SDK v0.20.0 adding support for the new stateless MCP 2026-07-28 specification alongside legacy initialize-based clients.
Table of contents
Copy link The anatomy of an MCP tool callCopy link Three places to control an MCP requestCopy link A URL does not tell you that a request uses MCPCopy link The protocol is becoming easier to identify on the wireCopy link Shadow MCP and approved-path bypass are separate problemsCopy link Detecting MCP traffic in GatewayCopy link Visibility into MCP traffic across your networkCopy link Bring discovered servers into an MCP PortalCopy link Enforcing Portal-only accessCopy link More MCP servers can now use the governed pathCopy link Bringing private MCP servers into the same PortalCopy link Agents SDK supports the new stateless modelCopy link Start with visibility, then close the paths that should not existQuestions this post answers
How can I detect MCP traffic in Cloudflare Gateway logs?
Cloudflare Gateway now inspects the MCP-Protocol-Version header on TLS-inspected HTTP requests and exposes a boolean selector, experimental.is_mcp, in Gateway HTTP logs and policies. This lets administrators identify MCP negotiation to any hostname without maintaining a manual list of MCP-looking domains or relying on hostname/path patterns like 'mcp' or '/sse'. daily.dev helps security teams track new Gateway detection features like MCP traffic classification as they ship.
What changed in the MCP 2026-07-28 specification compared to earlier versions?
MCP 2026-07-28 removes the stateful initialize handshake entirely, making the core protocol stateless by placing the protocol version and operation (via Mcp-Method and Mcp-Name headers) on every individual request. It also deprecates Dynamic Client Registration, pushing implementations toward pre-registered OAuth clients with fixed client IDs and secrets. Teams migrating MCP servers can follow protocol changes like this one on daily.dev before they cause breakage.
What is the difference between shadow MCP and MCP Portal bypass?
Shadow MCP is a connection to an MCP server the organization never approved, discovered informally by an employee with no visibility into its tools or data flow. Portal bypass is different: it involves an already-approved server that sits behind an MCP Portal, but an employee connects directly to its upstream URL, skipping the Portal's Access policy, tool catalog, and audit logging. daily.dev keeps developers securing AI agent traffic current on distinctions like shadow access versus policy bypass.