--- title: "How Cloudflare detects MCP traffic and helps secure it" url: https://daily.dev/posts/how-cloudflare-detects-mcp-traffic-and-helps-secure-it-vvsttepxz source_url: https://blog.cloudflare.com/mcp-security-updates type: article source: "Cloudflare" published: 2026-08-14T13:30:10.676Z updated: 2026-08-14T13:31:12.098Z tags: ["security", "ai-agents", "mcp", "cloudflare"] reading_time: 17 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Cloudflare detects MCP traffic and helps secure it **[Cloudflare](https://daily.dev/sources/cloudflare)** · 17 min read · 0 upvotes · 0 comments ## Summary Cloudflare announced new Cloudflare One and Gateway capabilities to detect Model Context Protocol (MCP) traffic and help security teams govern it. Gateway can now classify TLS-inspected requests as MCP using the MCP-Protocol-Version header via a new experimental.is_mcp selector, distinguishing shadow MCP (unapproved servers) from Portal bypass (approved servers accessed directly, skipping the MCP Portal). A new MCP traffic dashboard shows hosts, users, and Portal vs direct traffic, and new Traffic Source selectors let admins write Gateway policies that block direct MCP connections not routed through an MCP Portal. The post also covers MCP Portals adding support for pre-registered OAuth clients (since MCP 2026-07-28 deprecated Dynamic Client Registration), upcoming private network connectivity for MCP Portals, and Cloudflare Agents SDK v0.20.0 adding support for the new stateless MCP 2026-07-28 specification alongside legacy initialize-based clients. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I detect MCP traffic in Cloudflare Gateway logs? Cloudflare Gateway now inspects the MCP-Protocol-Version header on TLS-inspected HTTP requests and exposes a boolean selector, experimental.is_mcp, in Gateway HTTP logs and policies. This lets administrators identify MCP negotiation to any hostname without maintaining a manual list of MCP-looking domains or relying on hostname/path patterns like 'mcp' or '/sse'. _daily.dev helps security teams track new Gateway detection features like MCP traffic classification as they ship._ ### What changed in the MCP 2026-07-28 specification compared to earlier versions? MCP 2026-07-28 removes the stateful initialize handshake entirely, making the core protocol stateless by placing the protocol version and operation (via Mcp-Method and Mcp-Name headers) on every individual request. It also deprecates Dynamic Client Registration, pushing implementations toward pre-registered OAuth clients with fixed client IDs and secrets. _Teams migrating MCP servers can follow protocol changes like this one on daily.dev before they cause breakage._ ### What is the difference between shadow MCP and MCP Portal bypass? Shadow MCP is a connection to an MCP server the organization never approved, discovered informally by an employee with no visibility into its tools or data flow. Portal bypass is different: it involves an already-approved server that sits behind an MCP Portal, but an employee connects directly to its upstream URL, skipping the Portal's Access policy, tool catalog, and audit logging. _daily.dev keeps developers securing AI agent traffic current on distinctions like shadow access versus policy bypass._ ## Similar posts on daily.dev - [Scaling MCP adoption: Our reference architecture for simpler, safer and cheaper enterprise deployments of MCP](https://daily.dev/posts/scaling-mcp-adoption-our-reference-architecture-for-simpler-safer-and-cheaper-enterprise-deploymen-xzjbylial) · Cloudflare · 1 upvotes · 0 comments - [What CISOs need to know about new tools for securing MCP servers](https://daily.dev/posts/what-cisos-need-to-know-about-new-tools-for-securing-mcp-servers-5z1ny9azn) · CSO Online · 0 upvotes · 0 comments - [Give any website a WebMCP interface](https://daily.dev/posts/give-any-website-a-webmcp-interface-h0qmmm3j8) · Cloudflare · 6 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/how-cloudflare-detects-mcp-traffic-and-helps-secure-it-vvsttepxz)