HOW CLOUDFLARE DETECTS MCP TRAFFIC AND HELPS SECURE IT

Summary from the TLDR InfoSec newsletter

Cloudflare has introduced protocol-level detection for Model Context Protocol (MCP) traffic in Gateway by analyzing the MCP-Protocol-Version header on TLS-inspected requests. Security teams can now combine the experimental.is_mcp boolean selector with the mcp_portal traffic source tag to mandate that all agent traffic routes through approved portals, effectively blocking direct shadow MCP connections. Furthermore, the update delivers a dedicated traffic dashboard, pre-registered OAuth client support, and Agents SDK v0.20.0 to bridge compatibility between legacy handshakes and the new stateless MCP 2026-07-28 specification.