Field note
Cloudflare's MCP update makes the agent security boundary visible at the client, the network, and the server. Gateway with TLS inspection can classify conforming MCP traffic from protocol signals and expose the experimental.is_mcp selector in policy. Traffic Source metadata lets policy distinguish requests routed through an MCP Portal from detected direct connections, while server middleware can still deny a call before its tool handler runs.
The mechanism is layered coverage: the network sees many remote connections, while clients and servers retain deeper context about the requested operation. This matters now because an employee can connect a coding harness to an MCP server with little friction and repeat a mistaken action at machine speed.
Security teams can begin with visibility, move approved servers behind Portals, and block direct managed-device paths without pretending the network replaces tool-level authorization. The evidence boundary is important: local stdio, off-network, Do Not Inspect, nonconforming, and undecrypted traffic can remain outside Gateway's view. Watch the selector's general-availability contract and whether tool-level reporting works across both known and shadow MCP servers.