Field note
Cloudflare Gateway now identifies MCP requests with protocol-level heuristics so security teams can discover shadow MCP traffic and apply access policy on managed network paths.
New Runtime reading: Agent security is moving outside the model. Network observation can distinguish approved portal access from direct server connections even when an agent's internal reasoning is opaque, but it covers only traffic that actually crosses the managed path.
Evidence boundary: this item uses the listed public sources and keeps vendor, author, or reporter claims attributed. The queued page is an editorial synthesis, not an independent validation of every reported metric.