I know what someone will say: we know what tools we use. Let us look at the dashboard, then we will talk.
Fact
The facts: on 14 August 2026 Cloudflare announced detection of MCP traffic through protocol level heuristics in Gateway. It ships a policy selector that isolates MCP requests and a dashboard with request counts, unique users and servers, broken down by how they were reached. MCP servers outside approved portals are shown separately. A traffic label for portal traffic was added, along with manual OAuth credentials for portals. The agents kit moves to the MCP specification dated 28 July 2026. The features go to Zero Trust customers.
Here is what actually changed. Until now MCP was something a developer wires up alone, in ten minutes, and nobody in the company knows. From here it is visible.
First you see it. Then you manage it. In that order, never the reverse.
We run MCP throughout our own work, which is exactly why I am curious what lands in the shadow column. I will run it and tell you what I saw.
There is no CVE number here and I have not left one out. Nothing was breached; this is a tool for seeing. We keep the rule: a security piece without a CVE gets explained, not glossed over.
Official primary sources
Cloudflare Blog - How Cloudflare detects MCP traffic and helps secure itThe visual is generated code-art, no third-party images.