Start with what is on the wire. In the example request Cloudflare publishes, five things identify the call: the hostname and path, an Authorization header carrying a bearer token, and three headers only an MCP client sets, MCP-Protocol-Version, Mcp-Method and Mcp-Name [5]. Two of those signals belong to every HTTPS request, which leaves three as the detection surface [6]. That is why the match is on protocol signals rather than on destination [14].
Header detection is cheap and it is voluntary. Cloudflare attributes Mcp-Method and Mcp-Name to what it calls the new stateless protocol, and the sample advertises MCP-Protocol-Version: 2026-07-28 [7][5]. A client on an older revision will not set them. It will still send the JSON-RPC envelope, which repeats the method, carries an id the client matches against the response, and puts the tool arguments in params [8]. The method therefore exists in two copies, and stripping the header leaves only the copy in the body [15]. Reading that copy means terminating TLS on the path. The word doing the load-bearing work in the announcement is "inspected" [1]: certificates, routing, and the paths you already decrypt are the prerequisite, not the deliverable.
The grant that passed review was sized for a caller who stops when a result surprises them, which is Cloudflare's own framing of the old bound [c2b]. In my experience the identity layer answers who holds the token, not how often it gets used. So the difference between the engineer and the harness running as that engineer surfaces first as traffic volume, and that is the honest argument for putting the control where volume is visible rather than in another policy document.
The shadow side of this is a configuration problem, not a protocol one. Cloudflare says connecting an agent to a tool server can take a single line of config, and that an employee can point Claude Code, Codex, Cursor, OpenCode or VS Code at a server without checking whether it is approved [11]. Hence the enforcement primitive: with MCP Server Portals in place, Gateway is meant to answer whether the agent used the approved path or went around it [14].
For the mechanism to transfer to your estate, three things have to hold. The agent traffic has to cross a network path you manage. That path has to be inspected. Your clients have to emit the MCP headers, or you have to be willing to parse JSON-RPC bodies at volume. Miss the first and the other two are decoration, because the laptop on a home network never enters the control surface. Then budget for the log store, since Cloudflare's own inventory of what tool arguments can hold includes source code, customer data, and instructions to change infrastructure [9], and inspection moves all of it somewhere that needs a retention policy.
