Agent Permissions and Blast Radius

Cloudflare pins shadow MCP traffic on three protocol headers

Agent tool calls look like ordinary HTTPS, so Cloudflare's new controls match on protocol headers rather than on destinations. They only see traffic you already decrypt, which is where the adoption cost sits.