Cloudflare Gateway detects MCP traffic by protocol header, not hostname

Cloudflare Gateway now identifies MCP traffic from the MCP-Protocol-Version header rather than hostname or path, since a direct MCP call otherwise looks like ordinary HTTPS. That gives security teams an experimental.is_mcp policy selector, a dashboard of MCP servers and users, and Traffic Source selectors that block devices bypassing the approved MCP Portal. Detection requires TLS decryption and covers only traffic crossing Gateway — local stdio servers and off-network calls stay invisible.

出典： blog.cloudflare.com ↗