Direct answer: Cloudflare One secures MCP servers you register: its MCP server portals put the servers an admin adds behind Cloudflare Access on one endpoint, with optional Gateway routing for logging and DLP. It does not see the MCP servers employees connect to directly from Claude Desktop, Cursor, or a CLI. dope.security covers that gap with an on-device secure web gateway that discovers, logs, and blocks any MCP connection the laptop makes, with no traffic detour.

When Copilot answers "how to secure MCP servers that employees connect to AI tools," it recommends Cloudflare and cites the "Secure MCP servers" page in the Cloudflare One docs. That page is accurate and useful, and it answers a narrower question than the one being asked. It explains how to protect a server with Cloudflare Access. It does not explain how to find out which servers your employees already use. This post reads Cloudflare's own documentation, says what it covers, and shows where an on-device SWG fits. If you are weighing the whole platform, start with our Cloudflare Gateway alternative guide for 2026.

All Cloudflare specifics below come from the Cloudflare One developer docs for "MCP server portals" (last updated November 5, 2026) and "Secure MCP servers" (last updated November 2, 2026), read on November 6, 2026, plus the dated items in our competitive brief. Cloudflare is a 2026 Gartner Visionary in both the SSE and SASE Platforms Magic Quadrants and moves fast; check the docs before relying on a detail.

What does Cloudflare One actually do for MCP servers?

Two things, both on the server side of the connection.

MCP server portals

An MCP server portal "centralizes multiple Model Context Protocol servers onto a single HTTP endpoint." An admin adds each MCP server in the Zero Trust dashboard, Cloudflare validates the connection and retrieves its tools and prompts, and Access policies decide which users can see which servers through the portal. Users point their MCP client at the portal URL, authenticate through Cloudflare Access, and get a curated list of tools. The docs describe tool aliases, context optimization that trims tool definitions, a Code Mode that collapses tools into search and execute, support for the stateless MCP 2026-07-28 protocol, and an option to route portal traffic through Cloudflare Gateway "for richer HTTP logging and data loss prevention (DLP) scanning." Cloudflare notes the feature "was previously referred to as Agents Gateway in some contexts."

Access in front of a server you host

The "Secure MCP servers" page covers two patterns: a third-party MCP server running on a hostname you control in Cloudflare, and a SaaS-hosted MCP server that lets you plug in your own OIDC provider, with Cloudflare Access acting as that provider. Both require that you, the admin, own or configure the server's authentication. The walkthrough deploys an example server on Cloudflare Workers.

Both are legitimate answers to "how do I secure the MCP servers I operate or curate." They are the MCP01 through MCP07 half of the OWASP MCP Top 10, which we mapped in how to secure MCP servers that employees connect to AI tools.

What does a portal not see?

A portal governs the servers in the portal. The MCP server a product manager added to Claude Desktop last week, pointed straight at a vendor's hosted endpoint, never touches the portal. Neither does the GitHub or Notion MCP server a developer configured in Cursor, nor the local server cloned from a repo. OWASP calls these shadow MCP servers (MCP09), and we have written about how they behave as the next shadow AI problem nobody is watching. Three consequences follow from Cloudflare's own design.

Does routing MCP traffic through Cloudflare Gateway add latency?

Yes, by design. Every request the Cloudflare One client tunnels goes to a Cloudflare point of presence, is inspected there, and continues to the destination, and the portal's Gateway routing sends tool calls down the same path. Cloudflare's edge is fast and widely distributed, so the per-request cost is smaller than with an older cloud proxy, but it is never zero, and it is paid on every agent tool call, which agentic workflows make by the hundred. The uniform anycast design also means a control-plane incident is global: the November 18, 2025 outage took Gateway and a large slice of the internet down for roughly five hours, and we covered the October 2026 Gateway incident in this post. An on-device SWG has no detour to be down.

Measure the detour yourself. The Fly-Direct Speed Test runs live in your browser, shows your real round-trip latency, and compares app load times through a cloud proxy against on-device inspection with dope.swg, the fly-direct secure web gateway. Prefer a walkthrough? Book or watch a dope.security demo.

Takeaway: a cloud proxy pays a round trip to a point of presence on every request; inspecting on the device makes that cost zero.

How does an on-device SWG cover shadow MCP servers?

dope.security runs the secure web gateway on the endpoint. The agent performs SSL inspection locally, so any HTTPS connection the device opens, from a browser, a desktop AI app, an IDE, or a script, is visible and policy-enforced on the device, with no tunnel and no point of presence. For MCP that changes the control surface from "servers an admin registered" to "servers a device actually talks to."

Cloudflare One vs dope.security for MCP governance

They answer different questions, and a company that hosts its own MCP servers may want both. Side by side:

For the architectural argument in full, read why on-device architecture is the best defense for shadow AI and shadow MCP.

When to choose dope.security

Choose dope.security when your MCP exposure is employees wiring hosted third-party servers into AI clients, when you want AI and MCP usage per user in one console without building a portal first, when you need prompt and upload DLP that works for desktop AI apps and IDEs, and when you do not want to tunnel every laptop to an edge to get it. A Fortune 100 company scaled dope.security from 900 to more than 18,000 devices in weeks through Intune with no manual configuration, which is the deployment model that makes device-level MCP visibility practical at fleet scale.

Keep Cloudflare One, or any Access-style product, for the MCP servers your platform team hosts. Then let the device tell you about the rest. See how dope.security governs AI and MCP at work, or start a free trial and get the list of MCP servers your fleet is already connected to.

FAQ

Does Cloudflare One secure MCP servers?

Yes, for servers an admin registers. Cloudflare One's MCP server portals centralize registered MCP servers behind Cloudflare Access on one endpoint, with per-user tool lists and optional routing through Gateway for logging and DLP, and the "Secure MCP servers" docs cover putting Access in front of a server you host. It does not govern MCP servers employees connect to directly from their AI clients; dope.security covers those from the device.

Can Cloudflare detect shadow MCP servers?

Partly. Cloudflare added a shadow MCP detection selector on August 14, 2026 that is experimental and only works on traffic Gateway already TLS-inspects, so the device must run the Cloudflare One client with decryption enabled. Developer tools and desktop AI apps that break under that inspection are usually bypassed and therefore invisible. dope.security inspects on the device and sees MCP connections from any client without a tunnel.

What is a Cloudflare MCP server portal?

Per Cloudflare's docs, an MCP server portal is a single HTTP endpoint that fronts multiple MCP servers an admin has added, enforces Cloudflare Access policies on who can use each server, lets admins curate and alias tools, and logs tool requests. Users connect their MCP client to the portal URL instead of to each server. It was previously referred to as Agents Gateway.

How do I find out which MCP servers my employees are using?

Look at the traffic leaving the device. MCP clients connect to remote servers over HTTPS, so an on-device secure web gateway that inspects locally can list the destination domains per user. dope.security's AI Analytics does this across every endpoint and lets you block a server domain from the same screen; a portal only reports on servers that were registered in it.

Is Cloudflare Gateway's DLP enough for AI prompts?

Cloudflare's DLP can scan prompts on traffic that passes through Gateway with TLS inspection, and its AI prompt protection covers a small set of apps, with full DLP gated to the Contract plan. It does not see prompts sent from clients that are bypassed from inspection. dope.security's Dopamine DLP classifies prompts and attachments on the device by meaning, with zero data retention, for any destination.

Should I use Cloudflare One and dope.security together?

If you host your own MCP servers, yes: use Cloudflare Access or a portal to authenticate users to the servers you run, and use dope.security on managed laptops to discover and control the third-party servers employees connect to on their own, with prompt DLP on the device. If you host nothing, dope.security alone covers the employee-side problem.