Cloudflare's WriteGuard Adds Access Control to MCP Servers

Cloudflare has put WriteGuard into private beta: a policy, attribution, and audit layer that sits between its MCP server portal and every connected tool, classifying each call by risk tier and intercepting writes before they execute. The problem it solves is concrete. Cloudflare's own engineering blog describes an internal incident in which a background agent running under an engineer's OAuth identity closed thousands of Jira tickets in an afternoon — at a pace no human could sustain — before anyone caught it. The system logged every action under the engineer's name with no way to separate human from agent.

WriteGuard intercepts all incoming MCP requests at the portal layer, loads the policy bound to the targeted tool, and decides: pass unchanged, enrich with attribution and emit an audit event, or block before execution. Policy is defined in TypeScript alongside the tool configuration—no changes to the MCP server itself. That matters at scale. Cloudflare's internal portal grew from 13 connected servers in April 2026 to 27 today, spanning GitLab, Jira, an internal wiki, Google Workspace, and operational systems. Building the same controls into each server independently would produce inconsistent behavior across every new server added.

Risk tiers drive the routing logic. Read-only calls (searching issues, reading a merge request, viewing pipeline status) pass through unchanged. Minimal-impact calls (adding a reaction, marking a notification as read) are logged. Contained writes (creating a merge request, adding a comment, updating an issue field) get agent attribution injected into the downstream application in the format that application accepts, plus an async audit event. Critical operations (merging to main, triggering a production deployment, bulk-deleting records) are blocked outright before execution. Tiers are configurable per tool; a merge_mr tool classified as Critical will never execute without an explicit policy allowing it.

Identity threading is the hard part. WriteGuard does not introduce standalone agent accounts. Internal MCP servers already use Cloudflare Access and OAuth to identify users, so agents inherit the human's permissions—if the engineer cannot close a particular issue, the agent cannot either. But inheritance alone does not solve attribution. The audit trail appends MCP client and session context to the human identity, so the log distinguishes "Joe, Claude Code, session abc123" from "Joe, browser." Audit events are sent asynchronously—adding zero latency to the tool call path—and are scrubbed of secret-bearing key values. Each event records: server, tool, risk tier, outcome, user, client, and duration.

The timing reflects broader pressure. Security researchers have found over 21,000 internet-facing MCP server instances, with approximately 92% lacking basic OAuth authentication. The MCP 2026-07-28 specification shifted to stateless architecture and introduced mandatory HTTP headers (Mcp-Protocol-Version, Mcp-Method, Mcp-Name) that let Cloudflare Gateway detect shadow MCP traffic—employees connecting local agents directly to unapproved external servers—at the network layer. WriteGuard is the server-side complement: because the control lives at the server, an end user cannot bypass it by switching clients or disabling a local hook.

Private beta is live; GA timeline is unspecified. Cloudflare wants to validate how the risk model maps to customer tools, which downstream applications need specific attribution formats, and what audit delivery guarantees production customers require before broad rollout.

For architects shipping internal tool-calling agents, the implicit security model—"the agent has the user's permissions, so it's fine"—breaks the moment an agent acts at machine speed on a too-broad prompt. WriteGuard is table stakes. Build the risk tier classification into your tool definitions before you wire write access into any agent pipeline.