MCP Connections Are a Security Gap: Cloudflare’s Answer Is a Centralized Portal

Large language models are moving past simple Q&A toward real agency — retrieving data, updating tickets, and triggering workflows across SaaS tools and internal systems. That shift relies on the Model Context Protocol (MCP), the open standard that lets an LLM client like Gemini, Claude, or ChatGPT reach into applications ranging from Slack to Jira to custom databases. In principle, MCP turns a model into a teammate. In practice, it also opens an attack surface that most organizations haven’t mapped, let alone secured.

Cloudflare’s response is MCP Server Portals, now in Open Beta as part of Cloudflare One. The idea is to give every MCP connection in an organization a single front door: a place to register, authenticate, authorize, and observe all MCP server traffic instead of leaving each connection point scattered and unmanaged.

How MCP Works in Practice

MCP functions as a standard protocol layer between two distinct components:

  • MCP clients — the LLM front ends (ChatGPT, Claude, Gemini) that users interact with.
  • MCP servers — the adapters for individual applications. SaaS vendors may ship their own servers, or an organization’s developers can build custom ones for internal tools.
BLOG-2882 Image 1

A functioning connection depends on three additional primitives:

  • Resources — context the server exposes to the model, such as files, schemas, or user lists.
  • Prompts — standardized queries the server uses to gather missing details from the client.
  • Tools — the executable actions the client can request, from API calls to database queries to message sends.

Without MCP, an LLM works in isolation. With it, the model can act on the organization's software stack in structured ways — which is precisely why that access needs governance.

The Risks of Decentralized AI Access

An unmanaged MCP deployment resembles a network where every server has a public IP and no firewall. Consider the failure modes that have already surfaced:

  • Prompt and tool injection. Malicious instructions can be embedded in MCP tool descriptions themselves. A model reaching for a seemingly benign “WebSearch” tool might be tricked into also querying a financial database and funneling the results out.
  • Supply chain compromise. Third-party MCP servers are a trust vector. In mid-2025, CVE-2025-6514 exposed a critical flaw in a popular npm package used for MCP authentication. Separately, researchers documented the “NeighborJack” issue — hundreds of MCP servers bound to 0.0.0.0 without firewalls, leaving them open to OS command injection and full host takeover.
  • The confused deputy. Attackers don’t need to compromise the model; they just need to exploit its inability to distinguish instructions from data. One documented case involved an AI agent with high-level privileges executing SQL commands embedded in a support ticket, thereby compromising an entire database.
  • Data leakage. Without centralized controls, information can move between systems unintentionally. In June 2025, a major team-collaboration tool’s MCP integration leaked customer data across instances and was taken offline for two weeks.

A Single Gateway for All MCP Servers

MCP Server Portals replaces the fragmented model of distributing individual server endpoints. Developers register their MCP servers with Cloudflare, and users configure one unified portal URL in their MCP client.

BLOG-2882 Image 2

That shift yields four concrete benefits:

  • Centralized policy enforcement. Because Portals plug into Cloudflare One, the same Access policies used for human users apply to AI connections — multi-factor authentication, device post-checks, geographic restrictions, and granular permissions on which servers and tools each user may reach.
  • Unified visibility and logging. All MCP request logs — who, which server, which tool, which prompt — are aggregated in one place, enabling audit trails and anomaly detection rather than forcing forensic work across dozens of independent logs.
  • Least-privilege user experience. Administrators vet and approve servers before adding them to a Portal. Authenticated users see only the servers and tools they are authorized to use, which discourages unvetted third-party connections.
  • Simplified configuration. Users load one URL instead of manually inputting each MCP server. As new ones are approved, they appear in the portal dynamically.

When a user authenticates to their Portal, Cloudflare Access validates their identity against the corporate identity provider and then enforces server-level access regardless of the underlying server’s own authorization logic. For MCP servers hosted on Cloudflare domains, Access policies can enforce direct authorization via an OAuth server linked to the domain’s existing Access application. For third-party or non-Cloudflare hosts, authorization relies on OAuth controls outside of Cloudflare Access.

What Cloudflare Has Planned Next

The Portals launch is positioned as a first step rather than an endpoint. Cloudflare has outlined several follow-on efforts:

  • Harder enforcement of server access. Unless an MCP server author implements authorization controls, users may still connect directly outside of a Portal. Additional enforcement mechanisms are planned to close that loophole.
  • Firewall for AI. Applying WAF-style analysis to MCP traffic to detect and block prompt injection before it reaches a server.
  • Cloudflare-hosted MCP servers via AI Gateway for deeper prompt filtering.
  • Machine learning on MCP logs to flag anomalous behavior, from data exfiltration to unusual tool usage.
  • Protocol improvements contributed to the open-source MCP community.

Availability

MCP Server Portals are available in Open Beta to all Cloudflare One customers. To enable the feature, head to Access > AI Controls in the Zero Trust Dashboard. New accounts can start with up to 50 free seats.