WriteGuard: Granular Control for MCP Servers

Cloudflare built WriteGuard to prevent large-scale changes caused by incorrect tool calls from AI agents. In environments where multiple background agents run simultaneously, human and agent actions are recorded under the same user account, making root cause analysis and state recovery difficult.

WriteGuard is a common policy, identification, and audit layer placed in front of MCP (Model Context Protocol) servers. Based on tool configuration and request context, it passes calls through as-is, adds agent information to supported write operations and generates audit events, or blocks operations before the handler executes.

Cloudflare connects internal agents to OpenCode, Cloudflare OS, and long-running agent services, and operates MCP servers behind Cloudflare Access. The internal MCP server portal has expanded from 13 servers in April to 27 servers currently, starting initially with read-only tools for querying Jira, GitLab, wikis, and operational systems.

As model performance and team experience improved, engineering, product, design, sales, and customer success organizations began requesting tools that modify systems. Accordingly, Cloudflare chose to centrally manage the following without relying on client-side skills or prompts:

• Policies for write operations agents can perform
• Agent identification information displayed in downstream applications
• Central audit trails to investigate activity across multiple sessions

WriteGuard is designed to define policies for each MCP tool without modifying the existing MCP servers themselves. Cloudflare currently offers these controls in private beta via the MCP server portal.