As AI agents use the Model Context Protocol to call tools, orgs lose visibility into which MCP servers those agents reach — and MCP traffic is cryptographically indistinguishable from ordinary HTTPS. Jordan and Riley dig into the resulting "shadow MCP" and "portal bypass" problems, and how Cloudflare detects MCP at the network boundary using spec HTTP headers and the JSON-RPC envelope (surfaced as experimental.is_mcp == true) instead of hostname guessing — plus a new MCP dashboard and Gateway block policies. Governance loop: discover → validate → migrate behind portals → enforce portal-only. Source: How Cloudflare detects MCP traffic and helps secure it — The Cloudflare Blog, Aug 14 2026 —  ...