Cloudflare has introduced WriteGuard, now in private beta, to provide fine-grained security controls for MCP (Model Context Protocol) servers. The tool aims to make AI agents safer by controlling their access to tools that can modify data or perform actions, rather than simply read information.
SynthePulse Insight · AI deep reading
Version 1 · 1 source
Cloudflare launches WriteGuard in private beta, aiming to provide fine-grained security controls for MCP servers, addressing risks from AI agent write operations through centralized policy, audit, and attribution.
As models improve and teams gain experience, roles such as engineering, product, design, sales, and customer success are beginning to require AI agents to perform actions, not just read information. Cloudflare's WriteGuard is launched in this context, aiming to provide fine-grained security controls for MCP servers.
WriteGuard sits behind Cloudflare's MCP server portal and intercepts all incoming MCP requests. It loads policies associated with the target tool and evaluates the request context to decide whether the request passes through as-is or is blocked. If an allowed request subsequently fails, it is routed to the audit service, and all rejected requests are also routed to the audit service.
According to Cloudflare engineers Scott Roe-Meschke and Kenny Johnson, WriteGuard's advantage lies in its ability to define tool-specific policies without modifying the MCP server itself, and it can serve as a shared security layer for all MCP servers connected through the Cloudflare portal.
Each tool is assigned a risk level, ranging from no-risk read-only to critical operations. For example, completing a merge request, triggering a production deployment, or bulk deleting records are classified as critical operations. Creating a merge request or updating an issue field falls into the controlled write tier, while low-impact actions like marking notifications as read, subscribing to issues, or adding comments are in the minimal impact tier.
WriteGuard does not require creating separate agent accounts, as that would create a 'second set of permissions to manage.' Instead, MCP servers use existing OAuth credentials to identify users. To ensure that agent-driven operations are identifiable in centralized audit logs, WriteGuard adds MCP client and session context to the human identity.
WriteGuard classifies each call as success, failure, or blocked, then asynchronously sends sanitized events to an internal audit Worker. Events omit key-value pairs considered secret or sensitive, but include server, tool, risk level, result, user, client, and duration.
WriteGuard is currently available as a private beta, allowing Cloudflare to validate its behavior and refine the product before general availability.
The information in this article is based on a report from InfoQ and is a secondary source. All facts are derived from that report and have not been independently verified.
WriteGuard represents an advancement in MCP security, making AI agent write operations more controllable through centralized policy and audit, but its private beta status indicates that its maturity is yet to be validated.
Primary report
Primary source