Agent security · News & analysis
An MCP connection is a permission decision
Cloudflare’s August MCP security update highlights the controls around agent tools. A practical review of identity, server permissions and audit records.
Cloudflare’s August 14 MCP security article examines where organizations can observe and control agent-tool traffic: in the client, on the network and at the MCP server. It argues that permissions designed around human judgment and human speed need a fresh review when agents use them.
The announcement concerns Cloudflare’s approach to visibility and enforcement. It does not mean that every MCP connection is malicious or that a network control can replace authorization inside the service receiving the request.
Approve the operation, not just the connection
Our practical reading is to review an MCP integration as a set of business operations. Listing tickets, editing a ticket and closing every ticket are distinct capabilities. A single approved server address does not explain which of those operations an agent should be allowed to perform.
Start with one task. A support assistant preparing a draft response may need to read the relevant ticket and approved reference material. It may not need permission to change customer access or issue refunds. Keeping those decisions separate makes the integration easier to explain and easier to test.
Put the authoritative check at the destination
A client can display an approval dialog and a gateway can restrict traffic. The service receiving an operation still needs to establish which identity is acting, which organization the request belongs to and whether that operation is allowed on the selected record. Make those checks independently of anything claimed in the model’s text.
Human approval also needs a meaningful scope. Show the reviewer the action, target and proposed change. If an approval merely says that the assistant may continue, it is difficult to know whether a later action was part of the original decision. Expire approvals when the target or requested operation changes.
- Inventory MCP servers, owners, identities and enabled tools.
- Test that a valid identity cannot operate on another team’s records.
- Separate read, draft and execution permissions where the service supports them.
- Record tool outcomes and authorization failures with the relevant request.
Give access a lifecycle
Decide how a connection is revoked when a project ends or an employee changes role. Include unattended agents in the review rather than assuming they disappear with a browser session. Test revocation against the server, not only the client interface.
A useful access record should answer why the integration exists, who owns it and what it can change. That is a manageable starting point for a small team, and it remains useful when the number of agents grows. The protocol makes connection possible; your authorization model determines what connection permits.
Put your security work in motion.
Book a meeting