WriteGuard [What It Changes]

TL;DR

• WriteGuard is Cloudflare's policy, attribution, and audit layer for MCP write tools: it sits behind an MCP server portal, assigns each tool a risk tier, and can block a write before the handler runs.

• Private beta opened 5 August 2026. It is not general availability, and it only protects servers that sit behind Cloudflare's MCP portal.

• Cloudflare built it first on its own fleet: 13 MCP servers when the internal stack post ran in April, 27 connected by the WriteGuard post.

• Four risk tiers: read-only, minimal impact, contained write, critical. Human identity stays; agent and session labels are added. Audit events are scrubbed and asynchronous.

What WriteGuard is

WriteGuard is a shared gate in front of MCP tools that can change the world: comments, merge requests, emails, ticket closes. Read-only search can pass. A merge that ships production can be disabled. The person is still Joe; the log can say it was Joe's agent.

A two-truck HVAC shop, a ten-person marketing agency, and a solo clinic should care the first time an agent can close tickets, email a customer, or edit a contract. The constraint that broke is "we will just tell people to watch the agent." Cloudflare's own story is thousands of tickets closed under one engineer's name because a cleanup prompt was too broad. Small shops do not have a platform team to reconstruct that afternoon. They need a deny-by-default write list.

This hub is current as of 5 August 2026, the datePublished on Cloudflare's WriteGuard post.

Why read-only stopped being enough

According to Cloudflare, the internal portal connected 13 MCP servers when the April internal AI stack post ran, and 27 by the WriteGuard article, with teams shipping more every month. All began as read-only. People then asked for writes.

According to the April internal-stack post, 3,683 internal users were on AI coding tools in the window it reported, with 182+ tools behind that portal. Those numbers describe Cloudflare's fleet, not your shop.

According to InfoQ, WriteGuard is in private beta. According to the same InfoQ article, the write-up posted 18 August 2026. InfoQ describes intercepting MCP requests to allow, enrich, or block before the handler, then auditing successes, failures, and denials.

The MCP portal docs (updated 25 August 2026) explain the portal as a single HTTP endpoint in front of many MCP servers, with Access login, tool allowlists, Code Mode, and optional Gateway DLP. Adjacent pages in that same docs set cover securing MCP servers, managed OAuth for HTTP apps, MCP authorization, the MCP 2026-07-28 spec, Gateway HTTP logs, and DLP policies. WriteGuard is the write-policy layer on that portal, not a replacement for it. The enterprise MCP post and Code Mode post are the architecture siblings. Internal clients named in the April stack include OpenCode and Windsurf; Agents SDK docs, AI Gateway, and Workers AI sit under the same platform layer.

How the gate works

WriteGuard sits behind the portal. It loads the tool's policy, looks at the request, and either passes the call, adds agent attribution on a supported field, or blocks it. Failed and blocked calls go to an audit worker. Allowed calls that fail later also get an audit event.

Identity stays the employee's OAuth via Cloudflare Access and managed OAuth. Cloudflare rejected standalone agent accounts because they create a second permission set. The tradeoff: downstream apps see Joe, not the agent, unless WriteGuard injects a label.

Source: Cloudflare WriteGuard.

Cloudflare's GitLab walk-through: get_merge_request passes unchanged; create_mr_note gets a label in the note field and an async audit event; merge_mr is critical and disabled, so WriteGuard blocks it before the handler and records the attempt.

Audit events omit secret keys and include server, tool, risk tier, outcome, user, client, and duration. Logging is asynchronous so it does not add latency to the agent. The dashboard complements portal request logs with semantic classifications.

Private beta signup is the WriteGuard landing page. OpenCode is named as one internal MCP client. According to The Guardian, that destructive-agent anecdote published 29 April 2026; this hub does not rest a WriteGuard statistic on it.

MCP remains the protocol. WebMCP is a different 6 August preview for in-page tools. Do not mix the two in a procurement sentence.

USTA analysis

USTA analysis. Inputs: 13 MCP servers in the April internal-stack post; 27 servers in the August WriteGuard post; 182+ tools in April; four risk tiers.

• 27 − 13 = 14 additional servers between those two Cloudflare publications.

• 27 / 13 ≈ 2.08, so the connected fleet a bit more than doubled on Cloudflare's own count.

• If April had 182+ tools across 13 servers, that is at least 182 / 13 ≈ 14 tools per server on average. The WriteGuard post does not reprint a new tool total, so this hub does not invent one for 27 servers.

• Four tiers means a shop that only enables read-only plus contained-write still has two tiers left to keep disabled (minimal impact can be noisy; critical should stay off).

This is division of Cloudflare's own fleet counts. It is not your tool catalog.

What a small shop should do

You cannot "turn on WriteGuard" unless the MCP servers sit on a Cloudflare portal and you are in the beta. If you are not, copy the policy idea: list every write tool, mark critical ones disabled, keep send/merge/delete on a person.

An HVAC shop's dispatch agent should search work orders (read-only) and draft a close-out comment (contained write) without permission to bulk-close the board. An agency should draft a client email without send. A clinic should draft a message without posting to the patient portal.

Law teams on Clio alternatives, Smokeball versus Clio, or MyCase versus Clio should not let an MCP write tool file a document. Form-to-CRM writes belong behind the same kind of gate. Executive-assistant automation is safe only if send is denied. The state of small-business automation is still "who can change the record."

Teams already routing documents through US Tech Automations can put WriteGuard-style deny lists on the same approval node: the agent drafts, the workflow records the person who released the write. If Cloudflare's beta is not available, the workflow still can. The homepage is that path.

A paper version of WriteGuard for shops not in the beta

Write a table with four rows: read, comment, create, destroy. Put every MCP tool in one row. Disable destroy. Require a named person on create-and-send. Leave comment on if the downstream system shows an agent label; if it does not, require a person on comment too.

That table is what Cloudflare encoded as risk tiers. You do not need their beta to keep merge_mr off.

If you are on Cloudflare One, read Access policies, identity providers, and Gateway HTTP policies before you add write tools. Portal traffic can ride Gateway for DLP; WriteGuard is still the tool-level gate.

Code Mode on the portal collapses tools into search-and-execute. That saves tokens. It does not classify risk. Turn Code Mode off until the write list is boring.

The April stack's AGENTS.md generator and AI code reviewer are Cloudflare's way to keep agents inside repo norms. A ten-person shop can steal the idea: a short file that says which tools are allowed, sitting in the agent prompt.

When an agent closes the wrong tickets, you need user, client, session, tool, and outcome. WriteGuard's audit event is that tuple. If you are not in the beta, log those five fields in your workflow tool or you will reconstruct the afternoon from Joe's Jira history, which is the failure mode Cloudflare opened with.

Honest limits

Private beta, not GA. Portal-only. No standalone agent accounts, so downstream apps need the injected label to see the agent. Client-side skills and elicitation are not enough; Cloudflare said users can disable them. Code Mode on portals is a separate context-window feature, not a write gate.

InfoQ is a two-minute digest of the Cloudflare post. Primary figures come from Cloudflare.

Signal vs Speculation

Signal (sourced). 5 August 2026 private beta. Four tiers. Block-before-handler. 13 servers in April, 27 in the WriteGuard post. OAuth-as-the-person plus agent labels. Async scrubbed audit. Portal docs describe the envelope WriteGuard sits in.

Speculation (our read). If the beta maps onto customer GitLab/Jira/Google Workspace the way it mapped internally, SMBs on Cloudflare One will get a write gate without forking each MCP server. Our read: 12–36 months of this is "deny merge and deny send" as the default SMB policy, not full unsupervised writes. Our read is not a GA date.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to AICPA, 62% of firms reported cloud-workflow adoption.

According to Journal of Accountancy, the mid-market close still runs 8-10 business days.

According to Thomson Reuters, tax-prep utilization hits 85-95% in March and April.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• WriteGuard gates MCP writes at the portal, before the handler.

• Four tiers; keep critical disabled.

• Cloudflare's fleet grew from 13 to 27 servers between two posts.

• Private beta; portal-only; not GA.

• Copy the policy even if you never join the beta.

FAQ

Is WriteGuard generally available?

Direct-answer first sentence: no; Cloudflare and InfoQ both call it a private beta that will expand toward GA. Sign up on the landing page if your servers already sit on a Cloudflare MCP portal.

Does it work with MCP servers that are not on Cloudflare?

Direct-answer first sentence: no; it protects servers connected through Cloudflare's MCP server portal. Reimplementing the same checks in each server is the problem Cloudflare wrote WriteGuard to avoid.

Will downstream Jira show the agent or the person?

Direct-answer first sentence: the person, plus an injected label when the tool's labeling config supports it. Cloudflare kept employee OAuth instead of agent accounts.

Can it block a merge?

Direct-answer first sentence: yes; Cloudflare's merge_mr example is critical and disabled, so WriteGuard blocks the call before the handler and audits the attempt.

Is this the same as WebMCP?

Direct-answer first sentence: no; WebMCP is an in-page tool API for browser agents, and WriteGuard is a write-policy layer for MCP server portals. Cloudflare shipped them in the same Agents Week window; they solve different jobs.

What to do next

List every MCP write tool your agents can reach. Disable merge, send, delete, and deploy. If you are on Cloudflare One and want the shared layer, apply to the private beta. If you want that deny list on the same path as intake, keep it in agentic workflows so US Tech Automations stores who released the write.