Cloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers

Cloudflare WriteGuard 为 MCP 服务器带来细粒度安全控制

作者：Sergio De Simone · InfoQ 原文

摘要：Cloudflare 推出 WriteGuard（私有测试版），为 MCP 服务器提供细粒度安全控制。它作为共享策略、归属和审计层，拦截所有 MCP 请求，根据工具风险等级（只读到关键）评估是否允许通过。WriteGuard 无需创建独立代理账户，而是复用现有 OAuth 凭证，并将代理操作归因到具体用户。它异步发送脱敏事件到审计 Worker，记录工具、风险等级、结果等。

Cloudflare is introducing WriteGuard, now in private beta, to provide fine-grained security controls for MCP (Model Context Protocol) servers.

Cloudflare 推出 WriteGuard（目前处于私有测试阶段），为 MCP（模型上下文协议）服务器提供细粒度安全控制。

It aims to make AI agents safer by controlling their access to tools that can modify data or perform actions, rather than simply read information.

它旨在通过控制 AI 代理对能够修改数据或执行操作（而非仅读取信息）的工具的访问，来提升 AI 代理的安全性。

WriteGuard is a shared policy, attribution, and auditing layer that aims to address the risks that arise when AI agents use MCP to access external services with write-access privileges, including databases, GitHub, SaaS applications, internal APIs, etc.

WriteGuard 是一个共享的策略、归属和审计层，旨在解决 AI 代理使用 MCP 访问具有写入权限的外部服务（包括数据库、GitHub、SaaS 应用、内部 API 等）时产生的风险。

Read-only was a good starting point.

只读模式是一个不错的起点。

As models improved and teams gained experience with AI, people across engineering, product, design, sales, and customer success began asking for tools that could take action.

随着模型改进和团队积累 AI 经验，工程、产品、设计、销售和客户成功等部门的员工开始要求能够执行操作的工具。

[...] we wanted centralized control over the write actions agents could perform, agent labels to appear in downstream applications, and an audit trail that made agent activity easy to investigate.

[……] 我们希望集中控制代理可以执行的写入操作，在下游应用中显示代理标签，并拥有便于调查代理活动的审计跟踪。

WriteGuard sits right behind Cloudflare's MCP server portal and intercepts all incoming MCP requests.

WriteGuard 直接位于 Cloudflare 的 MCP 服务器门户之后，拦截所有传入的 MCP 请求。

It loads the policy associated with the targeted tool and evaluates the request context to determine whether a request is allowed to pass through unchanged or shall be blocked.

它加载与目标工具关联的策略，并评估请求上下文，以决定请求是允许原样通过还是应被阻止。

If an allowed request subsequently fails, it is routed to the auditing service, along with all requests that are denied in the first place.

如果允许的请求随后失败，它会与所有最初被拒绝的请求一起被路由到审计服务。

According to Cloudflare engineers Scott Roe-Meschke and Kenny Johnson, the advantage of WriteGuard lies in its ability to define tool-specific policies without requiring changes to the MCP server itself.

据 Cloudflare 工程师 Scott Roe-Meschke 和 Kenny Johnson 称，WriteGuard 的优势在于它能够定义特定于工具的策略，而无需更改 MCP 服务器本身。

It also serves as a shared security layer across all MCP servers connected through the Cloudflare portal.

它还可以作为通过 Cloudflare 门户连接的所有 MCP 服务器的共享安全层。

For GitLab alone, we could have built these controls directly into the server.

仅针对 GitLab，我们本可以将这些控制直接构建到服务器中。

But we needed the same capabilities for Jira, our internal wiki, Google Workspace, and every new MCP server we added.

但我们还需要为 Jira、我们的内部维基、Google Workspace 以及我们添加的每个新 MCP 服务器提供相同的功能。

Reimplementing them in each server would take more work and produce inconsistent behavior.

在每个服务器中重新实现它们将需要更多工作，并导致行为不一致。

Each tool is assigned a risk tier ranging from read-only, which carries no risk at all, to critical.

每个工具都被分配了一个风险等级，范围从完全没有风险的只读到关键。

For example, completing a merge request, triggering a production deployment, or bulk-deleting records are classified as critical operations.

例如，完成合并请求、触发生产部署或批量删除记录被归类为关键操作。

Creating a merge request or updating an issue field falls under the contained write tier, while lower-impact actions such as marking a notification as read, subscribing to an issue, or adding a comment has minimal impact.

创建合并请求或更新问题字段属于受限写入等级，而影响较小的操作（如将通知标记为已读、订阅问题或添加评论）影响最小。

WriteGuard does not require creating standalone agent accounts, which would 'create a second set of permissions to manage', note Roe-Meschke and Johnson.

Roe-Meschke 和 Johnson 指出，WriteGuard 不需要创建独立的代理账户，因为这会“创建另一套需要管理的权限”。

Instead, MCP servers use existing OAuth credentials to identify the user.

相反，MCP 服务器使用现有的 OAuth 凭证来识别用户。

To ensure that agent-driven action remain identifiable in the centralized audit log, WriteGuards adds MCP client and session context to the human identity.

为了确保代理驱动的操作在集中审计日志中保持可识别性，WriteGuard 将 MCP 客户端和会话上下文添加到人类身份中。

WriteGuard classifies each invocation as successful, failed, or blocked, then asynchronously sends a scrubbed event to an internal audit Worker.

WriteGuard 将每次调用分类为成功、失败或阻止，然后异步发送一个经过清理的事件到内部审计 Worker。

The event omits values for keys considered secret or sensitive.

该事件省略了被视为机密或敏感的键的值。

It includes the server, tool, risk tier, outcome, user, client, and duration.

它包括服务器、工具、风险等级、结果、用户、客户端和持续时间。

WriteGuard is currently available as a private beta, allowing Cloudflare to validate its behavior and refine the product before making it generally available.

WriteGuard 目前作为私有测试版提供，允许 Cloudflare 验证其行为并在正式发布前完善产品。

阅读理解

1. What is the primary purpose of WriteGuard according to the article?

2. How does WriteGuard handle the risk classification of tools?

3. What information does the scrubbed event sent by WriteGuard to the audit Worker include?

温故复习 →每日一句 →