SOURCE

WriteGuard: fine-grained controls for MCP Servers

Properties1
tagscloudflare, mcp, agent-security, write-controls, primary-source

2 min read

WriteGuard: fine-grained controls for MCP Servers

Summary

WriteGuard is Cloudflare’s shared policy, attribution, and audit layer for write-capable MCP tools. Cloudflare built it after expanding an internal MCP portal from read-only search across systems such as Jira and GitLab toward actions that change those systems. The design assumes client-side prompts and skills are insufficient because harness behavior varies and users can disable them.

Each tool receives an enabled state, attribution configuration, and risk tier: Read Only, Minimal Impact, Contained Write, or Critical. WriteGuard can pass a call unchanged, enrich supported downstream writes with the acting user’s agent/session attribution, emit a scrubbed audit event, or block the handler before it runs. Cloudflare’s example permits reading a merge request, labels and audits an agent-created comment, and disables agent-initiated merge operations because they can trigger deployment. Audit events record semantic classifications, identity context, outcome, and duration while omitting configured sensitive fields.

This provides a useful design pattern for the proof-business stack even though the Cloudflare product was only a private beta. Mystery-shopper and diagnostic tools should be read-only. A request for an appointment or draft update may be a contained write with visible attribution. Publishing, production deployment, bulk changes, and financial transactions should be blocked or released through a deliberate human-controlled path. Central policy is preferable to implementing inconsistent checks in every tool. However, WriteGuard does not replace downstream authorization: the human’s existing permissions remain the ceiling, and application-specific validation still matters. The consultancy can adopt the risk-tier vocabulary now without depending on Cloudflare’s beta.

Key Claims

  • Policy is centralized across MCP servers without requiring each server to reimplement it.
  • Tools are classified into four risk tiers and can be disabled before execution.
  • Supported writes can carry human-plus-agent attribution into downstream systems.
  • Audit events are asynchronous and scrub configured sensitive values.
  • WriteGuard was a private beta with GA dependent on validation and rollout.

Connections

Contradictions

  • None. It makes the roundup’s “fine-grained controls” concrete while adding a significant maturity caveat.