WriteGuard: Cloudflare's Answer to Runaway AI Agents
Cloudflare introduces WriteGuard, a policy, attribution, and auditing layer for MCP servers, now in private beta for its MCP server portals. It gives engineers centralized control over what AI agents can write, with risk tiers, agent labeling, and async audit logs.
Cloudflare has open-sourced the playbook for taming AI agents that write to your systems. The company's new WriteGuard layer, now in private beta for Cloudflare MCP server portals, is a response to a familiar nightmare: an agent with a too-broad prompt closing thousands of tickets in an afternoon, all attributed to a single human user.
WriteGuard sits between MCP clients and servers, applying per-tool policy before any handler runs. Each tool gets a risk tier—Read Only, Minimal Impact, Contained Write, or Critical—plus an enabled/disabled state and a labeling configuration. The policy is defined in TypeScript in Cloudflare's internal MCP monorepo today, but portal users will soon configure it through the dashboard.
The key design choice: keep the human identity, add the agent. Instead of creating separate agent accounts, WriteGuard enriches the existing OAuth user context with MCP client and session info. Downstream apps still see Joe's credentials, but now with a label saying "agent session acting on behalf of Joe." This avoids a second permission set to manage while preserving accountability.
Audit logging is asynchronous and scrubbed—no latency added to the agent's response, and secrets are stripped from events. The audit dashboard classifies each invocation as successful, failed, or blocked, making machine-speed activity queryable across all MCP servers.
The GitLab example shows the granularity: get_merge_request passes through, create_mr_note gets agent attribution injected into the note body, and merge_mr is blocked entirely because merges trigger deployments and require a human in the loop.
Building this into every MCP server would be duplication and inconsistency. WriteGuard is a shared layer that needs only per-tool config, working across Jira, GitLab, Google Workspace, and any future server connected through the portal.
WriteGuard adds MCP client and session context to the human identity, identifying each write as an agent session acting on behalf of a particular person.
| Risk Tier | Examples | Behavior |
|---|---|---|
| Read Only | Search issues; read an MR; view pipeline status | Pass through unchanged |
| Minimal Impact | Add a reaction; mark notification read; subscribe | Pass through, logged |
| Contained Write | Add comment; create MR; update issue field | Enrich with agent attribution, log |
| Critical | Merge MR; trigger deployment; bulk-delete | Block before handler runs, log attempt |