Scaling MCP adoption: Our reference architecture for simpler, safer and cheaper enterprise deployments of MCP

Cloudflare shares its internal reference architecture for enterprise-wide MCP adoption, covering how they govern, secure, and optimize agentic AI workflows across the company. Key components include centralized remote MCP servers deployed on Cloudflare Workers, Cloudflare Access for OAuth-based authentication, and MCP server portals for unified discovery, DLP enforcement, and audit logging. They launch 'Code Mode' for MCP server portals, which collapses all tool definitions into two tools (search and execute), reducing token consumption by up to 94% as tool counts scale. AI Gateway is used to mediate LLM access and enforce cost controls. For shadow MCP detection, Cloudflare Gateway can scan HTTP traffic using hostname patterns, URL paths, and DLP regex rules targeting JSON-RPC MCP method fields. The post also covers securing public-facing MCP servers with the Cloudflare WAF and AI Security for Apps to detect prompt injection.