0:02So my name is AJ Gerstenhaber. I am a product manager at Cloudflare. I'm responsible for our secure web gateway platform, along with some of the agentic security advancements that we're moving into. And today I'm going to be giving you a little demo of a couple of basic ways that you can use the Cloudflare One platform to improve your agentic security. both through understanding your MCP server access and MCP server traffic and the way that your agents use package registries to fetch packages and ensure that your agents are doing things that fall within your acceptable use policies. So how many people in here are familiar with Cloudflare 1?

0:49Cloudflare 1. Okay, about half. About half. So Cloudflare 1 is Cloudflare's secure access service edge. Anybody know the SASE acronym? Anyone who didn't, not familiar with Cloudflare 1, but familiar with SASE, raise your hand. Okay, that's pretty good. Almost everyone who wasn't familiar with Cloudflare 1. So we've been in this business for about six, seven years now. That's just about how long I've been at Cloudflare. And it comprises of our remote access products, which now includes our MCP server portal and configuration product, and our secure web gateway, our network firewall, our network, networking products, our mesh networking, and our SD-WAN products. And so what we're going to be talking about today is all related to the Cloudflare One platform. And so this is the Cloudflare dashboard. Hopefully many of you here are familiar with it. That's great.

1:34This is my personal account. And I want to show you a couple of things that you can do in order to both become aware of and secure your MCP traffic, and then understand your tool chain access and reduce threats that come from agentic tool usage cool let's get started so the first thing that i want to show you and i've been talking to customers for a really long time so i am going to move through this dashboard freeform if i go too fast or something's weird or confusing just like i don't know raise your hand and you can tell me to slow down and go back and explain something and i think that's fine but so where the one of the first places that you can start in a fully deployed cloudflare one environment is you can go to your insights and longs dashboard And we have AI security reports here, which you can use to understand both the agentic usage within your network and the overall MCP usage within your network as well.

2:31So you can see that in my test case, I only have one user, but that user uses a lot of MCP servers. So you can see which MCPs the users are connected to. You can see the trends over time. And then you can see this here, which represents how much traffic per on -ramp. What that means in a Cloudflare context is that this is traffic that all goes raw directly to MCP servers from harnesses rather than through our MCP server portal. Is anybody familiar with the MCP server portal? One, two, three, four, five. Yeah, a lot of people. If you're not familiar, our MCP portal is basically an MCP gateway that we developed that you can proxy all of your MCP traffic to and let Cloudflare.

3:16manage the authentication to the upstream MCP servers so that you can centralize the usage of your MCP within your network and then start to apply policy that control what users are able to do or what agents are able to do with MCPs. So there's a little more information here, but importantly, you can also see which policies control access to various MCPs. I'm going to talk about that in just a second. And then here you can see a little more information about AI usage, like which agents. are in use within your network and how much data is being transferred. But if we go and look at the MCP servers that I have configured, you can see that I have a number of policies related to portal MCP. So we talked about on-ramps.

4:02This is the way that you send your traffic to Cloudflare. Our on-ramps are our device client and our MCP server portal. and our Cloudflare WAN solution and a number of mesh networking, Cloudflare Tunnel and a number of others. But here, it's really easy to build gateway policies. This is the gateway policy builder, firewall policy builder here, that can allow you to just detect MCP traffic, which is a kind of native detection that we offer where we look for both header negotiation and then we determine, we build a database of known MCP servers that we've seen across our entire network over a period of time. It's just a simple little selector that says, is this traffic MCP? And what was this source? Is it not the MCP portal, implying that this is MCP traffic originating within your network that a customer or one of your users, rather, is sending outside of the portal?

4:59Then you can just block it. And if they're using the device client and all their traffic goes up to Cloudflare, you can then redirect them to use the approved sources. then everyone is able to access the tools they need to. The agents are still able to fetch the MCP information, but everything routes through your sanctioned environment. So the other half of this is, well, I'm moving really fast. That's good. We got a lot of time. So what's happening in package registries and ecosystems and how are your agents managing packages? How many people in here have been vibe coding something or maybe doing real coding work and you were surprised to that your agent fetched a package that you didn't expect and you didn't immediately know why they fetched it. Yeah, that's a lot of hats.

5:44It happens to me like every couple of days. And every time it just sends a little shiver down my spine because ultimately I'm probably concerned about the same thing that y'all are concerned about, which is that if I'm not just rigorously paying attention to what my agent is doing, they might fetch a package that they may have some relevant need for, but that package could have an exploit and the agent really has no way to know that. And then, all of a sudden, the agent just proliferates that exploit to everything else that it has access to, and all of a sudden, I'm completely compromised. Does that thought cross people's minds ever? Is that ever scary to anybody? Yeah? Well, I can't say that we can solve every element of that. I think that in order to do that, we'd need to have probably longer than a 20 -minute session where we talk about sandboxing the harness and doing default deny for all of your agentic security overall and only letting the agent fetch what it is.

6:33it's approved and blah, blah, blah, blah, blah. But in the interim, we could at least set kind of allow lists or block lists that determine what your harnesses should be able to fetch for your end users. And we do that with gateway policies as well. I'm going to jump tabs and I think it's going to go with me. So you can see here, this is the overview of a gateway policy. If you've ever used the Cloudflare gateway platform, hopefully this looks familiar to you. But when you're building a policy, we now, and this is a relatively recent thing that we added, we gave you the ability to specify. the package registry and related information for traffic that is going through gateway. So when we're doing TLS decryption, we have the ability to see, we have the ability to parse the traffic that's going to all of the major package registry APIs and say, what package is this? What is this related to? What version is it?

7:19And then we have some ways to validate that information asynchronously so that you can start to build policies against the HTTP requests that are fetching the actual. packages themselves. So you can build allow lists and deny lists, et cetera. And then you can build on-ramps into these policies to say that if this is traffic that I know is agentic, if it has a certain header or any other way that you identify an agent maybe running copilot alongside a user in your environment, you can add that to the policy as well. And then you can say this agent is only allowed to fetch from this predetermined list of packages. So I think that's one thing that's going to become increasingly important in the next couple of years as obvious. these kinds of threats continue to proliferate. But I figured I could show you in real time. This is my personal machine.

8:04This is my personal instance. I'm running the device client here. You can see that. Everybody familiar with Warp device client, Cloudflare One client? Yeah, sweet. How many of y'all have it on your machines? That warms my heart. I got one head shake. I was one of the first solutions engineers who sold Cloudflare. back before the warp client existed and before everything else happened. So anytime I hear anyone using Cloudflare for anything, fills me with joy. So I really appreciate everyone who's invested in us and uses us as their security provider. But so let's do one super quick and easy example here. So let's just say, I don't know, I have one in here. We're gonna fetch debug npm package. And I think that one is listed here.

8:50Maybe it's not.

8:54I think it's in another policy. But either way, oh, that's weird. I got blocked by a Cloudflare endpoint that tells me that for whatever reason, I was not allowed to fetch this package. That's pretty cool, right? It's something that works in practice in a demo in real time. So let's prove it. Let's go to the policy itself. And this was known malicious NPM versions. That's this policy here. And then if we go view in logs, we should look at that. Oh, that's an old one, but it is the same policy. And I'm sure it will refresh in just a moment here. Oh, this isn't going up to the current time. We're still a little behind, but that's okay.

9:40Either way, you can see that this user requested this host. It contained this package information with the ecosystem and the... package name and the version and the p url and that it was blocked because it matched that policy so you can do the same kind of thing and i did set up a number of example policies in here where you can see that in the http policies here you can block just all of pi p for instance if it's something that is unsanctioned for your environment or i have something in here to fetch hano as part of another example that i was going to do but i actually think that you get the point pretty effectively and I think that's okay. But so there's a lot of different ways that you can build these rules and a lot of different ways that we can flex. I think one of the things that will be coming for Cloudflare in the very near future is the ability to integrate with if you maintain your own kind of package repository source information right now about what's malicious, non-malicious, exploited, not exploited, you should be able to integrate your own environment into the way that you evaluate these policies.

10:45And some of that is going to be, I don't know if you saw the blog the other day, but we released our first iteration of our integration between Gateway, our secure web gateway, and our developer platform. So you can now execute code in a worker in a way that will influence traffic that matches certain policies, which is the only vendor that I'm aware of that does anything remotely like that. So you use the whole developer platform. You send your traffic to a worker, send your traffic somewhere else. I do have a session on that tomorrow, so I won't spend a lot of time on it today. but you should all come to the session tomorrow because it'll be just like this and I think it'll be a lot of fun. But I really, really appreciate your time. Thank you so much and I hope this was useful.