Total requests ↗
—All recorded requestsSecurity overview
Monitor gateway activity and policy enforcement.
Secure Chat ↗Connecting
Complete your gateway setup
Check database readiness, create a client key, and configure a destination MCP server.
Violations blocked ◇
—Awaiting traffic dataRequests redacted ◌
—Allowed after policy matchingAverage latency ◷
—Gateway decision / upstream headersTraffic & violations
Daily gateway activity over the last 30 days · UTC
Requests Blocked
No traffic recorded yet. Connect an MCP client to start monitoring.
Policy signals
Most frequent matching policy combinations
Active traffic sources
Clients with the most recorded requests
Recent security alerts
Blocked events in the latest 100 requests
Shared custom data rules
Enabled custom rules apply to browser checks and MCP requests. Each flow also has its own mandatory protections.
MCP gateway · 5 built-in protections Always active
MCP built-ins inspect the original request and cannot be hidden by custom redaction. Browser protection has its own 33-check catalog.
IDENTITY & ACCESS
0 active keysOne key for each client
Provision credentials with an expiry and request budget. Revoke access independently.
Client keys
Secrets are shown once. Only SHA-256 hashes are stored.
Advanced · Source IP overrides
Manage client access
Allow or deny clients by their Cloudflare-reported source IP.
◎
Shared networks share a policy
These are IP access policies, not individual user accounts. Unlisted source IPs with a valid client credential are allowed.
Client policies
Audit event stream
Review decisions and inspect retained payloads.
Search and filters run across the database. Older pages remain loaded during refresh.
TEST BEFORE YOU ENFORCE
No upstream calls · No audit writesSee how the gateway decides
Run a synthetic JSON payload through all enabled custom rules and built-in protections.
Decision trace
Awaiting testEvaluated payload
Run a test to see the payload after policy evaluation.
A blocked decision prevents forwarding, even if other rules redact text.
AI WEBSITE PROTECTION
Browser security overview
Local checks. Central policies. Private reporting.
No active browsers
Create an enrollment to start protecting a browser.
Browser devices
One enrollment per browser profile. Credentials are separate from MCP client keys.
Latest 200 records. Sync status reflects successful policy retrieval, not proof of complete website coverage.
Client management
Control enrollment permissions centrally.
Browser protection catalog
33 mandatory checks plus enabled custom rules. New custom rules sync about every minute while browsers are running.
Browser matches block secrets or require masking approval. The MCP gateway has its own mandatory protections. Pattern detection cannot identify every sensitive value.
Browser decision reports
Device metadata only. Clipboard and draft contents are not collected.
Reports are not independent attestation. Rule names use the current catalog. Older pages stay in place during automatic refresh.
Protected websites
Manage exact hosts and the adapter used to recognize message controls.
Add the chat website’s hostname, not an API or MCP endpoint. Subdomains are separate entries. New sites require browser permission in extension settings, then a page reload. A generic adapter supports standard text editors and Send controls; test every website and managed browser before rollout.
Add a website
Only bundled extension code runs. Adding a host does not guarantee that all its submission paths are supported. Configuration syncs about every minute; offline policies expire within five minutes.
Start with one test browser
No MCP destination, OAuth app, or AI API key is required for website protection.
- Install or update the extension
Download and extract the ZIP. Open chrome://extensions or edge://extensions, enable Developer mode, and load the folder. For updates, replace files in the same folder and click Reload.
- Enroll the browser profile
Create an enrollment from Devices. Enter its one-time code in extension settings within 15 minutes. Codes can be used once.
- Confirm policy health
Confirm Protection ready, reload AI tabs, and allow access to supported sites. Rules refresh automatically; extension code updates still need installation.
- Test with fake data
Type or paste jane@example.test, then try Enter and Send. Review masking or cancel. A fake API key should be blocked. Confirm metadata reports in Activity.
How protection works
1 · Hold the action
Paste, Enter, or recognized Send
2 · Check locally
Block secrets · review masking
3 · Continue safely
Apply masked draft, then send again
Typed drafts already exist on the website and may be collected before Send. This is not a network-wide filter; unsupported controls, uploads, mobile/native apps, and CLI tools need separate controls.
Configured website hosts
Configured coverage uses tested adapters, not a guarantee for every live account layout. Test each managed browser and website before rollout. Manage additional hosts in Websites. New hosts need browser permission and adapter testing.
CHATGPT & REMOTE MCP APPS
Authorize apps with OAuth
Register an app's exact callback, then approve its access with an assigned individual MCP client key. This is key-based account linking; organization SSO is not configured.
Register ChatGPT or another MCP app
In ChatGPT, add a custom MCP server using the endpoint below. Choose User-Defined OAuth Client and copy its Callback URL here. Match the token authentication method in both places.
Save these credentials now
Paste them only into your AI app's OAuth settings. The secret will not be shown again. A public client has no secret.
Registered OAuth clients
Latest 100 registrations.
Approved connections
Latest 100 connections. Revocation stops subsequent gateway requests. Existing client-key expiry, quotas, and DLP apply; changing a destination assignment requires a new approval.
Finish connecting in the AI app
Retry OAuth discovery, enter the client ID and secret, and request mcp:invoke (plus offline_access for refresh). Sign in on the AI Guard approval page with an individual client key assigned to an enabled destination. Review it, then choose Allow connection. OAuth does not add tools itself: your destination server must implement MCP initialization and tool discovery.
CLIENT ONBOARDING
Connect through your security boundary
Create a client key, configure the endpoint, and verify the first event.
Create a client identity
Give each client its own key, expiry, and request limit. Save the generated key once.
Add a destination server
Add a server in Destinations and assign the client key or set a workspace default. This gateway does not provide upstream tools itself.
Connect and verify
Use the configuration below, reload your client, then review its requests in Audit logs.
Connection configuration
ChatGPT, Claude & Gemini setup ↗Replace YOUR_CLIENT_KEY locally. These examples contain no real credentials. Use a client key, never the admin key.
Transport and web-client compatibility
The gateway forwards POST-based MCP requests. A real upstream must complete MCP initialization and advertise tools. Separate GET event channels are not implemented. OAuth discovery and pre-registered clients are supported. Register authenticated web apps in OAuth connections. Claude also supports fixed Request headers where available. Open the app setup guide above for instructions and limitations.
UPSTREAM ROUTING
Your MCP server catalog
Assign a server per client key, or set a workspace default. Every request still runs through DLP.
Routing order
Client assignment → workspace default → UPSTREAM_MCP_URL environment fallback. A disabled assigned server or missing authentication Secret stops forwarding. Requests never silently switch to another server.
SECURE CHAT · MODEL ACCESS
Open Secure Chat ↗Connect AI providers
Messages are inspected before a model API is called. Model providers are separate from MCP tool destinations.
Separate user access
Set CHAT_ACCESS_KEY as a Worker Secret for chat-only users. Never share ADMIN_API_KEY with them. Signed-in administrators can open /chat directly.
Secure Chat events
Metadata only · No prompt or reply contents
Two protection layers
Secure Chat masks built-in personal and financial matches with user approval. Secrets, private keys, passwords, and custom Block rules remain blocked. The MCP gateway retains its existing enforcement behavior.
Deployment readiness
Check the services required by the management console.
Checks have not run.
Access model
- Administrator
- Shared ADMIN_API_KEY with full management access
- MCP clients
- Individual hashed keys with expiry and rate limits; shared GATEWAY_API_KEY remains supported
- Sessions
- Signed HttpOnly session cookie · Up to 8 hours · Sign out to clear it
Individual admin accounts and roles are not configured. Use your organization’s access controls for identity and MFA.
Gateway connection
CheckingPOST JSON with your gateway bearer key. The upstream must support the same request format.
Manage multiple upstreams in Destinations. UPSTREAM_MCP_URL in Cloudflare Worker Settings remains the environment fallback. This gateway URL cannot also be its destination.
How traffic flows
01MCP clientClaude or another client
02This gatewayAuthentication + DLP
03Destination MCP serverYour separate tools service
A destination MCP server provides tools or data. A standard AI chat API requires a protocol adapter; it is not an interchangeable MCP endpoint.