{
  "version": "2",
  "id": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b",
  "title": "Cloudflare adds private-network MCP server support to its MCP server portals",
  "summary": "Portals can now reach MCP servers that live only on a private network, routed through Cloudflare Gateway, but OAuth authorization and token endpoints must still be publicly reachable.",
  "body": "Cloudflare has added support for private MCP servers to its MCP server portals, according to a changelog entry on its developer documentation site. The change means a portal can connect to an MCP server that is reachable only inside a private network, rather than requiring that server to be exposed to the public Internet.\n\nRather than a new hosting product, what Cloudflare outlines here is a routing path. Private hostnames and IP addresses are reached by the portal through Cloudflare Gateway, which means no public endpoint is required for the MCP server itself. Private reachability for the server, mediated by Cloudflare's gateway layer — that is the heart of the announcement.\n\nTo make this work, the private server network has to be connected to Cloudflare first. The changelog names Cloudflare Tunnel, Cloudflare Mesh, or another Cloudflare One connector as the options for establishing that connection. Only after that connectivity exists does the portal have a path into the private network.\n\nConfiguration then happens in two documented steps. An operator sets up a private hostname or a CIDR route, and when adding the server to the portal, turns on the option to route traffic through Cloudflare Gateway. The changelog frames these as the setup actions required for the private-server case.\n\nThere is an important boundary in the design. Cloudflare states that OAuth authorization server endpoints, including the authorization endpoint and the token endpoint, must remain accessible on the public Internet. The private-network treatment applies to the MCP server, not to the OAuth machinery that governs access to it.\n\nA second boundary applies to client registration. If Cloudflare automatically registers the OAuth client through Dynamic Client Registration, the changelog says the registration endpoint must also be reachable from the public Internet. So a fully private deployment is not what is being described; the identity and authorization surface stays public even when the server does not.\n\nFor developers and small studios running internal tooling, the practical shape of this is a split architecture. The MCP server can sit behind a private hostname or CIDR route, while the OAuth endpoints it depends on are published. Anyone planning a deployment has to account for both halves, because the private routing does not remove the public requirement on the authorization side.\n\nThe connector choice also matters for how the private network is joined to Cloudflare. Tunnel, Mesh and other Cloudflare One connectors are presented as alternatives rather than a single mandated path, which suggests teams can reuse whatever Cloudflare One connectivity they already operate instead of standing up a separate mechanism.\n\nCloudflare points readers to a setup guide titled Connect a private MCP server for the detailed instructions. The changelog itself is a summary: it states the capability, the routing behavior, the configuration switches and the public-endpoint constraints, but it does not walk through the full procedure.\n\nWhat the entry does not contain is equally relevant. There is no pricing information, no statement about which plan tiers include private MCP server support, and no indication of regional availability. Those are open questions for anyone evaluating whether this fits an existing Cloudflare One deployment.\n\nThere is also no performance or reliability data in the supplied material. Cloudflare does not describe latency, throughput, connection limits or failure behavior for portal traffic routed through Gateway to a private server. The changelog asserts the capability, not measured characteristics of it.\n\nThe date of the change is not stated in the extracted text. The source carries a publication timestamp, but the changelog excerpt does not give an explicit event date, so the timing of general availability cannot be pinned down from this evidence alone.\n\nFor freelancers and small development teams, the most concrete implication is architectural rather than commercial. If an internal MCP server previously had to be exposed publicly to be usable from a portal, this offers a documented alternative in which the server stays private while authorization endpoints remain public. That reduces the public attack surface for the server itself, but it does not eliminate public exposure entirely, because the OAuth endpoints and, where DCR is used, the registration endpoint must still be internet-reachable.\n\nThat distinction is worth stating plainly, because it is easy to read a headline about private MCP servers as meaning nothing is public. Cloudflare's own description contradicts that reading. The private part is the server's network location; the authorization surface is explicitly required to be public.\n\nA second implication concerns setup effort. Adopting this means having a Cloudflare One connector in place, defining a private hostname or CIDR route, and enabling Gateway routing when the server is added. Teams without existing Cloudflare One connectivity would be taking on that layer as part of the work, though the changelog does not quantify the effort involved.\n\nThe unresolved items are mostly operational. Without pricing, plan eligibility or regional details, it is not possible to say from this evidence who can use the feature or what it costs. Without any stated limits or performance figures, it is not possible to say how it behaves under load. And without an explicit event date in the text, the rollout timeline remains unclear.\n\nNarrow and specific is what can be stated with confidence: according to Cloudflare's documentation, MCP servers that exist only on a private network can now be connected to by MCP server portals; Cloudflare Gateway is the means by which the portal reaches them; Tunnel, Mesh or another Cloudflare One connector is how connectivity gets established; part of setup are a private hostname or CIDR route plus a Gateway routing toggle; and publicly accessible must remain the OAuth authorization, token and, under DCR, registration endpoints. Anything further finds no support in the supplied material.",
  "category": "dev",
  "language": "en",
  "datePublished": "2026-09-27T05:17:37.801Z",
  "dateModified": "2026-09-27T05:17:37.801Z",
  "eventDate": null,
  "sourcePublicationDate": "2026-09-22T00:00:00.000Z",
  "source": {
    "name": "developers.cloudflare.com",
    "url": "https://developers.cloudflare.com/changelog/post/2026-09-22-private-mcp-servers/",
    "kind": "official-publisher"
  },
  "practicalImpact": "Editorial interpretation: teams running internal MCP servers can keep the server itself off the public Internet while still using a portal, provided they already have or are willing to add Cloudflare One connectivity and can keep the OAuth authorization, token and (under DCR) registration endpoints publicly reachable. The change shifts where exposure sits rather than removing it, so the authorization surface still needs the same public-facing care as before.",
  "limitations": "The evidence is a single changelog entry. It gives no pricing, plan-tier eligibility, regional availability, latency, throughput or connection-limit details, and no explicit event date. The setup guide it references is not included in the supplied material, so the full procedure and any prerequisites beyond the named connectors are unverified here. No independent testing or third-party confirmation is available.",
  "keyPoints": [
    "Cloudflare's changelog states that MCP server portals can now connect to MCP servers available only on a private network, using Cloudflare Gateway to reach private hostnames and IP addresses.",
    "Private connectivity is established with Cloudflare Tunnel, Cloudflare Mesh, or another Cloudflare One connector, followed by configuring a private hostname or CIDR route and enabling Gateway routing when adding the server.",
    "OAuth authorization and token endpoints must remain accessible on the public Internet, and if Cloudflare registers the OAuth client via Dynamic Client Registration, the registration endpoint must be public too.",
    "The changelog does not state pricing, plan eligibility, regional availability, performance characteristics, or an explicit event date."
  ],
  "review": {
    "status": "source-reviewed",
    "checkedAt": "2026-09-27T05:17:37.801Z",
    "method": "Automated comparison against retrieved source text; not independent fact-checking.",
    "correctionNote": null
  },
  "sources": [
    {
      "id": 1,
      "url": "https://developers.cloudflare.com/changelog/post/2026-09-22-private-mcp-servers/",
      "publisher": "developers.cloudflare.com",
      "title": "Changelog",
      "publishedAt": 1790035200000,
      "fetchedAt": 1790486244369,
      "hash": "48a2a7356b462b979b7a18bf47c491405f5a23aec14eb13416998cb3c000aab4",
      "kind": "official-publisher"
    }
  ],
  "claims": [
    {
      "claim": "Cloudflare says MCP server portals can connect to MCP servers that are only available on a private network, reaching private hostnames and IP addresses through Cloudflare Gateway without exposing the server to the public Internet.",
      "source": 1,
      "id": "claim-1",
      "url": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b#claim-1"
    },
    {
      "claim": "The private server network is connected to Cloudflare using Cloudflare Tunnel, Cloudflare Mesh, or another Cloudflare One connector.",
      "source": 1,
      "id": "claim-2",
      "url": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b#claim-2"
    },
    {
      "claim": "Setup involves configuring a private hostname or CIDR route and enabling the option to route traffic through Cloudflare Gateway when adding the server.",
      "source": 1,
      "id": "claim-3",
      "url": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b#claim-3"
    },
    {
      "claim": "OAuth authorization server endpoints, including the authorization and token endpoints, must be accessible on the public Internet.",
      "source": 1,
      "id": "claim-4",
      "url": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b#claim-4"
    },
    {
      "claim": "If Cloudflare automatically registers the OAuth client through Dynamic Client Registration, the registration endpoint must also be publicly accessible.",
      "source": 1,
      "id": "claim-5",
      "url": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b#claim-5"
    }
  ],
  "formats": {
    "html": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b",
    "markdown": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b.md",
    "json": "https://freelancenews.online/news/cloudflare-adds-private-network-mcp-server-support-to-its-mcp-server-dd5c5e8b.json"
  }
}