MCP Server Portals, part of Cloudflare One (Zero Trust), give your users a single portal URL for all approved MCP servers, with Access policies in front. The portal auto-detects Streamable HTTP and supports stateless servers.
Cloudflare’s separate AI Gateway product is not in the MCP path; tool calls don’t traverse it. Use MCP Portals.
Register the server
Open MCP Portals
In the Cloudflare dashboard go to Zero Trust › Access controls › MCP Portals, open the MCP servers tab, and select Add an MCP server.
Choose authentication and policies
Pick one of the options below, attach your Access policies, then Save and connect server.
Authentication
Bearer (shared)
OAuth (per user)
Set the authentication type to bearer and paste your Consensus API key as the raw bearer token (or as a custom Authorization: Bearer ak_live_... header).
Set the authentication type to oauth and choose automatic OAuth registration. Cloudflare registers with Consensus through Dynamic Client Registration and each user signs in on first use. Manual credentials also work if you prefer a confidential client: Authorization endpoint https://consensus.app/oauth/authorize/, Token endpoint https://consensus.app/oauth/token/, Scope search.
cloudflare_zero_trust_access_mcp_server_portal.
Notes
- Users blocked by an Access policy can still reach
mcp.consensus.app directly unless Access is also the OAuth provider; combine with your egress policy if that matters.
- Manual-OAuth servers show Waiting until the first user completes sign-in.
Cloudflare docs: MCP Portals 
