Both put a centralised gateway in front of multiple MCP servers, but they enforce at different layers. Cloudflare hosts remote MCP servers on Workers, controls who reaches which server with Zero Trust Access, and meters LLM cost with AI Gateway. PolicyLayer governs what happens once a call gets through: every tool call checked against deterministic, argument-level rules before it runs. Here is where each one fits.
Cloudflare decides that Alice may reach the payments server and Bob may not. PolicyLayer decides that Alice may call refund_payment only when the amount is under $100. Different controls, often complementary.
PolicyLayer is the hosted gateway your MCP traffic runs through. Connect your servers and every tool call is checked against deterministic, deny-by-default policy before it executes: allow, deny, rate-limit, or require approval, with argument-level rules, per-identity scopes, and a per-call audit log. It enforces over any registered upstream, including community servers you did not build, and ships recommended policy pre-classified across 220,000+ catalogued tools.
Cloudflare is an infrastructure platform that hosts and secures MCP. It builds and hosts remote MCP servers on Workers, aggregates them behind MCP Server Portals, gates access with Zero Trust (Access policies, MFA, device posture, geo), moderates content with AI Gateway Guardrails (Llama Guard), and meters LLM cost. Its identity story is mature: an OAuth 2.1 provider library and integration with GitHub, Google, Auth0, WorkOS, and other OAuth providers.
An infrastructure and perimeter platform, versus a per-call policy layer.
| PolicyLayer | Cloudflare | |
|---|---|---|
| Enforcement layer | The tool call: deterministic rules evaluated before it executes | The perimeter: who reaches which server, plus content moderation and DLP |
| Tool control | Per-call policy: allow, deny, rate-limit, or approve on the call and its arguments | Binary tool enable, disable, alias, namespace, or allowlist in a portal |
| Granularity | Per tool and per argument (allow refund_payment only when amount is under $100) | Per tool and per identity; arguments are not surfaced in the portal |
| Approvals | Human approval gates on any call | Not present in the published architecture |
| Identity | Per-person scoped grant tokens that constrain what a person does inside a tool | Mature: OAuth 2.1 provider, Access, MFA, device posture, deciding who reaches a server |
| Hosting | Routes the servers you already run; does not host them | Builds and hosts remote MCP servers on Workers and Durable Objects |
| Content and cost | Out of scope; a token-cost directory provides context | Guardrails via Llama Guard, DLP, and LLM token metering and caching |
| Audit | Every call logged with the tool, its arguments, and the decision | Portal logging (time, status, server, tool, duration); Logpush to SIEM on Enterprise |
| Deployment | Hosted control plane; point your client at a URL, live in minutes | Cloudflare Workers and Cloudflare One; strongest controls inside Zero Trust |
| Best fit | Teams who need control on what each call does, across servers they do not own | Teams already on Cloudflare who want to host and gate MCP at the perimeter |
Not just who made it: allow a refund tool only below a threshold, or restrict a query tool to certain datasets, with the rule evaluated on every call.
Sensitive calls wait for human sign-off, and rules read the call's arguments, neither of which a portal tool toggle expresses.
Deterministic policy over any registered upstream, including community and third-party servers you cannot modify.
A log that reflects the arguments evaluated and the decision made, not just tool name and status.
A turnkey OAuth provider, Workers, and Durable Objects on a mature global network, especially if you already run on Cloudflare.
Deterministic allow or deny on who reaches which server, with MFA, device posture, and geo, satisfies your requirement.
Token metering, caching, routing, and Guardrails bundled into one platform.
For most teams these are complementary. A realistic architecture runs Cloudflare for hosting, perimeter identity, and cost control, with PolicyLayer providing deterministic per-call policy on top, including over community servers you did not build. The one thing worth naming: portal tool toggles plus Access plus DLP is coarse-grained gating and content matching, not per-call argument-level enforcement.
Whatever your agents touch, the same engine, audit, and access model is doing the work underneath every rule you write.
Rules run as code, not model judgement: argument-level conditions, quotas, deny-by-default. The same call gets the same decision every time.
Writing policies →Your security or compliance team writes and attaches policy without ever holding the upstream credentials or grant tokens.
Roles →Every call is logged with its decision and the rule that fired, attributed to the identity, in an append-only record. Argument values are redacted, never stored.
Logs & security →Upstream secrets are encrypted at rest and injected by the gateway. The agent only ever holds a scoped token.
Logs & security →Every person and agent connects with its own scoped grant. Rotate or revoke any one of them instantly, without disrupting the rest.
Core concepts →Hosted gateway. Point your clients at it, register a server, issue a token. Nothing to install.
Quick start →Cloudflare's portal control is tool enable or disable plus identity-based access; the dashboard does not surface individual tool-call arguments. PolicyLayer evaluates the call and its arguments: allow a refund only below a limit, block a DELETE without a WHERE clause, require approval.
Yes. Cloudflare can host your MCP servers, gate the perimeter, and meter cost, while PolicyLayer enforces deterministic per-call policy on the traffic, including over servers you did not build.
No. PolicyLayer routes the servers you already run, wherever they live. It is a policy layer, not a hosting platform.
No. DLP matches patterns in payloads. PolicyLayer evaluates the structured arguments of a tool call against deterministic rules and decides whether it runs.
Deterministic, deny-by-default policy on every MCP tool call: approval gates, per-identity scopes, argument-level rules, and a tamper-proof audit log, over any server you route. Live in minutes.
Instant setup, no code required.