Securing the Miro MCP server

With the rise of MCP and the associated security risks, I wanted to explore ways to enforce security rules on MCP traffic — in particular, to the Miro MCP.

I wanted organisations to be able to:

• enforce DLP policies, so sensitive data is not sent to Miro MCP
• control who can use the Miro MCP
• control which tools within the Miro MCP could be used

The result? All 3 were achieved with Cloudflare! (I used it as I am most familar with the platform compared to other security vendors). Results differ depending on deployment (see below), and there are more pros and cons that I do not state here.

1. Enforce DLP policies

I set up the relevant DLP and HTTP policies to block sensitive information, and then used Claude code to send sensitive information to a Miro board, via Miro MCP. It was blocked successfully!

DLP blocked ABN from being sent to Miro MCP

Cloudflare logs when accessing miro mcp server directly

when accessing via cloudflare portal using my custom domain

Decrypted payload

2. Control who can use the Miro MCP

Can be done on both the mcp server portal, or the mcp servers individually.

set access policies per mcp server to control who can access specific servers

3. Control which tools within Miro MCP could be used

These are the tools within the Miro MCP Server. On the mcp portal, these tools can be edited or toggled off completely. Really useful for organisations who want to limit the scope of MCP.

The tools within miro MCP can be toggled on/off

To give more context, there are two ways MCP traffic can be proxied through Cloudflare;

• via Secure Web Gateway (I deployed it through the Cloudflare agent)

In this set up, Cloudflare proxies outbound traffic going to the internet, including calls to the Miro MCP server. (This method is not new; existed before the rise of MCP)

• By deploying the MCP server on the MCP Portal

This is the new part. In my case, I deployed the miro MCP server through the Cloudflare MCP portal