New MCP Portal Logs Dataset

Cloudflare has released a new MCP Portal Logs dataset within its Logs platform, providing visibility into Cloudflare's MCP (Managed Configuration Platform) portal activity. This dataset captures 19 fields including:

• Core identifiers: ClientIP, ClientCountry, ColoCode, PortalID, ServerID, SessionID
• Request details: Method, ServerURL, ServerResponseDurationMs
• Authentication & authorization: PortalAUD, ServerAUD, UserEmail, UserID
• Operational metrics: Datetime, Success, Error, ToolCallName, PromptGetName, ResourceReadURI

Expanded Fields Across Existing Datasets

In addition to the new dataset, Cloudflare has added new fields to 10 existing Logpush datasets:

Security & Fraud Detection:

• HTTP Requests: FraudEmailRisk, FraudUserID, PayPerCrawlStatus
• Firewall Events: FraudUserID

Application & Network Monitoring:

• DEX Application Tests: HTTPRedirectEndMs, HTTPRedirectStartMs, HTTPResponseBody, HTTPResponseHeaders
• DEX Device State Events: ExperimentalExtra
• Gateway HTTP: AppControlInfo, ApplicationStatuses
• Gateway DNS: InternalDNSDurationMs
• Network Analytics Logs: DNSQueryName, DNSQueryType, PFPCustomTag

Zero Trust & Access:

• Zero Trust Network Session Logs: SNI
• WARP Toggle Changes: UserEmail
• WARP Config Changes: UserEmail

Next Steps

Developers using Cloudflare Logs should update their Logpush jobs to leverage these new fields for enhanced monitoring, analytics, and security workflows. Refer to the Logpush datasets documentation for complete field definitions and usage guidance.