Metorial vs Cloudflare MCP server portals
Cloudflare MCP server portals (Cloudflare One / Zero Trust) and Metorial both put a governed layer between AI clients and the tools your company uses.
Where Cloudflare MCP server portals wins: Bundled into Cloudflare Zero Trust: free for up to 50 users, and plugs into existing Access policies, IdPs, Gateway DLP and shadow-MCP detection.
Metorial is the stronger fit if you want self-hosting, Git-synced skills and skills teams write together.
Every Cloudflare MCP server portals fact below links to Cloudflare MCP server portals's own page. Anything they don't publish is marked "Not published", not "No".
Where Cloudflare MCP server portals wins
- Bundled into Cloudflare Zero Trust: free for up to 50 users, and plugs into existing Access policies, IdPs, Gateway DLP and shadow-MCP detection.source
- Code Mode collapses all upstream tools into two tools (search + execute) running in isolated Workers, cutting tool-definition context sharply.source
- Can reach MCP servers on private networks without exposing them publicly, via Cloudflare's network (Sept 2026).source
Key differences
Each cell links to the page it comes from.
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Source license | FSL-1.1-ALv2 engine (Apache 2.0 after two years); Apache-2.0 integration catalogsourceThe engine (metorial-platform) is source-available under FSL and converts to Apache 2.0 two years after each release. The integration catalog (metorial/metorial) is Apache-2.0. | Not publishedManaged Cloudflare service; no source repo for portals found. |
| Self-host | Yessource | Not publishedRuns on Cloudflare's network only; requires an active Cloudflare zone. |
| Integration catalog | 1,000+source | Not publishedNo integration catalog; admins register their own or third-party remote servers. |
| One URL for all tools | Yessource | Yessource |
| Per-user OAuth | Yessource | YessourceRequire user auth is default; can instead use a shared admin credential. |
| SSO (SAML or OIDC) | Yessource | Yessource |
| SCIM provisioning | Yessource | YessourceZero Trust-wide SCIM; applies to Access groups used in portal policies. |
| Role or group-based tool access | Yessource | PartialsourceAccess policies at server and portal level; tool toggles are portal-wide, not per role. Docs warn blocked users can bypass via direct server URL unless Access is the server's OAuth provider. |
| Audit log per person | Yessource | Yessource |
| Create and edit skills | Yessource | Not published |
| Git sync for skills | Yessource | Not published |
| Own chat app required | Nosource | Nosource |
| Prompt-injection detection | Yessource | PartialsourceVia separate AI Security for Apps product for public-facing MCP servers, not a portal feature. |
| EU data region | Yessource | Not publishedCloudflare has data localization products; not documented for MCP portals. |
| SOC 2 Type II | Yessource | YessourceCompany-level; portal scope not stated. |
| LLM gateway or model routing | No | PartialsourceSeparate product (AI Gateway), not part of MCP portals. |
| Starting price | $0 (Dev); Scale from $250/monthsource | $0 up to 50 users; $7/user/month Pay-as-you-gosourcePrice shown as $7 /user/month. |
Which AI clients each works in
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Claude (web and desktop) | Yessource | YessourceExamples use mcp-remote. |
| Claude Code | Yessource | Not publishedGeneric: works with MCP clients that support remote servers. |
| ChatGPT | Yessource | Not publishedChatGPT named only as an example MCP client in launch blog, no setup docs. |
| Cursor | Yessource | Not published |
| Codex | Yessource | Not published |
| GitHub Copilot | Yessource | Not published |
| Custom agents (SDK or API) | Yessource | YessourceMachine-to-machine access for agents via service tokens (added June 2026). |
Full checklist
Every row we track, with what it means. "Not published" means the vendor's own pages don't say.
Connect
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Integration catalogHow many ready-made integrations or MCP servers the vendor publishes. | 1,000+source | Not publishedNo integration catalog; admins register their own or third-party remote servers. |
| Verified or official serversThe catalog includes servers the vendor tests or maintains, not only community listings. | Yessource | Not publishedAdmins review/approve servers before exposure, but no vendor-verified catalog. |
| Bring your own MCP serverYou can add an MCP server you built or host yourself. | Yessource | Yessource |
| Remote (HTTP) MCP serversConnects to MCP servers hosted elsewhere over HTTP. | Yessource | Yessource |
| Local, stdio or Docker serversRuns MCP servers that ship as local processes or containers. | Yessource | NosourceStdio servers must be self-hosted behind HTTP first. Private-network HTTP servers supported since Sept 2026. |
| One URL for all toolsA user adds one endpoint to their AI client and reaches every approved tool through it. | Yessource | Yessource |
| Version pinningYou can lock an integration to a known version. | Yessource | Not published |
| Schema change monitoringChanges to tool definitions are detected and flagged. | Yessource | Not published |
AI clients
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Claude (web and desktop)Documented to work in the Claude apps. | Yessource | YessourceExamples use mcp-remote. |
| Claude CodeDocumented to work in Claude Code. | Yessource | Not publishedGeneric: works with MCP clients that support remote servers. |
| ChatGPTDocumented to work in ChatGPT. | Yessource | Not publishedChatGPT named only as an example MCP client in launch blog, no setup docs. |
| CursorDocumented to work in Cursor. | Yessource | Not published |
| CodexDocumented to work in Codex. | Yessource | Not published |
| GitHub CopilotDocumented to work in GitHub Copilot. | Yessource | Not published |
| Custom agents (SDK or API)Your own agents can use the tools through an SDK or API. | Yessource | YessourceMachine-to-machine access for agents via service tokens (added June 2026). |
| Own chat app requiredYes means people must work inside the vendor’s own app rather than the AI client they already use. | Nosource | Nosource |
Identity and access
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Per-user OAuthTool calls run with each person’s own account, not a shared key. | Yessource | YessourceRequire user auth is default; can instead use a shared admin credential. |
| Managed OAuth appsThe vendor provides OAuth apps so you don’t register your own. | Yessource | Not published'Managed OAuth' refers to client-to-portal auth, not pre-built upstream OAuth apps. |
| Bring your own OAuth appYou can use OAuth apps registered under your own company. | Yessource | Yessource |
| SSO (SAML or OIDC)People sign in through your identity provider. | Yessource | Yessource |
| SCIM provisioningUsers and groups sync automatically from your identity provider. | Yessource | YessourceZero Trust-wide SCIM; applies to Access groups used in portal policies. |
| Role or group-based tool accessAccess to tools follows roles or groups. | Yessource | PartialsourceAccess policies at server and portal level; tool toggles are portal-wide, not per role. Docs warn blocked users can bypass via direct server URL unless Access is the server's OAuth provider. |
| Tool-level allow and denyIndividual tools can be allowed or blocked, not only whole servers. | Yessource | Yessourcedefault_disabled enables allowlist mode. |
| Read-only modesAn integration can be limited to read-only tools. | Yessource | PartialsourceWriteGuard risk tiers (Read Only ... Critical) in private beta since Aug 5, 2026. |
Visibility and security
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Audit log per personEvery call is recorded and tied to the person or agent who made it. | Yessource | Yessource |
| Call tracingTool arguments and results are recorded for debugging and review. | Yessource | PartialsourceLogs show time, status, server, capability, duration; no payload-level tracing described. |
| Log export or SIEMLogs can be exported or streamed to your security tools. | Yessource | PartialsourceLogpush export of portal logs is Enterprise only. |
| Data redaction or DLPSensitive data in tool traffic can be detected, masked or blocked. | Yessource | PartialsourceRequires routing portal traffic through Cloudflare Gateway (since Mar 2026); DLP scanning/blocking, redaction not stated. |
| Prompt-injection detectionTool traffic is inspected for prompt-injection attacks. | Yessource | PartialsourceVia separate AI Security for Apps product for public-facing MCP servers, not a portal feature. |
| Tool-poisoning protectionMalicious or changed tool descriptions are detected. | YesThrough Protoguard. | Not published |
Skills
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Create and edit skillsTeams can write and edit shared skills in the product. | Yessource | Not published |
| Git sync for skillsSkills sync to or from a Git repository. | Yessource | Not published |
| Skills delivered by roleSkills reach people based on their role or group. | Yessource | Not published |
| Skills over MCPSkills are served to AI clients through MCP. | Not published | Not published |
Deployment
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Source licenseThe license the product’s code is published under, if any. | FSL-1.1-ALv2 engine (Apache 2.0 after two years); Apache-2.0 integration catalogsourceThe engine (metorial-platform) is source-available under FSL and converts to Apache 2.0 two years after each release. The integration catalog (metorial/metorial) is Apache-2.0. | Not publishedManaged Cloudflare service; no source repo for portals found. |
| Self-hostYou can run it on your own infrastructure. | Yessource | Not publishedRuns on Cloudflare's network only; requires an active Cloudflare zone. |
| VPC or on-premCan be deployed in your own cloud account or data center. | Yessource | PartialsourcePortal is SaaS; upstream servers can sit on private networks. |
| Air-gappedCan run with no internet connection. | Yes | Not published |
| EU data regionData can be hosted in the EU. | Yessource | Not publishedCloudflare has data localization products; not documented for MCP portals. |
Compliance
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| SOC 2 Type IIHolds a SOC 2 Type II report. | Yessource | YessourceCompany-level; portal scope not stated. |
| ISO 27001Holds ISO/IEC 27001 certification. | Not published | YessourceCompany-level; portal scope not stated. |
| HIPAASupports HIPAA workloads, usually with a BAA. | YesSigns BAAs. | Not published |
| GDPR and DPAStates GDPR compliance and offers a data processing agreement. | YessourceA data processing agreement is published at /legal/data-processing-agreement. | PartialsourceGDPR addressed; DPA not stated. |
Pricing
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| Public pricingPrices are published on the vendor’s site. | Yessource | Yessource |
| Free tierA free plan or free edition exists. | Yessource | YessourcePortals available on all plans per Aug 2025 changelog. |
| Starting priceThe lowest published paid price, as listed. | $0 (Dev); Scale from $250/monthsource | $0 up to 50 users; $7/user/month Pay-as-you-gosourcePrice shown as $7 /user/month. |
| Pricing modelHow the vendor charges: per seat, usage, platform fee, or a mix. | Flat monthly plans with paid add-ons (extra seats, tool calls)source | Bundled in Cloudflare Zero Trust seat pricing (per user/month); no separate MCP portal charge publishedsource |
Model layer
| Feature | Metorial | Cloudflare MCP server portals |
|---|---|---|
| LLM gateway or model routingRoutes model traffic, not only tool traffic. | No | PartialsourceSeparate product (AI Gateway), not part of MCP portals. |
| Cost tracking per personShows AI spend per person or team. | No | Not publishedAI Gateway tracks cost per app, not per user in portals. |
Which should you pick?
| Situation | Pick | Why |
|---|---|---|
| Rolling AI out to every employee in the clients they already use | Either | Both connect to existing AI clients. Compare the client list below. |
| You must self-host | Metorial | Metorial documents self-hosting; Cloudflare MCP server portals's own pages don't state a self-hosted option. |
| You need an LLM gateway or model routing today | A dedicated model router | Metorial doesn't ship an LLM gateway, and Cloudflare MCP server portals's pages don't state one. |
| Teams should share skills, not only tools | Metorial | Metorial lets teams write skills together and deliver them by role. |
| You are building integrations into your own product | Either | Both offer an SDK or API for your own agents. |
Pricing
Published prices only. Nothing is estimated.
Metorial
What each Metorial plan includes
From the Metorial pricing page.
| Included | Metorial Dev | Metorial Scale | Metorial for Enterprise |
|---|---|---|---|
| Tool calls per month | 500,000 | 2,500,000 | Custom |
| Callbacks | 10,000 | 100,000 | Custom |
| Workforce seats | 2 | 20 | Custom |
| Provider integrations | 10 | Unlimited | Unlimited |
| Log retention | 30 days | 90 days | Custom |
| Production access | Not included | Included | Included |
On every plan
- Slack and email support
- Auth Connections: Unlimited
- Sessions: Unlimited
- Concurrent Connections: Unlimited
- Developer API Access
- Custom Integrations
- Remote MCP Servers
- Managed MCP Servers
Cloudflare MCP server portals limits
As published by the vendor.
- MCP servers per portal: up to 80source
- Server transport: Remote HTTP (Streamable HTTP / SSE) only; stdio-only servers cannot be addedsource
- Free plan users: 50 userssource
- Log retention: 24 hours (Free), 30 days (Pay-as-you-go), 6 months (Contract)source
- Prerequisite: Active domain on Cloudflare and an IdP configured in Zero Trustsource
Moving from Cloudflare MCP server portals to Metorial
- Remote MCP servers you use through Cloudflare MCP server portals can be added to Metorial as they are.
- OAuth apps registered under your company can be reused, so people sign in the way they do today.
- Sign-in moves to your identity provider through SAML; groups decide who gets which tools.
- Skills, policies and audit history in Cloudflare MCP server portals don't transfer automatically. Talk to us about moving them.
Book a demo to plan the move with us.
Frequently asked questions
Common questions about Metorial and Cloudflare MCP server portals.
Is Cloudflare MCP server portals open source?
Cloudflare MCP server portals's own pages don't state a source license.Can I self-host Cloudflare MCP server portals?
Cloudflare MCP server portals's own pages don't say whether it can be self-hosted.Does Cloudflare MCP server portals work with ChatGPT?
Cloudflare MCP server portals's own pages don't document ChatGPT support.Is Metorial cheaper than Cloudflare MCP server portals?
Metorial's Dev plan is free and Scale starts at $250 a month. Cloudflare MCP server portals publishes Free at $0 forever up to 50 users and Pay-as-you-go at $7 per user/month. The right answer depends on team size; see the pricing section.Is Metorial SOC 2 compliant?
Yes. Metorial is SOC 2 Type 2 and GDPR compliant, with EU and US regions.Is Metorial open source?
Metorial's engine is published under FSL-1.1-ALv2 engine (Apache 2.0 after two years); Apache-2.0 integration catalog. You can self-host it or use the hosted platform.
More comparisons
Metorial vs ArchestraMetorial vs BarndoorMetorial vs Docker MCP GatewayMetorial vs ContextForge MCP GatewayMetorial vs Microsoft MCP Gateway / Azure API Management MCPMetorial vs MintiveMetorial vs ObotMetorial vs Speakeasy AI Control PlaneMetorial vs TrueFoundry AI GatewayBest open-source MCP gatewaysMetorial vs RunlayerMetorial vs Arcade.dev
Checked October 17, 2026. 28 Cloudflare MCP server portals facts are sourced, each linked in its row. Spotted something wrong? Tell us and we will fix it. All product names are trademarks of their owners.