Skip to content
Talk to Us

Blocks.ai publishes this comparison and sells in this market. Every claim about another product links to a public source.

Cloudflare MCP server portals vs ServiceNow AI Control Tower

Cloudflare MCP server portals

Cloudflare One feature that puts MCP servers behind one governed endpoint

ServiceNow AI Control Tower

What ServiceNow calls a central hub to discover, secure, govern, observe, and measure AI

Short answer

Cloudflare says its MCP server portals, part of Cloudflare One, put MCP servers behind one governed endpoint; ServiceNow describes AI Control Tower as a central hub to discover, secure, govern, observe, and measure AI.⁠Source 1, Source 2, Source 3, Source 4 Portals proxy MCP tool calls, as ServiceNow’s community documentation says its AI Gateway does.⁠Source 2, Source 5

By Blocks.ai teamLast checked

Where each one sits

Six layers of running AI agents at a company, and what each product’s own public sources say it covers.

These aren’t the same kind of product

Where they overlap
Both can proxy agents’ calls to MCP servers, with access policy and logging; ServiceNow’s community documentation says AI Control Tower does this through its AI Gateway.⁠Source 2, Source 5, Source 6
Where they differ
Portals govern MCP servers and tools; a registry of agents isn’t publicly documented.⁠Source 2 ServiceNow says AI Control Tower also inventories agents, models, and datasets, and can contain a managed agent.⁠Source 4, Source 7, Source 8
Running both
Neither vendor publicly documents using the two together. Cloudflare’s portals accept remote MCP clients; ServiceNow’s community documentation says its AI Gateway governs MCP connections from any agent platform.⁠Source 2, Source 6
Public sources · checked 2 October 2026
  • Offered
  • Not publicly documented

Cloudflare MCP server portals

  • Build agents: Not publicly documented
  • Host and run agents: Not publicly documented
  • Identity and access: OfferedIdentity provider or service token⁠Source 2
  • Registry and governance: OfferedCentrally managed MCP servers⁠Source 2
  • Traffic between agents, tools, and models: OfferedProxy for MCP tool calls⁠Source 2
  • Agents across organizations: Not publicly documented

ServiceNow AI Control Tower

  • Build agents: Not publicly documented
  • Host and run agents: Not publicly documented
  • Identity and access: OfferedScoped OAuth tokens (community docs)⁠Source 9
  • Registry and governance: OfferedAI inventory tied to CMDB⁠Source 4
  • Traffic between agents, tools, and models: OfferedAI Gateway (community docs)⁠Source 5
  • Agents across organizations: Not publicly documented

At a glance

TopicCloudflare MCP server portalsServiceNow AI Control Tower
What it isPuts multiple MCP servers behind one HTTP endpoint, with Cloudflare Access as the governance layer.⁠Source 2, Source 3 Cloudflare says portals are part of Cloudflare One.⁠Source 1What ServiceNow calls a central hub to discover, secure, govern, observe, and measure AI, running on the ServiceNow AI Platform.⁠Source 4
What it keeps track ofMCP servers and their tools, up to 80 servers per portal.⁠Source 2 A registry of agents is not publicly documented.ServiceNow says it inventories first- and third-party AI agents, models, and MCP servers, plus copilots and datasets, tied to the CMDB.⁠Source 4
How agents reach MCP toolsAs MCP clients at the portal’s URL, signed in through Cloudflare Access with a user’s identity provider or an Access service token.⁠Source 2, Source 10ServiceNow’s community documentation says AI Gateway, a ServiceNow-hosted MCP proxy, verifies agent identity and issues scoped, short-lived OAuth 2.1 tokens.⁠Source 5, Source 9
Pricing modelCloudflare says MCP server portals are available to all Cloudflare customers.⁠Source 11 A separate price for portals is not publicly documented.Contact ServiceNow for pricing.⁠Source 4 Included in the Foundation, Advanced, and Prime tiers.⁠Source 12
Generally availableSince 24 September 2026, after an open beta announced in August 2025.⁠Source 11, Source 13ServiceNow announced general availability on 6 May 2025.⁠Source 14 ServiceNow’s community documentation says AI Gateway became generally available on 10 September 2026.⁠Source 15

What each one is

Cloudflare MCP server portals

Cloudflare says MCP server portals are part of Cloudflare One, its SASE platform.⁠Source 1 Admins add MCP servers to Cloudflare Access, and a portal puts them behind one HTTP endpoint.⁠Source 2 Access policies decide which users can connect to it, and Access logs each tool request.⁠Source 2

ServiceNow AI Control Tower

ServiceNow describes AI Control Tower as a central hub to discover, secure, govern, observe, and measure AI across an enterprise.⁠Source 4 ServiceNow says it inventories first- and third-party AI agents, models, and MCP servers.⁠Source 4 ServiceNow’s community documentation says its AI Gateway proxies agents’ MCP traffic.⁠Source 5

The differences that matter

  1. What each one keeps track of

    Cloudflare MCP server portals

    A portal brings together MCP servers that admins add to Cloudflare Access, up to 80, and admins choose which tools it exposes.⁠Source 2

    ServiceNow AI Control Tower

    ServiceNow says it auto-discovers agents, models, MCP servers, and datasets into one inventory tied to the CMDB; connectors you set up reach external platforms.⁠Source 4, Source 16, Source 17

    ServiceNow’s community documentation says governance workflows run only for assets marked Managed.⁠Source 18

  2. Identity on MCP tool calls

    Cloudflare MCP server portals

    A user signs in through Cloudflare Access with their identity provider; agents can use an Access service token, whose upstream requests use the admin credential.⁠Source 2, Source 10

    ServiceNow AI Control Tower

    ServiceNow’s community documentation says AI Gateway verifies agent identity and issues scoped, short-lived OAuth 2.1 tokens; tool policies can follow role or department.⁠Source 6, Source 9

    Portals can’t add MCP servers that use stdio transport only, and ServiceNow’s community documentation says AI Gateway doesn’t support servers running locally on a developer’s machine.⁠Source 2, Source 6

  3. Cutting off access

    Cloudflare MCP server portals

    Admins can turn off a portal’s tools so users can’t call them through it, and delete an Access service token to revoke its access.⁠Source 2, Source 19

    ServiceNow AI Control Tower

    A kill switch can contain a managed agent and revoke all of its active credentials across connected systems.⁠Source 7, Source 8

    Cloudflare cautions that blocked users can still reach a server by its direct URL, and advises making Access the server’s OAuth provider.⁠Source 2

For security teams

What a security review asks, answered from each vendor’s public documentation.

TopicCloudflare MCP server portalsServiceNow AI Control Tower
Network exposureMCP clients reach the portal’s HTTPS URL.⁠Source 2 Private MCP servers can join through outbound-only Cloudflare Tunnel, with Gateway routing on.⁠Source 2, Source 20ServiceNow’s community documentation says agents using AI Gateway call a ServiceNow-hosted URL.⁠Source 5 Network requirements are not publicly documented.
IdentityAccess sign-in through your identity provider, or an Access service token for agents.⁠Source 2, Source 10 Independent MFA isn’t enforced for portal-authorized servers.⁠Source 2ServiceNow’s community documentation says AI Gateway issues scoped, short-lived OAuth 2.1 tokens for MCP connections through it.⁠Source 9
Access changes and revocationService tokens can be deleted to revoke access, turned off and on again, or set to auto-disable when unused.⁠Source 19A kill switch can contain a managed agent and revoke all of its active credentials across connected systems.⁠Source 7, Source 8
Audit trailAccess logs each request made with a portal’s tools.⁠Source 2 Logpush export to a SIEM is on Enterprise plans only.⁠Source 2Each kill-switch containment leaves an immutable audit trail.⁠Source 7 ServiceNow’s community documentation says AI Gateway logs every MCP transaction through it.⁠Source 6
ComplianceNot publicly documented (checked 2 October 2026)ServiceNow says the company has a SOC 2 Type 2 attestation and ISO/IEC 42001 certification.⁠Source 21 Product scope: not publicly documented.

Full comparison

18 criteria in five groups. Every cell links to its source, or says no public source answers it.

Cloudflare MCP server portals and ServiceNow AI Control Tower compared on 18 criteria
Cloudflare MCP server portalsServiceNow AI Control Tower
What it is
What it is and who it’s forCloudflare says portals are part of Cloudflare One, its SASE platform.⁠Source 1 A portal puts multiple MCP servers behind one HTTP endpoint, governed through Access.⁠Source 2, Source 3ServiceNow describes it as a central hub to discover, secure, govern, observe, and measure AI, on the ServiceNow AI Platform.⁠Source 4
MaturityGA since 24 September 2026, after an open beta announced 26 August 2025.⁠Source 11, Source 13 Previously called Agents Gateway in some contexts.⁠Source 2ServiceNow announced general availability on 6 May 2025.⁠Source 14 ServiceNow’s community documentation says AI Gateway became generally available on 10 September 2026.⁠Source 15
Control
Agent registry and discoveryAdmins add MCP servers to Cloudflare Access for central management, up to 80 per portal.⁠Source 2 A registry of agents is not publicly documented.ServiceNow says it auto-discovers agents, models, MCP servers, and datasets into one inventory tied to the CMDB.⁠Source 4 Connectors you set up reach external platforms.⁠Source 16, Source 17
Identity and access controlSign-in through Access with an identity provider, or an Access service token for agents.⁠Source 2, Source 10 Policies can match emails, groups, country, and device posture.⁠Source 2ServiceNow’s community documentation says AI Gateway verifies agent identity and issues scoped, short-lived OAuth 2.1 tokens for MCP connections through it.⁠Source 9
Ownership, policy, and revocationAdmins choose each portal’s tools and prompt templates; turned-off tools can’t be called through it.⁠Source 2 Service tokens can be turned off or deleted.⁠Source 19A kill switch can contain a managed agent and revoke all of its active credentials across connected systems.⁠Source 7, Source 8 It covers ServiceNow and four other platforms.⁠Source 22
Audit log and observabilityAccess logs each tool request, viewable per portal or per server.⁠Source 2 Logpush export, recording user email and tool name, is on Enterprise plans only.⁠Source 2, Source 23Each containment is audited.⁠Source 7 ServiceNow’s community documentation says AI Gateway logs each MCP transaction through it, in tamper-evident logs.⁠Source 6
Connection
How agents connectMCP clients reach the portal’s HTTPS URL; it proxies tool calls.⁠Source 2 Private servers join via Cloudflare Tunnel, with Gateway routing on.⁠Source 2, Source 24ServiceNow’s community documentation says agents using AI Gateway call a ServiceNow-hosted URL instead of the MCP server, which must be remote.⁠Source 5, Source 6
Agents across organizationsPortals can include third-party MCP servers.⁠Source 3 A way for another organization to register its own agents in a portal is not publicly documented.Third-party systems like Microsoft Agent 365 can discover publishable agents via an open API.⁠Source 25 Partner-controlled agents: not publicly documented.
Protocol supportMCP: stateless 2026-07-28 and earlier 2025 Streamable HTTP clients and servers.⁠Source 2 Cloudflare’s separate Agents SDK has a published A2A server example.⁠Source 26ServiceNow’s community documentation calls its AI Gateway its MCP enforcement layer.⁠Source 9 A2A is documented for ServiceNow’s separate AI Agent Studio.⁠Source 27
Frameworks, models, and clouds supportedWorks with MCP clients that support remote servers, such as Claude Desktop or Windsurf.⁠Source 2 Stdio-only servers can’t be added; some servers reject proxies.⁠Source 2ServiceNow says it inventories agents, models, and MCP servers from ServiceNow or third parties.⁠Source 4 Connectors reach external platforms.⁠Source 16
Operations
Deployment options and data residencyA portal’s hostname is a proxied CNAME record pointing to gateway.agents.cloudflare.com.⁠Source 2 Self-hosting a portal is not publicly documented.Data may go to a central ServiceNow environment in another region, or a third-party cloud.⁠Source 28 ServiceNow says controls can switch this off.⁠Source 28
Compliance attestationsNot publicly documented (checked 2 October 2026)ServiceNow says the company holds a SOC 2 Type 2 attestation and ISO/IEC 42001.⁠Source 21 Content packs: EU AI Act, NIST AI RMF, California SB 53, Colorado AI Act.⁠Source 29
Support and SLASupport options vary by Zero Trust plan; professional services are Contract add-ons.⁠Source 30 Cloudflare advertises a 100% uptime SLA for paid Zero Trust plans.⁠Source 30ServiceNow’s Customer Support Addendum states a 99.8% availability SLA for production instances.⁠Source 31 ServiceNow’s community documentation points to Now Support.⁠Source 32
Time and effort to get runningNeeds a domain on Cloudflare and an identity provider in Zero Trust.⁠Source 2 Then add MCP servers, create a portal with tools and policies, and connect clients.⁠Source 2A Guided Setup widget walks through initial configuration.⁠Source 33 Discovering an outside platform’s agents needs a connector and credentials you supply.⁠Source 17
Pricing model and public pricesCloudflare says MCP server portals are available to all Cloudflare customers.⁠Source 11 A separate price for portals is not publicly documented.ServiceNow’s tiers page says fully managing external AI assets needs a separate license.⁠Source 12 ServiceNow’s community documentation says usage-based costs may apply.⁠Source 6, Source 34
Building
Agent building toolsSeparately from portals, Cloudflare’s Agents docs cover building and hosting agents on Cloudflare; remote MCP servers can be built on Workers.⁠Source 3, Source 35ServiceNow’s separate AI Agent Studio creates, configures, and deploys agents.⁠Source 36 Creating new custom agents is supported only in the Prime tier.⁠Source 12
Model accessNot publicly documented for portals. Agents built with Cloudflare’s separate Agents SDK can use Workers AI, OpenAI, Anthropic, or Google Gemini.⁠Source 37Model provider settings cover ServiceNow-supported providers, such as Now LLM Service and AWS Claude, and ones your organization configures.⁠Source 38
Integrations and ecosystemPortals can be managed with Terraform.⁠Source 2 Cloudflare One supports social, open source, and corporate identity providers.⁠Source 39 A marketplace: not publicly documented.ServiceNow’s community documentation names discovery connectors for Databricks, Snowflake, and Hugging Face, and says connectors can also be custom-built.⁠Source 18, Source 32

Which to choose

Choose Cloudflare MCP server portals if

  • You already use Cloudflare One, which Cloudflare says includes portals, now generally available to all Cloudflare customers.⁠Source 1, Source 11
  • You want many MCP servers behind one endpoint that MCP clients such as Claude Desktop or Windsurf can connect to.⁠Source 2
  • You want MCP access decided by Access policies on emails, groups, country, and device posture, with per-portal tool choices.⁠Source 2
  • You want tool-request logs with the user’s email and tool name, exported to your SIEM with Logpush on an Enterprise plan.⁠Source 2, Source 23

Choose ServiceNow AI Control Tower if

  • You run ServiceNow and want AI assets tied to your CMDB, which ServiceNow says it does with lineage, ownership, and relationships.⁠Source 4
  • You want agents, models, and MCP servers from ServiceNow and other platforms in one inventory, which ServiceNow says it builds by auto-discovery.⁠Source 4, Source 16
  • You want a kill switch that contains a managed agent and revokes all of its active credentials across connected systems.⁠Source 7, Source 8
  • You want compliance content: ServiceNow’s pack covers the EU AI Act, NIST AI RMF, California SB 53, and Colorado’s AI Act.⁠Source 29

Questions buyers ask

Does either one keep a registry of AI agents?

Portals bring MCP servers under central management in Cloudflare Access; a registry of agents is not publicly documented for portals.⁠Source 2 ServiceNow says AI Control Tower inventories first- and third-party AI agents, models, and MCP servers.⁠Source 4

Do they support MCP and A2A?

Portals support stateless MCP 2026-07-28 and earlier 2025 Streamable HTTP clients and servers; portal A2A support is not publicly documented.⁠Source 2 ServiceNow’s community documentation says its AI Gateway governs MCP connections; A2A is documented for ServiceNow’s separate AI Agent Studio.⁠Source 9, Source 27

How is each one priced?

Cloudflare says MCP server portals are available to all Cloudflare customers.⁠Source 11 A separate price for portals is not publicly documented. Contact ServiceNow for AI Control Tower pricing; ServiceNow’s community documentation says usage-based costs may apply.⁠Source 4, Source 6, Source 34

Can either one govern agents built on other platforms?

MCP clients that support remote servers can connect to a portal, including agents using an Access service token.⁠Source 2, Source 10 ServiceNow’s community documentation says its AI Gateway governs MCP connections from any agent platform, such as AWS Bedrock.⁠Source 6

How we compare

Read the full method

Every claim on this page links to a public source. Where none answers a question, the page says so.

We re-check every fact at least every 90 days. This page was last checked .

Something wrong or out of date? Tell us and we’ll correct it.

Sources

44 public sources, each with the date we checked it. Every one opens in a new tab.

  1. Source 1: Securing the AI Revolution: Introducing Cloudflare MCP Server Portals Cloudflare · checked Back:abcde

  2. Source 2: MCP server portals · Cloudflare One docs Cloudflare · checked Back:abcdefghijklmnopqrstuvwxyz272829303132333435363738394041424344454647

  3. Source 3: MCP governance · Cloudflare Agents docs Cloudflare · checked Back:abcde

  4. Source 4: AI Control Tower - ServiceNow (product page) ServiceNow · checked Back:abcdefghijklmnop

  5. Source 5: AI Gateway Implementation Guide (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:abcdefg

  6. Source 6: AI Gateway FAQ (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:abcdefghij

  7. Source 7: AI agent containment using kill switch protocol manually (ServiceNow product documentation, Australia release) ServiceNow · checked Back:abcdefg

  8. Source 8: Configure AI agent containment using kill switch protocol manually (ServiceNow product documentation, Australia release) ServiceNow · checked Back:abcde

  9. Source 9: What's new in AI Gateway v3.4 - September 2026 release (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:abcdefg

  10. Source 10: Service token support for MCP server portals · Changelog Cloudflare · checked Back:abcde

  11. Source 11: MCP server portals are now generally available · Changelog Cloudflare · checked Back:abcdef

  12. Source 12: ServiceNow product tiers (ServiceNow product documentation, Australia release) ServiceNow · checked Back:abc

  13. Source 13: MCP server portals · Changelog Cloudflare · checked Back:ab

  14. Source 14: ServiceNow Launches AI Control Tower, a Centralized Command Center to Govern, Manage, Secure, and Realize Value From Any AI Agent, Model, and Workflow (ServiceNow news release, investor relations PDF) ServiceNow · checked Back:ab

  15. Source 15: What's new in AI Control Tower for August & September 2026 (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:ab

  16. Source 16: Discovering AI assets through connectors (ServiceNow product documentation, Australia release) ServiceNow · checked Back:abcd

  17. Source 17: Configuring connectors (ServiceNow product documentation, Australia release) ServiceNow · checked Back:abc

  18. Source 18: AI Control Tower: What's new in the June 2026 release (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:ab

  19. Source 19: Service tokens · Cloudflare One docs Cloudflare · checked Back:abc

  20. Source 20: Cloudflare Tunnel · Cloudflare One docs Cloudflare · checked Back to text

  21. Source 21: Compliance - ServiceNow Trust ServiceNow · checked Back:ab

  22. Source 22: Control enforcement points (ServiceNow product documentation, Australia release) ServiceNow · checked Back to text

  23. Source 23: MCP Portal Logs · Cloudflare Logs docs Cloudflare · checked Back:ab

  24. Source 24: Private MCP server support for MCP server portals · Changelog Cloudflare · checked Back to text

  25. Source 25: External Registries (ServiceNow product documentation, Australia release) ServiceNow · checked Back to text

  26. Source 26: agents/examples/a2a · cloudflare/agents (GitHub) Cloudflare · checked Back to text

  27. Source 27: Integrating external AI agents (ServiceNow product documentation, Australia release) ServiceNow · checked Back:ab

  28. Source 28: AI Control Tower (ServiceNow product documentation, Australia release) ServiceNow · checked Back:ab

  29. Source 29: AI Risk and Compliance Content Pack (ServiceNow product documentation, Australia release, Governance, Risk, and Compliance) ServiceNow · checked Back:ab

  30. Source 30: Cloudflare Access | Zero Trust Network Access (ZTNA) Cloudflare · checked Back:ab

  31. Source 31: Customer Support Addendum (ServiceNow legal schedules, Version 12MAR2025) ServiceNow · checked Back to text

  32. Source 32: AI Control Tower Welcome Guide (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:ab

  33. Source 33: AI Control Tower release notes (ServiceNow product documentation, Australia release) ServiceNow · checked Back to text

  34. Source 34: AI Control Tower Observability & Monitoring FAQ (ServiceNow Community, AI Control Tower articles) ServiceNow · checked Back:ab

  35. Source 35: Build Agents on Cloudflare · Cloudflare Agents docs Cloudflare · checked Back to text

  36. Source 36: AI Agent Studio (ServiceNow product documentation, Australia release) ServiceNow · checked Back to text

  37. Source 37: Using AI Models · Cloudflare Agents docs Cloudflare · checked Back to text

  38. Source 38: AI model providers (ServiceNow product documentation, Australia release) ServiceNow · checked Back to text

  39. Source 39: Identity providers · Cloudflare One docs Cloudflare · checked Back to text

  40. Source 40: Your company's private network Blocks.ai · checked Back to text

  41. Source 41: Network requirements Blocks.ai · checked Back to text

  42. Source 42: Solutions: Agent sprawl Blocks.ai · checked Back to text

  43. Source 43: Solutions: Partner networks Blocks.ai · checked Back to text

  44. Source 44: Pricing Blocks.ai · checked Back to text