Skip to content

Commit c72cf7b

Browse files
pedrosousapedrosousa
committed
Merge branch 'production' into dpena/implementation-guide
2 parents 1f4950e + 08cf39d commit c72cf7b

File tree

14 files changed

+446
-34
lines changed

14 files changed

+446
-34
lines changed

‎src/content/docs/agents/model-context-protocol/mcp-portal.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
pcx_content_type: navigation
3+
title: MCP server portals
4+
tags:
5+
- MCP
6+
sidebar:
7+
order: 101
8+
external_link: /cloudflare-one/applications/configure-apps/mcp-servers/mcp-portals/
9+
description: Centralize multiple MCP servers onto a single endpoint and customize the tools, prompts, and resources available to users.
10+
11+
---

‎src/content/docs/cloudflare-one/account-limits.mdx‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,21 @@ This page lists the default account limits for rules, applications, fields, and
1313

1414
| Feature | Limit |
1515
| --------------------------- | ----- |
16-
| Applications count | 500 |
16+
| Applications | 500 |
1717
| Audit Logpush jobs | 5 |
1818
| Email addresses per rule | 1,000 |
19-
| Group count | 300 |
20-
| Group size | 1,000 |
19+
| Rule groups | 300 |
20+
| Rules per rule group | 1,000 |
2121
| IP addresses per rule | 1,000 |
2222
| mTLS root certificates | 50 |
23-
| Service tokens count | 50 |
24-
| IdP count | 50 |
25-
| Reusable policies count | 500 |
26-
| Rules count per application | 1,000 |
27-
| Rules count per group | 1,000 |
23+
| Service tokens | 50 |
24+
| Identity providers | 50 |
25+
| Reusable policies | 500 |
26+
| Rules per application | 1,000 |
2827
| Domains per application | 5 |
2928
| Infrastructure targets | 5,000 |
29+
| MCP portals | 20 |
30+
| MCP servers per portal | 10 |
3031

3132
## Gateway
3233

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/anthropic.mdx‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
pcx_content_type: reference
3+
title: Anthropic
4+
rss: file
5+
---
6+
7+
import { Render } from "~/components";
8+
9+
<Render
10+
file="casb/integration-description"
11+
product="cloudflare-one"
12+
params={{
13+
integrationName: "Anthropic",
14+
integrationAccountType: "Anthropic account",
15+
}}
16+
/>
17+
18+
This integration covers the following Anthropic products:
19+
20+
- Claude Console (organizations, workspaces/projects, users, invites)
21+
- Anthropic API Platform (organization and project API keys)
22+
23+
## Integration prerequisites
24+
25+
- An Anthropic [Team or Enterprise organization](https://www.anthropic.com/pricing#team-&-enterprise)
26+
- [Organization-level admin (or equivalent) privileges in Anthropic](https://support.anthropic.com/articles/10186004-api-console-roles-and-permissions) to view organization metadata and manage API keys
27+
28+
## Integration permissions
29+
30+
For the Anthropic integration to function, Cloudflare CASB requires authorization via **API keys**:
31+
32+
- `Organization API key (organization-level)`: Grants read-only access to organization/workspace metadata, members and invites, and key metadata used for findings.
33+
- (Optional) `Project API key (project-level)`: Grants read-only access to project metadata and keys when you include project scopes in the scan.
34+
35+
These credentials follow the principle of least privilege so that only the minimum required access is granted.
36+
37+
## Security findings
38+
39+
<Render
40+
file="casb/security-findings"
41+
product="cloudflare-one"
42+
params={{ integrationName: "Anthropic", slugRelativePath: "anthropic" }}
43+
/>
44+
45+
### API key hygiene
46+
47+
Detect API keys that may be unused or overdue for rotation.
48+
49+
| Finding type | FindingTypeID | Severity |
50+
| ------------------------- | -------------------------------------- | -------- |
51+
| Anthropic: Unused API key | `f343cd22-21f0-45a6-b6f7-39b1539a0f2b` | Medium |
52+
53+
### Access security
54+
55+
Flag organization access issues to help enforce best practices.
56+
57+
| Finding type | FindingTypeID | Severity |
58+
| -------------------------------- | -------------------------------------- | -------- |
59+
| Anthropic: High-privilege invite | `a435d091-3bb1-42e1-bc98-32d80c6340a5` | High |
60+
| Anthropic: Stale pending invite | `5667f7fa-4215-4a8e-80d7-4694ea33335b` | Low |
61+
62+
### Data Loss Prevention (optional)
63+
64+
<Render file="casb/data-loss-prevention" product="cloudflare-one" />
65+
66+
| Finding type | FindingTypeID | Severity |
67+
| --------------------------------------------------- | -------------------------------------- | -------- |
68+
| Anthropic: Downloadable File with DLP Profile match | `74ec2a38-0e69-48d4-80ed-a8faad5f40ef` | High |

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/google-workspace/gemini.mdx‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
pcx_content_type: reference
3+
title: Gemini for Google Workspace
4+
rss: file
5+
---
6+
7+
import { Render } from "~/components";
8+
9+
<Render
10+
file="casb/integration-description"
11+
product="cloudflare-one"
12+
params={{
13+
integrationName: "Gemini for Google Workspace",
14+
integrationAccountType: "Google Workspace account",
15+
}}
16+
/>
17+
18+
## Integration prerequisites
19+
20+
<Render file="casb/google/google-prereqs" product="cloudflare-one" />
21+
22+
## Integration permissions
23+
24+
<Render
25+
file="casb/integration-perms"
26+
product="cloudflare-one"
27+
params={{
28+
parentIntegration: "Google Workspace",
29+
parentSlug: "google-workspace",
30+
}}
31+
/>
32+
33+
## Security findings
34+
35+
<Render
36+
file="casb/security-findings"
37+
product="cloudflare-one"
38+
params={{
39+
integrationName: "Gemini for Google Workspace",
40+
slugRelativePath: "gemini",
41+
}}
42+
/>
43+
44+
### User account settings
45+
46+
| Finding type | FindingTypeID | Severity | Description |
47+
| ---------------------------------------------------------------------------------------- | -------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------ |
48+
| Google Workspace: Admin user with Gemini license with two-factor authentication disabled | `27a0a9a0-13c6-4d8f-a67c-b455dd213cb9` | High | An administrator with a Gemini for Google Workspace license does not have two-factor authentication enabled. |
49+
| Google Workspace: User with Gemini license with two-factor authentication disabled | `c82024dc-b836-4b86-8c90-ab07971474e4` | Medium | A user with a Gemini for Google Workspace license does not have two-factor authentication enabled. |
50+
51+
### Inactive or suspended users
52+
53+
| Finding type | FindingTypeID | Severity | Description |
54+
| ------------------------------------------------------------ | -------------------------------------- | -------- | -------------------------------------------------------------------------------------- |
55+
| Google Workspace: Admin user suspended with AI Ultra license | `ee7d4ed6-479f-404f-8dbd-f82dce2a0f66` | Low | An administrator account with an AI Ultra (Gemini for Workspace) license is suspended. |
56+
| Google Workspace: User suspended with AI Ultra license | `cf20e808-29ad-4026-a8f9-6ec3e069376c` | Low | A user account with an AI Ultra (Gemini for Workspace) license is suspended. |
57+
58+
### Gemini licensing
59+
60+
<Render file="casb/google/gemini-licensing" product="cloudflare-one" />

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/google-workspace/index.mdx‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,10 @@ These permissions follow the principle of least privilege to ensure that only th
5959

6060
<Render file="casb/google/inactive-suspended-users" product="cloudflare-one" />
6161

62+
### Gemini licensing
63+
64+
<Render file="casb/google/gemini-licensing" product="cloudflare-one" />
65+
6266
### File sharing
6367

6468
<Render file="casb/google/file-sharing" product="cloudflare-one" />

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/openai.mdx‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
---
2+
pcx_content_type: reference
3+
title: OpenAI
4+
rss: file
5+
---
6+
7+
import { Render } from "~/components";
8+
9+
The OpenAI integration detects a variety of data loss prevention, account misconfiguration, and user security risks in an integrated OpenAI account that could leave you and your organization vulnerable.
10+
11+
This integration covers the following OpenAI products:
12+
13+
- ChatGPT Enterprise (Workspaces)
14+
- OpenAI Platform Projects (API keys)
15+
- GPTs (custom GPTs)
16+
17+
:::note
18+
Before you begin, ensure that OpenAI has enabled ChatGPT Enterprise Compliance API access for your organization. You will need an Admin API key issued for your organization, your Organization ID, and your Workspace ID. These are available in your [ChatGPT Admin Settings](https://chatgpt.com/admin/settings).
19+
20+
If Compliance API access is not yet turned on for your organization, refer to [Enable Compliance API access](#enable-combliane-api-access).
21+
:::
22+
23+
## Integration prerequisites
24+
25+
- An OpenAI organization with a ChatGPT Enterprise workspace
26+
- Organization-level admin privileges to create and manage Admin API keys
27+
- (Optional) A Project API key and the corresponding Project ID if you plan to include OpenAI Platform Projects in the scan scope
28+
29+
### Enable Compliance API access
30+
31+
Compliance API access is required to use the OpenAI CASB integration. To enable Compliance API access:
32+
33+
1. Contact `[email protected]` to request access to the Compliance API for your organization and for the API key you will use with Cloudflare CASB. In your request, include:
34+
- The last four characters of the API key
35+
- The name of the API key
36+
- The name of the user who created the key
37+
- The requested scope (`read`, `write`, or both)
38+
2. OpenAI will verify the key and grant the requested Compliance API scopes.
39+
3. After the scopes are granted, [add the OpenAI integration to CASB](/cloudflare-one/applications/casb/#add-an-integration). When prompted, enter your Open AI Admin API key, Organization ID, and Workspace ID (available at `https://chatgpt.com/admin/settings`).
40+
41+
For more information, refer to the [OpenAI Help Center](https://help.openai.com/articles/9261474-compliance-api-for-enterprise-customers).
42+
43+
## Integration permissions
44+
45+
For the OpenAI integration to function, Cloudflare CASB requires the following authorization via API keys:
46+
47+
- `Admin API key (organization-level)`: Grants read-only access to organization/workspace metadata, GPTs, users, invites, and audit/compliance objects exposed by the ChatGPT Enterprise Compliance API.
48+
- (Optional) `Project API key (project-level)`: Grants read-only access to OpenAI Platform project metadata and keys.
49+
50+
These credentials follow the principle of least privilege so that only the minimum required access is granted.
51+
52+
## Security findings
53+
54+
<Render
55+
file="casb/security-findings"
56+
product="cloudflare-one"
57+
params={{ integrationName: "OpenAI", slugRelativePath: "openai" }}
58+
/>
59+
60+
### Model and tool governance
61+
62+
Flag risky tool and capability settings on custom GPTs.
63+
64+
| Finding type | FindingTypeID | Severity | ChatGPT Enterprise required |
65+
| ----------------------------------------- | -------------------------------------- | -------- | --------------------------- |
66+
| OpenAI: GPT with Custom Actions enabled | `5a2995f5-0cc1-4af3-9045-cdf7e6601f7b` | High | ✅ |
67+
| OpenAI: GPT with Code Interpreter enabled | `d368036a-be90-49f0-b7da-5092a3f8beb4` | Medium | ✅ |
68+
| OpenAI: GPT with web browsing enabled | `3af14358-5ff2-4502-921e-7ffd9a310093` | Medium | ✅ |
69+
70+
### Publishing and sharing
71+
72+
Identify GPTs that are externally visible beyond your organization.
73+
74+
| Finding type | FindingTypeID | Severity | ChatGPT Enterprise required |
75+
| ----------------------------------------------- | -------------------------------------- | -------- | --------------------------- |
76+
| OpenAI: GPT publicly accessible via GPT Store | `c69adfa6-2362-4939-86ec-49ff34093cfd` | High | ✅ |
77+
| OpenAI: GPT publicly accessible via public link | `de460c9f-55c0-4131-9cdf-e4c3b84f9549` | High | ✅ |
78+
79+
### API key hygiene
80+
81+
Detect API keys that may be stale, unused, or overdue for rotation.
82+
83+
| Finding type | FindingTypeID | Severity | ChatGPT Enterprise required |
84+
| ----------------------------------- | -------------------------------------- | -------- | --------------------------- |
85+
| OpenAI: Admin API key not rotated | `b72e971d-f5b9-4cf3-96f4-ef82bdf38453` | High | ❌ |
86+
| OpenAI: Project API key not rotated | `2c079fe8-6188-43e1-a2e5-d0e2dd8c7686` | High | ❌ |
87+
| OpenAI: Unused admin API key | `49c75a36-1e64-437b-98a1-e54ec35d0a64` | Medium | ❌ |
88+
| OpenAI: Unused project API key | `c8fd231b-de51-43cc-8c3f-e1e57114c5f5` | Medium | ❌ |
89+
90+
### Access security
91+
92+
Flag user/invite issues to help enforce best practices.
93+
94+
| Finding type | FindingTypeID | Severity | ChatGPT Enterprise required |
95+
| ----------------------------- | -------------------------------------- | -------- | --------------------------- |
96+
| OpenAI: High-privilege invite | `776ceb93-fa9a-4ca0-83db-668a67c09936` | High | ❌ |
97+
| OpenAI: Inactive user | `20ab9ddb-fd48-46a8-9fdf-9bb9b9061f21` | Medium | ❌ |
98+
| OpenAI: Stale pending invite | `18fd5b21-8489-485e-9c93-0bd4a696e724` | Low | ❌ |
99+
100+
### Data Loss Prevention (optional)
101+
102+
<Render file="casb/data-loss-prevention" product="cloudflare-one" />
103+
104+
| Finding type | FindingTypeID | Severity | ChatGPT Enterprise required |
105+
| ----------------------------------------------------------- | -------------------------------------- | -------- | --------------------------- |
106+
| OpenAI: File in ChatGPT Conversation with DLP Profile match | `9aca654d-b331-4052-a5b4-2ceecced8676` | High | ✅ |
107+
| OpenAI: File in ChatGPT GPT with DLP Profile match | `520200f5-7dcc-42c9-bc3c-423019159d45` | High | ✅ |
108+
| OpenAI: File in ChatGPT Project with DLP Profile match | `8e46ec69-e5c1-4f53-ab00-a92f2050ec33` | High | ❌ |

‎src/content/docs/cloudflare-one/applications/configure-apps/mcp-servers/linked-apps.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ title: Authenticate MCP server to self-hosted apps
44
tags:
55
- MCP
66
sidebar:
7-
order: 2
7+
order: 3
88
label: Enable MCP OAuth to self-hosted apps
99
---
1010

0 commit comments

Comments
 (0)