mcptunnels

mcptunnels is an open-source CLI tool that exposes local MCP (Model Context Protocol) servers to the public internet in a single command. Built by Terra Gohan and licensed under Apache 2.0, it bridges stdio MCP servers to Streamable HTTP and prints a public URL — no deployment, no accounts, no configuration files required. The project reached v1 in August 2026 and is actively developed as a spare-time project.

What It Is

mcptunnels is a purpose-built tunneling tool for the MCP ecosystem. Unlike generic tunnels such as ngrok or cloudflared that forward raw TCP/HTTP traffic, mcptunnels understands the MCP protocol: it spawns any stdio MCP server, bridges it to Streamable HTTP, and creates an ephemeral public URL through a hosted relay at tunnel.mcptunnels.xyz. The core use cases are connecting remote MCP clients (Claude, ChatGPT, Cursor) to a locally running server, demoing an MCP server to a teammate without deploying anything, and testing a server against a real client during development.

How the Tunnel Architecture Works

The tool operates through an outbound WebSocket connection so no inbound ports are required and it works behind NAT:

• mcptunnel expose asks the relay (tunneld) for a quick tunnel and receives an ephemeral tenant plus an agent key
• It spawns the specified command and bridges stdio to loopback HTTP
• The agent dials outbound to tunneld via WebSocket + yamux — no inbound ports needed
• tunneld reverse-proxies public HTTPS requests over that connection to the local process

The relay component (tunneld) is a self-hostable single binary backed by SQLite with ACME TLS support, deployable via Docker or bare-metal. The data plane is covered by end-to-end tests including WebSocket + yamux proxy, stdio bridge, SSE streaming, and automatic reconnect.

Security Model

All tunnels are OAuth 2.1-protected by default. When a tunnel is created, the CLI generates a password; MCP clients like ChatGPT, Claude, and Cursor discover the OAuth flow automatically and prompt for that password. The --no-auth flag creates open URLs with no authentication. Key security properties:

• Tunnels expire after 24 hours automatically; Ctrl-C deletes the tunnel server-side immediately
• All traffic transits the relay operator — the project explicitly warns to expose throwaway servers only, never private data
• A managed bearer token registry (mcptunnel token add/list/remove) handles long-lived credentials without putting secrets on the command line

CLI Capabilities

Beyond the basic expose command, mcptunnels supports several modes:

• Expose a remote HTTP MCP server: mcptunnel expose --url https://api.example.com/mcp points the tunnel at an existing Streamable HTTP endpoint
• Reverse bridge: mcptunnel run --url <url> bridges a remote Streamable HTTP MCP server to local stdio, so stdio-only clients can consume remote servers
• Header injection: --header "Authorization: Bearer $KEY" (repeatable) forwards credentials to upstream servers
• Token registry: Register tokens once per upstream; expose and run pick them up automatically from the OS config directory

Prebuilt binaries are available for Linux and macOS (amd64/arm64) via GitHub Releases, and the tool can also be installed with go install (requires Go 1.26+).

Update: v1 and Roadmap

The project shipped v1 on August 25, 2026, covering anonymous quick tunnels, OAuth 2.1 by default, 24h TTL with a janitor sweeping expired tenants, a self-hostable tunneld, and an end-to-end tested data plane. The roadmap — explicitly ordered by real user pain with no fixed dates — targets permanent named tunnels with stable URLs and minimal identity next, followed by a stdio-to-HTTP framework for scaling MCP servers as Streamable HTTP services, and later pluggable identity providers and audience isolation. The project explicitly rules out generic TCP/HTTP tunneling and a billing-backed hosted SaaS as non-goals, keeping the default public relay free and best-effort while self-hosting remains a first-class path.