mcp-tunnels

What it is

mcp-tunnels connects Claude to an MCP server running inside your private network through an Anthropic MCP tunnel. It needs no inbound ports, no public exposure, and no IP allowlisting on your origin, because traffic flows over an outbound-only connection. MCP tunnels is a research preview. It is provided "as-is" with no uptime or support commitment and depends on a third-party transport provider (Cloudflare). Users are advised to review the security model before sending anything sensitive. The plugin's main command, /create-docker-mcp-tunnel [deployment-dir], drives the MCP tunnels quickstart end to end on your machine. It uses Docker Compose with manually supplied credentials, which the README calls the shortest path for local testing. It walks you through the parts only you can do in the Claude Console and runs everything else. The steps are: 1. Preflight checks for Docker, Docker Compose, OpenSSL, and outbound connectivity. 2. You create the tunnel in the Console. The token stays out of the chat and goes into a locked-down, gitignored .env file. 3. It generates a CA and a server certificate with OpenSSL, using the exact extensions the tunnel requires. 4. You register the CA by uploading ca.crt, and the tunnel goes Active. 5. It scaffolds a verifiable FastMCP sample server or wires up an MCP server you already have. 6. It writes mcp-proxy.yaml and a docker-compose.yaml with digest-pinned images and the cloudflared agent. 7. It starts the stack and verifies the proxy and tunnel logs. 8. It shows how to call the server from Managed Agents and the Messages API. The stack it builds runs on your host and has these containers: - mcp-proxy: Anthropic's proxy, which terminates inner TLS with a cert you control, validates upstream IPs, and routes by hostname. - cloudflared: the tunnel agent, which connects outbound-only to the Anthropic tunnel edge and shares the proxy's network namespace. - hello-mcp (optional): a FastMCP sample server, used only if you don't have an MCP server to expose yet. Once running, the routed server is reachable from Claude at https://<subdomain>.<your-tunnel-domain>/<path> with nothing listening on a public port. The command also includes a troubleshooting matrix and the operational basics for token rotation and certificate renewal. The plugin targets the manual-credentials, single-host, local-testing path. For other setups, the README points to the official Deploy with Docker Compose and Deploy with Helm guides. These cover hardened single-host deployments (non-root, read-only rootfs, dropped capabilities), Kubernetes deployments, and programmatic access via Workload Identity Federation.

Who it's for

• Developers who want Claude to reach an MCP server inside a private network without opening inbound ports
• Teams testing Anthropic MCP tunnels locally on a single host with Docker Compose
• Users who need to expose an existing MCP server, or try a FastMCP sample server, to Managed Agents or the Messages API

Requirements

Examples

/create-docker-mcp-tunnel
/create-docker-mcp-tunnel ~/work/my-tunnel

cat <deployment-dir>/data/ca.crt   # default: ~/mcp-tunnel/data/ca.crt

scp coder.<workspace>:<deployment-dir>/data/ca.crt .
# generic form: scp <homespace-ssh-host>:~/mcp-tunnel/data/ca.crt .

scp <deployment-dir>/data/ca.crt <user>@<devbox-host>:~/