Vendor-neutral MCP tunnel

Your MCP server stays where it is. The agents come to it.

mcppipe is a hosted, vendor-neutral tunnel that puts an MCP server running on your own machine behind a public HTTPS endpoint that Claude, ChatGPT and Cursor can all reach.

One outbound connection, over Streamable HTTP at a clean /mcp URL. No inbound ports, no router config, no rewriting your server for someone else's cloud.

Read the quickstart Install the CLI

Accounts open soon. The CLI and the documentation are public today — you can install it and read everything without one.

$ export MCPPIPE_API_KEY=mtk_…
$ mcppipe up --upstream http://127.0.0.1:3000

  ✓ https://filesystem--acme.mcppipe.dev
    forwarding to http://127.0.0.1:3000

Agent Claude · ChatGPT · Cursor

mcppipe edge TLS · OAuth · policy

Your machine the MCP server you already run

what the edge records allowed · 41 ms

{
  "method": "tools/call",
  "params": {
    "name": "read_file",
    "arguments": {
      "path": "~/notes/q3.md",
      "token": "[redacted]"
    }
  }
}

toolread_file
policyallow-list
hashpinned

The difference

A byte tunnel cannot read what it carries.

ngrok, Cloudflare Tunnel and Tailscale move packets, and they are good at it. ngrok publishes an MCP guide; it stops at a bearer token, an IP filter and a rate limit. None of the three knows whether the thing crossing the wire is a tools/call that just read your SSH key.

mcppipe speaks MCP. It parses the JSON-RPC, so it can show you each call, refuse the tools you did not allow, redact the fields you name, and tell you the p95 of one tool rather than the throughput of a socket.

Your call, per tunnel

You do not have to trust us with the payloads.

Inspecting default

The edge parses the JSON-RPC. It sees the method, the tool name, the arguments and the result, and stores them. That is what makes allow and deny lists, per-tool rate limits, field-level redaction, replay and per-tool latency possible.

History is kept for 24 hours on Free, 30 days on Pro and 60 days on Scale, then swept.

Zero-knowledge

The edge terminates TLS and relays the bytes onward without parsing them. Nothing is decoded, nothing is stored. We still see what any router sees — the tunnel, the subdomain, connection timing, byte volume.

The trade is real: with zero-knowledge on, allow and deny lists, per-tool rate limits, tool-definition pinning, redaction, replay and the per-tool metrics are all off, because none of them can work on bytes we never read. Only transfer is counted.

Available on every plan, including Free.

From nothing to a public endpoint

Three steps, about a minute.

01

Install the CLI

One self-contained binary for macOS, Linux and Windows. Homebrew, Scoop and an MSI are on the install page.

curl --proto '=https' --tlsv1.2 -LsSf https://mcppipe.sh | sh macOS and Linux
02

Create a tunnel

Pick a subdomain or take a generated one — it only has to be unique inside your account, because your account slug is part of the host. The dashboard shows your public host, and a CLI key that is displayed once.

https://<subdomain>--<account>.mcppipe.dev the host you get
03

Point it at your server

Forward an HTTP server, or let the CLI spawn and supervise a stdio one — it restarts the child on crash. Run it bare and it reads the config files your MCP clients already keep, so it finds the servers you have set up.

mcppipe up --stdio "npx -y @modelcontextprotocol/server-filesystem ~/notes" or --upstream http://127.0.0.1:3000 for an HTTP server

Because it understands the protocol

What you get that a tunnel cannot give you.

Every call, in the open

Live-tail MCP traffic by method, tool, arguments, latency and status — then replay any tool call against your server, with the original arguments or your edited ones.
Tools you did not list stay shut

Name the tools a tunnel may expose and the edge refuses the rest before they reach your machine — exact tool names, checked on every tools/call. Rate limits scope to a single tool or method, not the whole socket.
Redacted before it is recorded

Field-level redaction rewrites the values you name — tokens, paths, customer data — in the copy we store and show you. Your server still receives the real argument, verbatim.
Told when a tool changes under you

mcppipe hashes every tool definition your server advertises and tells you — by webhook and in the dashboard — when one you approved is rewritten. Turn blocking on for that tunnel and the next call to the changed tool is refused instead of run.
Auth the spec actually asks for

Switch a tunnel to OAuth and nothing reaches your server without a token bound to that exact hostname — RFC 9728 discovery and RFC 8707 audience binding, as the MCP spec requires. Service tokens for headless agents, and an IP allow-list when a machine, not a person, is calling.
Several servers, one endpoint

Put a filesystem server, a database server and an internal API behind one tunnel. mcppipe merges their tool lists — each tool prefixed with its upstream, so two servers can both ship a search — and routes every call to the right one. If one stops answering, the others keep serving.

Because it still has to be a tunnel

The parts you only notice when they fail.

A local inspector, on your machine

Start the tunnel with --inspect and mcppipe serves a UI on 127.0.0.1:4040: every call decoded as MCP — method, tool, error code, latency — streaming live, and replayable against your local server. It holds the last 500 requests in memory and writes nothing to disk.
A second machine does not evict the first

Run the same tunnel from your laptop and from a CI box and both stay connected: the newest one serves, the others stand by and take over if it drops. Past your plan limit the new connection is refused by name — the tunnel already running is never dropped to make room. Three sessions per tunnel on Free, ten on Pro.
A reconnect picks up the queue

Reconnect within 60 seconds and the broker replays the calls it had not yet had an answer for, so a flaky link does not drop the work queued behind it. A call your server was already running is not re-run — mcppipe never executes a tool call twice.
Slow tools and streams survive

Responses are relayed chunk by chunk, never buffered, and SSE passes through with the headers that stop an intermediate proxy from holding it. Your server has 60 seconds to start replying; once bytes are flowing there is no ceiling, so a long tool call runs as long as it needs to.
Your domain, not just ours

Point mcp.yourcompany.com at a tunnel, prove it with a DNS TXT record, and we issue and renew the certificate for you. On Pro and above; every plan reaches its tunnels on the mcppipe zone.
Made for a container, not just a laptop

Every flag has an MCPPIPE_* environment variable, so there is no interactive setup. With no terminal attached the CLI stops asking questions and gets on with it. On docker stop it finishes the calls already in flight instead of timing out.

One tunnel, every agent

The model vendors each built a tunnel for their own model.

Anthropic's MCP Tunnels are a research preview you deploy yourself — a Kubernetes cluster or a Docker Compose VM, plus a registered CA certificate — and tunnels created in their Console are not available as connectors in claude.ai. OpenAI's Secure MCP Tunnel reaches ChatGPT, Codex, the Responses API and AgentKit. Neither can serve the other without undercutting the lock-in that paid for it.

The same mcppipe subdomain answers all of them — over Streamable HTTP, at a clean /mcp URL, with no interstitial warning page on any plan. You install a CLI; there is no cluster to run.

See the client compatibility matrix → Vendor documentation as published July 2026.

Pricing

A flat price with a ceiling, never a usage bill.

Every plan has a monthly ceiling on tunnels, tool calls and transfer — and reaching it returns a clear 429, not an invoice. There is no metered billing and no overage path. Inspection and tool policy come with every tier, including Free.

Free

$0 /mo

No credit card, ever.
- 2 tunnels
- 100k MCP tool calls / mo
- 5 GB transfer / mo
- Full MCP inspection, tool allow/deny policy and per-tool rate limits
- Payload redaction and replay — included, not gated
- 24-hour call history
- No session timeout, no credit card, no overage charge
Read the quickstart
Pro
Popular

$12 /mo

or $120/year — two months free
- 5 tunnels
- 1M MCP tool calls / mo
- 25 GB transfer / mo
- Everything in Free, plus:
- Your own domain, with TLS issued and renewed for you
- 30-day call history
- 10 concurrent CLI sessions per tunnel
Read the quickstart
Scale

$39 /mo

or $390/year — two months free
- 20 tunnels
- 5M MCP tool calls / mo
- 100 GB transfer / mo
- Everything in Pro, plus:
- 60-day call history
- 25 concurrent CLI sessions per tunnel
Read the quickstart

Full plan comparison, retention and billing details →

Your MCP server stays where it is. The agents come to it.

A byte tunnel cannot read what it carries.

You do not have to trust us with the payloads.

Inspecting default

Zero-knowledge

Three steps, about a minute.

Install the CLI

Create a tunnel

Point it at your server

What you get that a tunnel cannot give you.

Every call, in the open

Tools you did not list stay shut

Redacted before it is recorded

Told when a tool changes under you

Auth the spec actually asks for

Several servers, one endpoint

The parts you only notice when they fail.

A local inspector, on your machine

A second machine does not evict the first

A reconnect picks up the queue

Slow tools and streams survive

Your domain, not just ours

Made for a container, not just a laptop

The model vendors each built a tunnel for their own model.

A flat price with a ceiling, never a usage bill.

Free

Pro

Scale