Skip to content
Secure MCP Tunnel Client

Secure MCP Tunnel Client

by OpenAI
Released
vlatest
Apache-2.0
Repository Docs
Developer ToolsCloud & Infrastructure

Summary

OpenAI's customer-run tunnel client: reach a localhost or private-network MCP server from ChatGPT, Codex, the Responses API and AgentKit without opening an inbound firewall rule.

Features

  • Outbound-only tunnel: no inbound firewall rule or public endpoint for the MCP server
  • Connects private MCP servers to ChatGPT, Codex, the Responses API and AgentKit
  • Operator endpoints /healthz, /readyz, /metrics and /ui for readiness and monitoring
  • Importable as a Go SDK using the MCP SDK's in-memory transport — no port, no stdio
  • Documented Docker, Kubernetes and VM deployment paths
  • Role, group, tunnel-ID and API-key based access control
  • Published protocol docs and OpenAPI schema for third-party client implementations

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Secure MCP Tunnel Client" tools will be available.
{
  "mcpServers": {
    "openai-secure-mcp-tunnel": {
      "command": "go",
      "args": [
        "get",
        "github.com/openai/tunnel-client"
      ]
    }
  }
}

Description

An MCP server running on a laptop, a VM or inside a Kubernetes cluster is unreachable from a hosted product — and the usual fix, a public endpoint plus an inbound firewall rule, is exactly what a security team will refuse. tunnel-client is OpenAI's answer: the customer runs the client, the client dials out to an OpenAI-hosted tunnel endpoint, and ChatGPT, Codex, the Responses API and AgentKit reach the MCP server through it while the server itself stays off the public internet.

An operable daemon, not a side process

The design assumption is that something in production will eventually depend on this tunnel, so it behaves like infrastructure. It exposes /healthz, /readyz, /metrics and a /ui endpoint, so readiness can be checked and the tunnel wired into existing monitoring before a connector or API call is pointed at it. The repository documents Docker, Kubernetes and VM deployment paths, plus a troubleshooting guide covering readiness, connector discovery and OAuth failures.

Embedding it in a Go process

Beyond the standalone binary, the module is importable as a Go SDK. Using the MCP SDK's in-memory transport pair, a Go MCP server can run in the same process as the tunnel client and never bind a port or use stdio at all — you hand the server side of the transport to your server and the client side to tunnelclient.New. For teams building a compatible client in another language, the protocol is documented and an OpenAPI schema ships in the repository.

Access control

Roles, groups, tunnel IDs and API keys are documented separately, so a tunnel can be scoped rather than handed out as a single shared credential.

Apache-2.0 licensed and published by OpenAI. tunnel-client help quickstart is the shortest path from a localhost server to a working connector.

Covered in the Weekly

Related MCP Servers

MCP: JFrog MCP Server

by JFrog

JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.

Developer Tools

MCP: Automox MCP Server

by Automox

Automox's official MCP server for endpoint management — 130+ tools over devices, patches, policies, groups and audit data, self-hosted or on Automox's hosted endpoint.

Cloud & Infrastructure
Browse all MCP servers →