tunnel-client

Overview of tunnel-client

What it is

tunnel-client is a customer-run CLI and Go SDK for Secure MCP Tunnel. It connects a private or localhost MCP (Model Context Protocol) server to ChatGPT, Codex, the Responses API, and AgentKit through an OpenAI-hosted MCP tunnel endpoint, while keeping the MCP server off the public internet.

Key features

• Connects private or localhost MCP servers to OpenAI-hosted products without exposing them to the public internet.
• Provides a CLI and a Go SDK that can run beside the MCP server.
• Includes an embedded demo with server_info, echo, and uppercase tools (use --embedded-stateless-mcp-stub or --embedded-mcp-stub).
• Offers operator-visible endpoints: /healthz, /readyz, /metrics, and /ui.
• Supports Docker, Kubernetes, and VM deployments (see docs/deployment/overview.md).
• Supports MCP timing and distributed tracing (opt-in with --mcp.forward-trace-context and --tracing.enabled).
• Supports request ID forwarding (--forward-request-id).
• Supports namespaced tunnel IDs.
• Can embed an MCP server directly in a Go process using in-memory transport (see examples/go-sdk-inmemory).

Use cases

• You have an MCP server on a laptop, VM, Kubernetes cluster, or private network and need an OpenAI-hosted product to reach it.
• Security will not approve a new inbound firewall rule or public endpoint for the MCP server.
• You want an operator-visible daemon with health and metrics endpoints before a connector or API call depends on it.

Getting started

Install via Homebrew on macOS: bash brew install openai/tools/tunnel-client Verify the version and start with the guided setup: bash tunnel-client --version tunnel-client help quickstart For the Go SDK, add the module: bash go get github.com/openai/tunnel-client To try the embedded demo with a runtime API key and tunnel ID: bash export CONTROL_PLANE_API_KEY='sk-...' export CONTROL_PLANE_TUNNEL_ID='tunnel_0123456789abcdef0123456789abcdef' tunnel-client run --embedded-stateless-mcp-stub --health.listen-addr 127.0.0.1:0 For Docker, Kubernetes, or VM deployments, see the repository README.

License and pricing

Licensed under Apache-2.0. The project is open source and free to use.

Based on the project's public README and repository metadata.