# Show HN: Mcptunnels – ngrok for MCP with basic OAuth

> Source: <https://terragohan.github.io/mcptunnels/>
> Published: 2026-09-01 20:34:55+00:00

### One command

`mcptunnel expose -- <your MCP server>`

spawns any stdio MCP server, bridges it to Streamable HTTP, and prints a public URL. Nothing to deploy.

`mcptunnel expose -- <your MCP server>`

spawns any stdio MCP server, bridges it to Streamable HTTP, and prints a public URL. Nothing to deploy.

No signup, no login, no config files. The hosted relay at `tunnel.mcptunnels.xyz`

is the default — or self-host your own `tunneld`

.

Public endpoints are gated behind a password the CLI generates. Clients like ChatGPT, Claude, and Cursor discover the OAuth flow automatically. `--no-auth`

for open URLs.

Tunnels live for 24 hours, then they’re gone. Ctrl-C deletes the tunnel server-side immediately — the URL and password die with your process.

Generic tunnels forward raw TCP/HTTP. mcptunnels is MCP-shaped.

| mcptunnels | ngrok | cloudflared | bore | |
|---|---|---|---|---|
| Takes an MCP server command | ✅ | ❌ (ports only) | ❌ | ❌ |
| stdio → Streamable HTTP bridging | ✅ | ❌ | ❌ | ❌ |
| No account required | ✅ | ❌ | ❌ (named tunnels) | ✅ |
| Self-hostable relay | ✅ | ❌ | ❌ | ✅ |
| Ephemeral-by-default URLs | ✅ (24h TTL) | ❌ | ❌ | ✅ |

If you already have an MCP server listening on a port with its own HTTP transport, a generic tunnel works fine. mcptunnels removes the stdio bridging step and everything around it.

**Status: v1.** The tunnel data plane is covered by end-to-end tests; compatibility
with every major hosted MCP client is not yet exhaustively verified. Bug reports welcome on
[GitHub](https://github.com/terragohan/mcptunnels/issues).

Where mcptunnels is headed. Roughly ordered; no dates — this is a spare-time project and priorities follow real user pain.

`mcptunnel expose – <cmd>`

→ public URL.`–no-auth`

for open URLs).`tunneld`

: single binary + SQLite, ACME TLS, Docker or bare-metal.The MVP’s ephemerality is the feature that lets us skip accounts — and the first thing real users will outgrow.

`/<you>/<name>`

once, keep it across restarts, reboots, and laptop sleeps.Today `expose`

bolts a public URL onto a single local process. The destination is making MCP servers easy to *run and scale* as Streamable HTTP services.

Per-tunnel OAuth 2.1 (discovery metadata, DCR, PKCE) shipped with the MVP. What comes later:

`https://tunnel.mcptunnels.xyz`

for convenience — it’s free and best-effort, and self-hosting
stays a first-class path.)[File an issue](https://github.com/terragohan/mcptunnels/issues) describing your use case —
especially if the MVP’s 24h model is the thing blocking you. That’s the signal that permanent
tunnels should move up.