mcp-tunnels Plugin
Plugin Claude Code Development AI Agents & AI App DevelopmentCloud, Deployment & CI/CDClaude Code Customization & WorkflowThe explanation below is AI-generated. Please verify it against the sources.
mcp-tunnels is an official Claude plugin that connects Claude to an MCP server running inside a private network through an Anthropic MCP tunnel, using only an outbound connection with no inbound ports opened. Its main command, /create-docker-mcp-tunnel, drives the Docker Compose quickstart end to end on a single host, covering preflight checks, tunnel creation and CA registration in the Claude Console, certificate generation, proxy/Compose configuration, stack startup and verification, and calling the server from Claude. According to the README, this is a research preview provided "as-is" with no uptime or support commitment, and it depends on a third-party transport provider (Cloudflare). The plugin targets a manual-credentials, single-host, local-testing path; hardened or Kubernetes-based deployments are covered by separate official guides. The plugin is authored by Anthropic.
Overview
mcp-tunnels is a Claude plugin (not a standalone SaaS) that automates setup of an Anthropic MCP tunnel and its supporting Docker container stack (mcp-proxy, cloudflared, and an optional hello-mcp sample server) so a private MCP server can be reached by Claude without opening inbound ports.
What you can do with mcp-tunnels
- Run /create-docker-mcp-tunnel [deployment-dir] to drive the full Docker Compose quickstart for setting up an MCP tunnel
- Have the plugin perform preflight checks for Docker, Docker Compose, OpenSSL, and outbound connectivity
- Be guided through creating the tunnel and registering the CA certificate in the Claude Console while the token stays out of chat in a gitignored .env
- Get CA and server certificates generated automatically with OpenSSL, including the required extensions
- Scaffold a verifiable FastMCP sample server (hello-mcp) or wire up an existing MCP server as the upstream
- Get mcp-proxy.yaml and a docker-compose.yaml (with digest-pinned images and the cloudflared agent) written automatically
- Start the stack and verify proxy and tunnel logs, then learn how to call the server from Managed Agents and the Messages API
- Reference a troubleshooting matrix covering TLS handshake failures, the routes-must-be-a-map gotcha, tls.key permission issues, the config-is-not-hot-reloaded trap, and upstream IP validation
- Follow guidance on copying only the ca.crt certificate (never key files) between machines, e.g. via cat or scp
- Follow operational basics for token rotation and certificate renewal
Sources
Original description (English)
Connect Claude to a private MCP server through an Anthropic MCP tunnel. The /create-docker-mcp-tunnel command drives the Docker Compose quickstart end to end: certificates, proxy config, cloudflared, and a verifiable sample server.
History of mcp-tunnels
- Plugin Added mcp-tunnels