ngrok alternative for MCP: ngrok vs Cloudflare Tunnel vs Tailscale Funnel vs MCP Warp

Oct 10, 2026

For MCP servers, the main ngrok alternatives are Cloudflare Tunnel with Access (free, needs a domain and an identity provider), Tailscale Funnel (no auth of its own, reported failures with claude.ai), and MCP-specific tunnels like MCP Warp or mcptunnels, which add OAuth and stdio support. ChatGPT-only users can use OpenAI’s Secure MCP Tunnel and its open-source client.

If you reached for ngrok out of habit, got a URL, and claude.ai still won’t connect or you’re uneasy about an open URL to your laptop, this page compares what else is out there. For how to add a URL to each client once you have one, see One URL for your MCP server, in every client.

What an MCP tunnel has to do that a web tunnel doesn’t

Any tunnel gives a local port a public HTTPS address. For an MCP server used from claude.ai, ChatGPT or the Claude mobile apps, three more things matter:

Auth that MCP clients understand. A public URL to an MCP server lets anyone who finds it run your tools on your machine. MCP clients discover OAuth on their own: an unauthenticated request gets a 401 with a WWW-Authenticate header pointing at Protected Resource Metadata (RFC 9728), and the client runs the sign-in. claude.ai also accepts a fixed header, which is simpler and weaker. A tunnel that only offers IP rules or a shared key leaves the OAuth part to you.
A stable URL. A custom connector stores the URL. If the tunnel hands out a new random hostname every time it starts, you re-add the connector every time.
stdio. Many MCP servers only speak stdio: the client is expected to launch them as a process. A web tunnel forwards HTTP, so a stdio server needs a bridge such as supergateway in front. Use a stdio MCP server in claude.ai and ChatGPT without deploying it covers that in detail.

Comparison table

As of 10 October 2026. Prices and limits change; check each vendor’s page before you decide.

Tunnel	OAuth for MCP clients	stdio	Stable URL	Needs your own domain	Setup steps	Price
ngrok	No. ngrok’s MCP guide shows IP rules and API-key checks	Needs a bridge	Yes, one auto-assigned dev domain on Free	No	Account, agent, Traffic Policy, bridge for stdio	Free tier; Hobbyist $10/month; custom domains from Pay-as-you-go ($20/month plus usage)
Cloudflare Tunnel plus Access	You configure Access and an identity provider	Needs a bridge	Yes, on a named tunnel	Yes, a domain on Cloudflare	Domain, cloudflared, tunnel, hostname, Access app, identity provider, bridge for stdio	Free tier (see Cloudflare’s pricing)
Tailscale Funnel	No auth of its own	Needs a bridge	Yes, `device.tailnet.ts.net`	No	Tailscale on the machine, enable Funnel, auth in your server, bridge for stdio	Not stated in the Funnel doc; available on all plans
MCP Warp	Yes, OAuth at the edge, owner only	Yes, spawns the command	Yes, named per server	No, URLs are under `tunnel.mcpwarp.io`	Install, sign in once on the web, config file, `mcpwarp login`, `mcpwarp up`	Free (100 requests/month, 1 server); $5 or $10/month

The “Needs your own domain” column means a domain you register and point at the service. “No” means the service gives you a hostname under its own domain.

MCP-specific and first-party options, covered further down. This table swaps “Needs your own domain” and “Setup steps” for “Who it serves”, because these tools differ mostly in which clients they reach:

Option	OAuth for MCP clients	stdio	Stable URL	Who it serves	Price
mcptunnels	Yes, by default (generated password on the authorize page)	Yes	No, random URL, expires after 24h	Any Streamable HTTP client	Free, no signup
OpenAI Secure MCP Tunnel	n/a, server stays private	Yes	n/a	ChatGPT, Codex, the Responses API, AgentKit	Open-source client; no cost stated
Anthropic MCP tunnels	No, OAuth on each server is yours	No, Streamable HTTP only	Yes	Claude, for Enterprise organizations	Enterprise plan only, by request
mcp-use tunnel	No, the server’s own auth applies	Not stated	No, expires after 24h	Servers built with mcp-use	Not stated; “for local testing”

ngrok

ngrok is a strong general-purpose tunnel, and it now presents itself for MCP. Its MCP guide calls ngrok an “MCP gateway” that lets you “securely expose your local development environment to AI platforms like OpenAI and Claude.” For protection, ngrok’s MCP guide shows Traffic Policy rules restricting traffic to Anthropic’s IP addresses, checking an API key in the Authorization header, and rate limiting per key.

That’s useful, and it’s not MCP OAuth. The guide doesn’t cover Protected Resource Metadata or dynamic client registration, so claude.ai won’t find a sign-in on its own. An API key does work with claude.ai if you put it in the custom connector’s “Request headers” field, which Anthropic’s help article describes as “fixed credentials such as API keys that Claude sends on every request”. That’s a shared secret living in a connector setting. An IP allowlist on its own isn’t per-user either: it admits every request from Anthropic’s range, 160.79.104.0/21 (Anthropic’s IP addresses page), whoever’s chat it came from.

ngrok forwards HTTP, so a stdio server needs a bridge in front.

On URLs and price, from ngrok’s pricing page and domains docs:

Free includes one dev domain. ngrok says “Every ngrok account comes with a free Dev Domain” whose URL “is automatically generated and cannot be changed”, and calls it “a stable, auto-assigned hostname”. So the URL stays the same across restarts; you just can’t choose it. Free also lists up to 1GB of data transfer, up to 20k HTTP/S requests, and an interstitial page on HTTP/S endpoints. We haven’t tested how MCP clients handle that interstitial.
Hobbyist is $10 a month (less with annual billing), with 10 ngrok-branded domains and no interstitial page.
Pay-as-you-go starts at $20 a month plus usage and is the first plan that lets you bring your own custom domain.

ngrok makes sense if you already use it, you’re happy with a fixed key or IP rules, and your server speaks Streamable HTTP.

Cloudflare Tunnel with Access

Cloudflare Tunnel is free and robust, and with Access in front it can do real sign-in. The cost is setup. Counting the steps:

Have a domain on Cloudflare. Cloudflare’s tunnel guide says “Before you publish an application through your tunnel, you must add a website to Cloudflare.”
Create a tunnel in the dashboard and install cloudflared on your machine.
Add a public hostname that points at the local MCP port.
Set up Zero Trust and create an Access application for that hostname.
Connect an identity provider.
Make the result something an MCP client can discover and sign in to. This is the fiddly part: this write-up on zenn shows what the DIY route takes, and mcp-ferry exists to glue the pieces together.
Add a stdio bridge if the server needs one.

Quick tunnels skip most of that. Per Cloudflare’s docs, “You do not need a Cloudflare account or domain”, but “the hostname changes each time you create a Quick Tunnel”, nothing sits in front to check who’s calling, and “Quick Tunnels do not support Server-Sent Events (SSE)”, which Streamable HTTP servers use to stream responses. Cloudflare says they “are for testing and development”. They suit a five-minute check. A connector you keep needs a hostname that doesn’t change.

If you already own a domain on Cloudflare and don’t mind an afternoon of configuration, this is a good free choice.

Tailscale Funnel

Tailscale is built for private networks between your own devices. Funnel is the part that puts a service on the public internet: tailscale funnel 3000 publishes local port 3000 at a hostname like https://amelie-workstation.pango-lin.ts.net. Per Tailscale’s docs, Funnel “is available for all plans”, “is currently in beta”, “can only listen on ports 443, 8443, and 10000”, and traffic over it “is subject to non-configurable bandwidth limits”.

Funnel adds no auth for public traffic: it shares a service “for anyone to access”. Whatever protects your MCP server has to be in the server or a proxy in front of it. And there are reports of Funnel URLs failing with claude.ai. anthropics/claude-ai-mcp #953 describes a Funnel-hosted server “being fully reachable and functional from outside” that still gets “Couldn’t reach the MCP server”, and #864 reports “Authorization with the MCP server failed” through Funnel. The checklist for “Couldn’t reach the MCP server” has the details.

claude.ai can’t join your tailnet, so plain tailnet addresses never work for web clients. Tailscale works well for Claude Code or VS Code on your own devices: they run locally, so a tailnet address to a server on another of your machines works without Funnel.

MCP Warp

MCP Warp is the tunnel we build, so weigh this section accordingly. It was made for the three requirements above: each server gets its own named URL, https://<name>-<username>.tunnel.mcpwarp.io/mcp, with OAuth at the edge, and it can spawn stdio servers itself or proxy to a local Streamable HTTP server.

Every request needs an OAuth token, and the edge checks that the token belongs to the server’s owner; a valid token from another account gets a 403. That also means a URL works for your account only, so it isn’t a way to share a server with other people. See Security.

The first run: install the CLI, sign in once at web.mcpwarp.io to pick a username, then add the server to ~/.mcpwarp/config.json:

{
  "servers": [
    {
      "name": "blender",
      "kind": "stdio",
      "command": "uvx",
      "args": ["blender-mcp"],
      "env": { "BLENDER_PATH": "/Applications/Blender.app" }
    }
  ]
}

mcpwarp login
mcpwarp up

NAME     KIND   URL
blender  stdio  https://blender-anatoly.tunnel.mcpwarp.io/mcp

After that it’s mcpwarp up each time. The URL stays the same as long as the server’s name doesn’t change. Get started has the full walkthrough, and Expose a stdio server covers the stdio bridge and its limits.

The trade-offs: mcpwarp up must be running, or the URL returns 503. The Free plan is 100 requests a month and 1 server, and every HTTP request a client makes counts, so Free is for trying it out. Plus is $5 a month with unlimited requests and 1 server; Pro is $10 a month with unlimited requests and servers (Limits and quotas). MCP Warp is small and new.

MCP Warp isn’t certified by Anthropic or OpenAI; it’s built to work with Claude and ChatGPT as a standard Streamable HTTP MCP client.

Other options worth knowing

mcptunnels is the closest free equivalent. One command bridges a stdio server and gives it a public URL:

mcptunnel expose -- npx -y @modelcontextprotocol/server-everything

Its README says tunnels are “anonymous, OAuth-protected by default, and expire after 24 hours.” The CLI prints the URL and a generated password, and you enter the password on the authorize page during the client’s OAuth flow. The URL has a random segment, so when the tunnel expires you get a new one and re-add the connector. That 24-hour limit is the real catch; the tool itself does the job. You can also run its relay yourself.

OpenAI Secure MCP Tunnel connects “private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit” while keeping the server off the public internet, and it can spawn stdio servers. It’s first-party, and the client is open source. If ChatGPT is the only client you use, it’s probably the better pick. It does nothing for claude.ai. OpenAI’s announcement has the setup.

mcp-use tunnels come with the mcp-use framework (mcp-use dev --tunnel). URLs look like https://<adjective>-<color>.tunnel.mcp-use.run/mcp, “Connected tunnels expire after 24 hours”, each IP can have up to 5 active tunnels, and the docs say they “are for local testing before deployment”.

Anthropic’s MCP tunnels are first-party but not free for most people: they are “available to organizations on the Claude Enterprise plan by request”, run inside your network on Kubernetes or Docker Compose with cloudflared, and carry Streamable HTTP only (Anthropic docs).

Which one to pick

You only use ChatGPT. OpenAI’s Secure MCP Tunnel. Open-source client, stdio included, nothing public.
You’re on Claude Enterprise. Ask your admin about Anthropic’s MCP tunnels before anything else.
You own a domain on Cloudflare and like configuring things. Cloudflare Tunnel with Access. Free, solid, a few hours of setup.
You only use clients on your own devices (Claude Code, VS Code). Tailscale without Funnel, or plain localhost on the same machine. No public URL needed.
You already pay for ngrok and your server speaks HTTP. ngrok with an API key in a request header and IP rules. The key is a shared secret, so anyone holding it gets in.
You want to test a server in claude.ai today, for free. mcptunnels. Expect to re-add the connector after 24 hours.
You want claude.ai, ChatGPT and the Claude phone app on one URL that doesn’t change, with OAuth and stdio handled, and no domain. MCP Warp, with the Free plan to try it.