MCP Warp | Blog

ngrok alternative for MCP: ngrok vs Cloudflare Tunnel vs Tailscale Funnel vs MCP Warp

Sat, 10 Oct 2026 14:00:00 GMT

For MCP servers, the main ngrok alternatives are Cloudflare Tunnel with Access (free, needs a domain and an identity provider), Tailscale Funnel (no auth of its own, reported failures with claude.ai), and MCP-specific tunnels like MCP Warp or mcptunnels, which add OAuth and stdio support. ChatGPT-only users can use OpenAI’s Secure MCP Tunnel and its open-source client.

If you reached for ngrok out of habit, got a URL, and claude.ai still won’t connect or you’re uneasy about an open URL to your laptop, this page compares what else is out there. For how to add a URL to each client once you have one, see One URL for your MCP server, in every client.

What an MCP tunnel has to do that a web tunnel doesn’t

Any tunnel gives a local port a public HTTPS address. For an MCP server used from claude.ai, ChatGPT or the Claude mobile apps, three more things matter:

Auth that MCP clients understand. A public URL to an MCP server lets anyone who finds it run your tools on your machine. MCP clients discover OAuth on their own: an unauthenticated request gets a 401 with a WWW-Authenticate header pointing at Protected Resource Metadata (RFC 9728), and the client runs the sign-in. claude.ai also accepts a fixed header, which is simpler and weaker. A tunnel that only offers IP rules or a shared key leaves the OAuth part to you.
A stable URL. A custom connector stores the URL. If the tunnel hands out a new random hostname every time it starts, you re-add the connector every time.
stdio. Many MCP servers only speak stdio: the client is expected to launch them as a process. A web tunnel forwards HTTP, so a stdio server needs a bridge such as supergateway in front. Use a stdio MCP server in claude.ai and ChatGPT without deploying it covers that in detail.

Comparison table

As of 10 October 2026. Prices and limits change; check each vendor’s page before you decide.

Tunnel	OAuth for MCP clients	stdio	Stable URL	Needs your own domain	Setup steps	Price
ngrok	No. ngrok’s MCP guide shows IP rules and API-key checks	Needs a bridge	Yes, one auto-assigned dev domain on Free	No	Account, agent, Traffic Policy, bridge for stdio	Free tier; Hobbyist $10/month; custom domains from Pay-as-you-go ($20/month plus usage)
Cloudflare Tunnel plus Access	You configure Access and an identity provider	Needs a bridge	Yes, on a named tunnel	Yes, a domain on Cloudflare	Domain, cloudflared, tunnel, hostname, Access app, identity provider, bridge for stdio	Free tier (see Cloudflare’s pricing)
Tailscale Funnel	No auth of its own	Needs a bridge	Yes, `device.tailnet.ts.net`	No	Tailscale on the machine, enable Funnel, auth in your server, bridge for stdio	Not stated in the Funnel doc; available on all plans
MCP Warp	Yes, OAuth at the edge, owner only	Yes, spawns the command	Yes, named per server	No, URLs are under `tunnel.mcpwarp.io`	Install, sign in once on the web, config file, `mcpwarp login`, `mcpwarp up`	Free (100 requests/month, 1 server); $5 or $10/month

The “Needs your own domain” column means a domain you register and point at the service. “No” means the service gives you a hostname under its own domain.

MCP-specific and first-party options, covered further down. This table swaps “Needs your own domain” and “Setup steps” for “Who it serves”, because these tools differ mostly in which clients they reach:

Option	OAuth for MCP clients	stdio	Stable URL	Who it serves	Price
mcptunnels	Yes, by default (generated password on the authorize page)	Yes	No, random URL, expires after 24h	Any Streamable HTTP client	Free, no signup
OpenAI Secure MCP Tunnel	n/a, server stays private	Yes	n/a	ChatGPT, Codex, the Responses API, AgentKit	Open-source client; no cost stated
Anthropic MCP tunnels	No, OAuth on each server is yours	No, Streamable HTTP only	Yes	Claude, for Enterprise organizations	Enterprise plan only, by request
mcp-use tunnel	No, the server’s own auth applies	Not stated	No, expires after 24h	Servers built with mcp-use	Not stated; “for local testing”

ngrok

ngrok is a strong general-purpose tunnel, and it now presents itself for MCP. Its MCP guide calls ngrok an “MCP gateway” that lets you “securely expose your local development environment to AI platforms like OpenAI and Claude.” For protection, ngrok’s MCP guide shows Traffic Policy rules restricting traffic to Anthropic’s IP addresses, checking an API key in the Authorization header, and rate limiting per key.

That’s useful, and it’s not MCP OAuth. The guide doesn’t cover Protected Resource Metadata or dynamic client registration, so claude.ai won’t find a sign-in on its own. An API key does work with claude.ai if you put it in the custom connector’s “Request headers” field, which Anthropic’s help article describes as “fixed credentials such as API keys that Claude sends on every request”. That’s a shared secret living in a connector setting. An IP allowlist on its own isn’t per-user either: it admits every request from Anthropic’s range, 160.79.104.0/21 (Anthropic’s IP addresses page), whoever’s chat it came from.

ngrok forwards HTTP, so a stdio server needs a bridge in front.

On URLs and price, from ngrok’s pricing page and domains docs:

Free includes one dev domain. ngrok says “Every ngrok account comes with a free Dev Domain” whose URL “is automatically generated and cannot be changed”, and calls it “a stable, auto-assigned hostname”. So the URL stays the same across restarts; you just can’t choose it. Free also lists up to 1GB of data transfer, up to 20k HTTP/S requests, and an interstitial page on HTTP/S endpoints. We haven’t tested how MCP clients handle that interstitial.
Hobbyist is $10 a month (less with annual billing), with 10 ngrok-branded domains and no interstitial page.
Pay-as-you-go starts at $20 a month plus usage and is the first plan that lets you bring your own custom domain.

ngrok makes sense if you already use it, you’re happy with a fixed key or IP rules, and your server speaks Streamable HTTP.

Cloudflare Tunnel with Access

Cloudflare Tunnel is free and robust, and with Access in front it can do real sign-in. The cost is setup. Counting the steps:

Have a domain on Cloudflare. Cloudflare’s tunnel guide says “Before you publish an application through your tunnel, you must add a website to Cloudflare.”
Create a tunnel in the dashboard and install cloudflared on your machine.
Add a public hostname that points at the local MCP port.
Set up Zero Trust and create an Access application for that hostname.
Connect an identity provider.
Make the result something an MCP client can discover and sign in to. This is the fiddly part: this write-up on zenn shows what the DIY route takes, and mcp-ferry exists to glue the pieces together.
Add a stdio bridge if the server needs one.

Quick tunnels skip most of that. Per Cloudflare’s docs, “You do not need a Cloudflare account or domain”, but “the hostname changes each time you create a Quick Tunnel”, nothing sits in front to check who’s calling, and “Quick Tunnels do not support Server-Sent Events (SSE)”, which Streamable HTTP servers use to stream responses. Cloudflare says they “are for testing and development”. They suit a five-minute check. A connector you keep needs a hostname that doesn’t change.

If you already own a domain on Cloudflare and don’t mind an afternoon of configuration, this is a good free choice.

Tailscale Funnel

Tailscale is built for private networks between your own devices. Funnel is the part that puts a service on the public internet: tailscale funnel 3000 publishes local port 3000 at a hostname like https://amelie-workstation.pango-lin.ts.net. Per Tailscale’s docs, Funnel “is available for all plans”, “is currently in beta”, “can only listen on ports 443, 8443, and 10000”, and traffic over it “is subject to non-configurable bandwidth limits”.

Funnel adds no auth for public traffic: it shares a service “for anyone to access”. Whatever protects your MCP server has to be in the server or a proxy in front of it. And there are reports of Funnel URLs failing with claude.ai. anthropics/claude-ai-mcp #953 describes a Funnel-hosted server “being fully reachable and functional from outside” that still gets “Couldn’t reach the MCP server”, and #864 reports “Authorization with the MCP server failed” through Funnel. The checklist for “Couldn’t reach the MCP server” has the details.

claude.ai can’t join your tailnet, so plain tailnet addresses never work for web clients. Tailscale works well for Claude Code or VS Code on your own devices: they run locally, so a tailnet address to a server on another of your machines works without Funnel.

MCP Warp

MCP Warp is the tunnel we build, so weigh this section accordingly. It was made for the three requirements above: each server gets its own named URL, https://<name>-<username>.tunnel.mcpwarp.io/mcp, with OAuth at the edge, and it can spawn stdio servers itself or proxy to a local Streamable HTTP server.

Every request needs an OAuth token, and the edge checks that the token belongs to the server’s owner; a valid token from another account gets a 403. That also means a URL works for your account only, so it isn’t a way to share a server with other people. See Security.

The first run: install the CLI, sign in once at web.mcpwarp.io to pick a username, then add the server to ~/.mcpwarp/config.json:

{
  "servers": [
    {
      "name": "blender",
      "kind": "stdio",
      "command": "uvx",
      "args": ["blender-mcp"],
      "env": { "BLENDER_PATH": "/Applications/Blender.app" }
    }
  ]
}

mcpwarp login
mcpwarp up

NAME     KIND   URL
blender  stdio  https://blender-anatoly.tunnel.mcpwarp.io/mcp

After that it’s mcpwarp up each time. The URL stays the same as long as the server’s name doesn’t change. Get started has the full walkthrough, and Expose a stdio server covers the stdio bridge and its limits.

The trade-offs: mcpwarp up must be running, or the URL returns 503. The Free plan is 100 requests a month and 1 server, and every HTTP request a client makes counts, so Free is for trying it out. Plus is $5 a month with unlimited requests and 1 server; Pro is $10 a month with unlimited requests and servers (Limits and quotas). MCP Warp is small and new.

MCP Warp isn’t certified by Anthropic or OpenAI; it’s built to work with Claude and ChatGPT as a standard Streamable HTTP MCP client.

Other options worth knowing

mcptunnels is the closest free equivalent. One command bridges a stdio server and gives it a public URL:

mcptunnel expose -- npx -y @modelcontextprotocol/server-everything

Its README says tunnels are “anonymous, OAuth-protected by default, and expire after 24 hours.” The CLI prints the URL and a generated password, and you enter the password on the authorize page during the client’s OAuth flow. The URL has a random segment, so when the tunnel expires you get a new one and re-add the connector. That 24-hour limit is the real catch; the tool itself does the job. You can also run its relay yourself.

OpenAI Secure MCP Tunnel connects “private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit” while keeping the server off the public internet, and it can spawn stdio servers. It’s first-party, and the client is open source. If ChatGPT is the only client you use, it’s probably the better pick. It does nothing for claude.ai. OpenAI’s announcement has the setup.

mcp-use tunnels come with the mcp-use framework (mcp-use dev --tunnel). URLs look like https://<adjective>-<color>.tunnel.mcp-use.run/mcp, “Connected tunnels expire after 24 hours”, each IP can have up to 5 active tunnels, and the docs say they “are for local testing before deployment”.

Anthropic’s MCP tunnels are first-party but not free for most people: they are “available to organizations on the Claude Enterprise plan by request”, run inside your network on Kubernetes or Docker Compose with cloudflared, and carry Streamable HTTP only (Anthropic docs).

Which one to pick

You only use ChatGPT. OpenAI’s Secure MCP Tunnel. Open-source client, stdio included, nothing public.
You’re on Claude Enterprise. Ask your admin about Anthropic’s MCP tunnels before anything else.
You own a domain on Cloudflare and like configuring things. Cloudflare Tunnel with Access. Free, solid, a few hours of setup.
You only use clients on your own devices (Claude Code, VS Code). Tailscale without Funnel, or plain localhost on the same machine. No public URL needed.
You already pay for ngrok and your server speaks HTTP. ngrok with an API key in a request header and IP rules. The key is a shared secret, so anyone holding it gets in.
You want to test a server in claude.ai today, for free. mcptunnels. Expect to re-add the connector after 24 hours.
You want claude.ai, ChatGPT and the Claude phone app on one URL that doesn’t change, with OAuth and stdio handled, and no domain. MCP Warp, with the Free plan to try it.

Use a stdio MCP server in claude.ai and ChatGPT without deploying it

Sat, 10 Oct 2026 12:00:00 GMT

To use a stdio MCP server from claude.ai or ChatGPT, you need three things: a bridge that turns stdio into Streamable HTTP (supergateway or mcp-proxy), a public HTTPS URL (a tunnel), and auth in front of it, ideally OAuth. Some tools do all three at once: MCP Warp and mcptunnels spawn the command and give it an OAuth-protected URL.

If your server already speaks Streamable HTTP, skip to One URL for your MCP server, in every client, which covers getting a URL and adding it to each client, or see Expose an HTTP server for the MCP Warp config.

Why web clients can’t use stdio

A stdio server is a program the client starts. In Claude Desktop’s JSON config you write "command": "uvx", "args": ["some-server"], and Claude Desktop launches that as a child process, writes JSON-RPC messages to its stdin and reads replies from its stdout. That only works when the client and the server are on the same machine.

claude.ai and ChatGPT run in someone else’s data centre. When you add a custom connector, Anthropic’s help article says “Claude connects to your remote MCP server from Anthropic’s cloud infrastructure, rather than from your local device.” Those servers can’t start a process on your laptop, and they can’t reach localhost on it either. They need a URL.

stdio, Streamable HTTP and SSE in two minutes

MCP defines how messages travel between client and server. There are three transports you’ll run into:

Transport	How it works	Status
stdio	The client spawns the server and exchanges newline-delimited JSON-RPC over stdin and stdout.	Current. Local clients only.
Streamable HTTP	The server listens at one HTTP endpoint, usually `/mcp`. Clients `POST` messages there, and the server can answer with JSON or stream the response.	Current. What remote clients use.
HTTP+SSE (2024-11-05)	A `GET /sse` stream for server messages plus `POST /messages` for client messages.	Legacy, replaced by Streamable HTTP.

Which clients take which:

Client	stdio	Streamable HTTP URL
claude.ai, ChatGPT	No	Yes, as a custom connector
Claude mobile apps	No	Yes, connectors added on the web sync to the phone
Claude Desktop	Yes, in `claude_desktop_config.json`	Yes, as a custom connector (public URL only)
Claude Code	Yes	Yes, `claude mcp add --transport http`
VS Code	Yes	Yes, `"type": "http"` in `mcp.json`

So the job is to turn a stdio program into a Streamable HTTP endpoint that the web clients can reach.

The three jobs

Getting a stdio server into claude.ai takes three separate pieces of work:

claude.ai / ChatGPT          in Anthropic's or OpenAI's cloud
   │  HTTPS + auth            job 3: auth (OAuth, or a fixed header)
   ▼
Public URL                   job 2: a tunnel or a host
   │
   ▼
Bridge on your machine       job 1: Streamable HTTP in, stdio out
   │  stdin / stdout
   ▼
Your stdio server            uvx ..., npx ...

Bridge. Something listens on HTTP and turns each request into stdio messages for the child process.
Public URL. A tunnel (or a host) gives that local HTTP endpoint an address the internet can reach.
Auth. Once the URL is public, anyone who finds it can call your tools, on your machine, with your permissions. Something has to decide who gets through.

mcp-remote often comes up in these searches, and it goes the other way. It lets a stdio-only client reach a server that already has a URL. It doesn’t help a web client reach your stdio server.

How MCP Warp works shows the same path for one specific tunnel.

Option A: bridge plus tunnel plus auth

This is the free, do-it-yourself route, with one tool per job.

The bridge. Two popular choices are supergateway and the TypeScript mcp-proxy. Both are widely used: between 9 September and 8 October 2026, supergateway had about 596,000 npm downloads and mcp-proxy about 3.2 million (npm API). With supergateway:

npx -y supergateway \
    --stdio "npx -y @modelcontextprotocol/server-filesystem ./my-folder" \
    --outputTransport streamableHttp \
    --port 8000

That serves the filesystem server at http://localhost:8000/mcp. supergateway also has --apiKey, which makes clients present a key as a bearer token or X-API-Key header. mcp-proxy’s usage is npx mcp-proxy [options] -- <command>, and its --apiKey option, “Optional and off by default”, makes clients send a valid key in the X-API-Key header.

The tunnel. Point any tunnel at the bridge’s port. Each has trade-offs for MCP:

A Cloudflare quick tunnel (trycloudflare.com) needs no account, but Cloudflare’s docs say the hostname changes each time and “Quick Tunnels do not support Server-Sent Events (SSE)”, which Streamable HTTP servers use to stream responses. Cloudflare calls them “for testing and development”.
A named Cloudflare Tunnel gives a stable hostname but needs a domain added to Cloudflare.
ngrok’s free plan gives each account one auto-assigned dev domain that doesn’t change.

mcp-proxy also has a --tunnel flag that prints a public URL such as https://abcdefghij.tunnel.gla.ma. Its README says the tunnel is “Powered by pipenet, sponsored by glama.ai”, and that a requested subdomain “may not be available”. It’s handy for a quick test, but the subdomain isn’t guaranteed.

The auth. This is the job people skip. The simplest working setup is a fixed key: run supergateway with --apiKey, and in claude.ai’s custom connector dialog put the key in the “Request headers” field, which Anthropic’s help article describes as “fixed credentials such as API keys that Claude sends on every request”. The key then lives in a connector setting as a shared secret. For OAuth, which ties each call to an account and is what MCP clients discover on their own, you need an authorization server and Protected Resource Metadata in front of the bridge, or Cloudflare Access with an identity provider. This write-up on zenn shows what that takes, and mcp-ferry exists to glue the Cloudflare pieces together.

It all works and costs nothing. It’s three tools to install, configure and keep running.

Option B: one tool for all three

MCP Warp, the tunnel we build, does the three jobs in one process: it spawns your command, bridges it to Streamable HTTP locally, and gives it a public URL with OAuth at the edge. The bridges above are good at bridging; the case for this route is fewer moving parts.

After installing the CLI and signing in once at web.mcpwarp.io to pick a username (see Get started), add the server to ~/.mcpwarp/config.json with the same command you’d give Claude Desktop:

{
  "servers": [
    {
      "name": "blender",
      "kind": "stdio",
      "command": "uvx",
      "args": ["blender-mcp"],
      "env": { "BLENDER_PATH": "/Applications/Blender.app" }
    }
  ]
}

command is resolved on PATH and run directly, not through a shell. env values are used literally, with no ${VAR} expansion. There’s also an optional cwd. The Config reference has every field.

Validate the config, log in and start the tunnel:

mcpwarp status
mcpwarp login
mcpwarp up

NAME     KIND   URL
blender  stdio  https://blender-anatoly.tunnel.mcpwarp.io/mcp

Paste that URL into claude.ai or ChatGPT as a custom connector and complete the OAuth sign-in. Only your account can use it: the edge checks that each token belongs to the server’s owner.

MCP Warp isn’t certified by Anthropic or OpenAI; it’s built to work with Claude and ChatGPT as a standard Streamable HTTP MCP client.

How the bridge works

From Expose a stdio server: each stdio server gets a small local HTTP endpoint that turns Streamable HTTP requests into newline-delimited JSON-RPC on the child’s stdin and stdout. It classifies messages by shape, so it supports both session-based MCP and the stateless 2026-07-28 generation of the protocol.

In the full-screen view, r restarts the selected stdio server and l opens its log pane. mcpwarp up --verbose gives more detail. See the CLI reference.

Limits

No SSE resumability. There’s no Last-Event-ID or replay, so if a stream drops, the client has to re-issue the request.
Windows. .cmd and .bat shims aren’t launched directly; point command at node and pass the underlying .js file in args. Process cleanup on Windows is best-effort and only kills the direct child.
Restart cap. If the child crashes 10 times in a row without a 60-second healthy run, mcpwarp stops restarting it and requests get a 502 with “local server ‘<name>’ is not running”.
Your machine has to be on. If mcpwarp up isn’t connected, the URL returns 503.
Free plan. 100 requests a month and 1 server, and every HTTP request a client makes counts. See Limits and quotas.

Option C: OpenAI’s tunnel, for ChatGPT only

If ChatGPT is the only client you care about, OpenAI’s Secure MCP Tunnel handles stdio. Its open-source client, openai/tunnel-client, connects “private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit”. It can spawn a stdio server itself, with one rule from the README: “run only one active tunnel-client instance per tunnel ID when using --mcp.command”. OpenAI’s announcement has the setup. It doesn’t serve claude.ai or other clients.

Anthropic has a first-party option too, with narrower reach. Its MCP tunnels are for organizations on the Claude Enterprise plan, by request, and they carry Streamable HTTP only, so a stdio server would still need a bridge in front.

Option D: mcptunnels, free with a 24-hour URL

mcptunnels does all three jobs in one command, with no signup:

mcptunnel expose -- npx -y @modelcontextprotocol/server-everything

Its README says tunnels are “anonymous, OAuth-protected by default, and expire after 24 hours.” The CLI prints the public URL and a generated password; when a client runs the OAuth flow, you enter that password on the authorize page. The URL contains a random segment, so after 24 hours (or when you press Ctrl-C) you get a new URL and have to re-add the connector. For an afternoon of testing that’s fine. For a connector you use every day, it’s a chore. You can also run its relay yourself.

Which servers this suits

Tunnelling a stdio server makes sense when the server needs your machine:

Local files. A filesystem server, a notes vault, a folder of PDFs.
Desktop apps. blender-mcp drives Blender, which has to be running on your machine.
Local data. A database or service on your laptop or home network that you don’t want on the internet.

If a server only calls a cloud API with a key, hosting it somewhere is usually simpler. It stays up when your laptop sleeps, and you don’t depend on a tunnel.

Whichever route you take, remember the server runs with your permissions. Auth decides who can call it; it doesn’t limit what it does once called. Scope it before you expose it. The filesystem server, for example, only touches the directories you pass on its command line, so give it one folder:

{
  "servers": [
    {
      "name": "files",
      "kind": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/you/Documents/shared"]
    }
  ]
}

For a side-by-side look at tunnels for MCP, including ngrok, Cloudflare Tunnel and Tailscale Funnel, see ngrok alternative for MCP. If claude.ai still won’t connect, Why claude.ai can’t connect to your local MCP server covers what the URL needs.

Use your laptop's MCP servers from the Claude app on your phone

Sat, 10 Oct 2026 10:00:00 GMT

The Claude mobile app can’t run local MCP servers. It uses connectors you add on claude.ai or in Claude Desktop, which then show up on iOS and Android. To use a server on your laptop, give it a public HTTPS URL with OAuth through a tunnel, add that URL on claude.ai, and keep the laptop running.

That last part matters most. Your phone doesn’t talk to your laptop. Anthropic’s servers do, so the laptop has to be awake, online and running the tunnel whenever you want to use the server from your phone.

For the steps in every other client (claude.ai, Claude Desktop, Claude Code, ChatGPT, VS Code), see One URL for your MCP server, in every client.

The short answer

There is no setting in the Claude app for a server on your Mac or PC, and there can’t be one in the way Claude Desktop has it. Claude Desktop launches stdio servers as local processes from its JSON config. A phone app can’t do that for a program on another machine. As a dev.to guide to remote MCP on the Claude mobile apps puts it, “mobile apps cannot run local scripts, so only remote MCP is available.”

So the route is: the server gets a public URL, you add that URL as a custom connector on the web or desktop, and the phone picks it up.

How connectors reach the mobile app

Anthropic’s help article Use connectors to extend Claude’s capabilities describes the sync:

Once you connect to a service on Claude or Claude Desktop, it will be available to use the next time you log in to your account on Claude for iOS or Android.

The same article says installing connectors on mobile is in beta, and that Claude Desktop and the web “remain the primary path for custom connectors”. Add the connector on claude.ai in a browser or in Claude Desktop, then open the app on your phone.

Custom connectors are available “for users on Free, Pro, Max, Team, and Enterprise plans”, and “Free users are limited to one custom connector” (Anthropic help).

Why your laptop’s server doesn’t show up

When Claude uses a custom connector, the request leaves Anthropic’s cloud, not your browser or your phone. Anthropic’s custom connectors article says “Claude connects to your remote MCP server from Anthropic’s cloud infrastructure, rather than from your local device.” To those servers, localhost is their own machine and your laptop has no address they can reach. Paste a localhost URL into Claude Desktop and the log says “Localhost URLs cannot be used because our servers cannot reach your local machine.” Why claude.ai can’t connect to your local MCP server covers the mechanism in detail.

This is also why the usual phone-to-laptop setups don’t help here. Tailscale on your phone, an SSH app like Termius, or a VPN home all give your phone a route to the laptop. The Claude app isn’t the one making the request, so none of that reaches Anthropic’s servers. The URL has to be on the public internet.

Give the server a public URL

Any tunnel that produces a public HTTPS URL works. Your free options:

Cloudflare Tunnel with Access. Free and solid, if you own a domain on Cloudflare and are willing to set up Access and an identity provider. A stdio server also needs a bridge such as supergateway. This write-up on zenn shows what the DIY route takes.
mcptunnels. No signup, bridges stdio, and OAuth-protected by default. The URL is random and the tunnel expires after 24 hours, so you re-add the connector every day you use it.

Anthropic also runs its own MCP tunnels, but they are “available to organizations on the Claude Enterprise plan by request”.

The steps below use MCP Warp, the tunnel we build. It gives each server a named URL that stays the same, with OAuth in front of it, and it can spawn stdio servers itself.

Install the CLI (Homebrew shown; Scoop and Linux packages are in Get started):

brew tap mcpwarp/tap
brew trust --tap mcpwarp/tap
brew install --cask mcpwarp

Sign in once at web.mcpwarp.io to create your account and pick a username. Skip this and mcpwarp up fails with USERNAME_REQUIRED.

Add the server to ~/.mcpwarp/config.json. Most desktop servers are stdio commands, so use "kind": "stdio" and the same command and arguments you’d put in Claude Desktop’s config:

{
  "servers": [
    {
      "name": "blender",
      "kind": "stdio",
      "command": "uvx",
      "args": ["blender-mcp"],
      "env": { "BLENDER_PATH": "/Applications/Blender.app" }
    }
  ]
}

Expose a stdio server explains each field.

mcpwarp login
mcpwarp up

NAME     KIND   URL
blender  stdio  https://blender-anatoly.tunnel.mcpwarp.io/mcp

On claude.ai, add a custom connector, paste the URL and complete the OAuth sign-in. Connect Claude shows each screen.
Open the Claude app on your phone. The connector is there the next time you log in.

After the first run, it’s mcpwarp up each time (plus mcpwarp login when the session expires). The URL stays the same as long as the server’s name doesn’t change, so the connector keeps working.

MCP Warp isn’t certified by Anthropic; it’s built to work with Claude as a standard Streamable HTTP MCP client.

What has to stay on

Whichever tunnel you use, the server only exists while your laptop is awake, online and running it. With MCP Warp, if mcpwarp up isn’t connected, the connector gets a 503 (Troubleshooting lists the other codes). Two ways to live with that:

Keep the laptop awake. Plug it in and stop it sleeping while you’re away. On macOS, caffeinate -i mcpwarp up keeps the machine from idle sleep for as long as the tunnel runs. Closing the lid usually still puts a laptop to sleep.
Use an always-on machine. A desktop, a home server or a small Linux box can run the tunnel without a terminal. Mint a personal access token in the dashboard and run headless:
```
export MCPWARP_TOKEN=mcpwarp_pat_...
mcpwarp up --no-tui
```
The headless section of Get started has the details. MCP Warp doesn’t ship a launchd or systemd recipe yet, so wiring it into a service manager is up to you. The server still has to be on that machine, so this suits servers that work on files or apps you keep there.

If the laptop wakes from sleep before the network is back, mcpwarp up keeps retrying the session refresh and reconnects on its own.

Good first servers to try

The servers worth reaching from a phone are the ones that need something only your computer has:

Your notes vault. An Obsidian or Markdown notes server lets you search and add to notes from the phone. Check the server’s README for which folder it reads.
A filesystem server, scoped down. The reference filesystem server only touches the directories you pass on its command line, for example npx -y @modelcontextprotocol/server-filesystem /Users/you/Documents/phone. Give it one folder, not your home directory.
Notes or reminders apps on a Mac. Servers that talk to Apple’s apps run on the Mac itself, which makes them a natural fit. Read their READMEs for the permissions they ask for.
Blender. The blender-mcp server used in the example above drives Blender on your machine. Blender has to be open for it to do anything.

Is this safe?

A public URL to a server that can read your notes is worth thinking about. Unauthenticated MCP servers on the internet are common: in July 2025, Trend Micro found 492 MCP servers on the public internet with no client authentication or traffic encryption. A plain tunnel with no auth in front of your vault would add one more.

With MCP Warp, every request needs an OAuth token, and the edge checks that the token belongs to the server’s owner. A valid token from another account gets a 403. The URL is an identifier, not a secret, so it doesn’t matter if someone sees it. See Security.

OAuth decides who can call the server. It doesn’t limit what the server can do once called. The server runs on your laptop with your permissions, so scope it (one folder, read-only where the server supports it) before you put it on your phone.

FAQ

Does this work on Claude Free?

Custom connectors are available on Free, limited to one, per Anthropic’s help article. On the MCP Warp side, the Free plan is 100 requests a month and 1 server, and every HTTP request a client makes counts. A chat with a few tool calls makes several, so Free is for trying it out. See Limits and quotas.

We haven’t confirmed whether the phone ever asks you to sign in to the server again after you authorized it on the web. If it does, sign in with the MCP Warp account that runs mcpwarp up.

Does the ChatGPT mobile app work the same way?

ChatGPT also calls connectors from OpenAI’s servers, so the server needs a public URL there too. We haven’t tested how ChatGPT’s mobile apps handle custom connectors. If ChatGPT is your only client, OpenAI’s Secure MCP Tunnel, through its open-source client openai/tunnel-client, connects private servers to “ChatGPT, Codex, the Responses API, and AgentKit” and can spawn stdio servers. It doesn’t serve Claude.

Do I need to keep the terminal open?

You need mcpwarp up running. In a terminal, that means leaving it open. On an always-on machine, run it headless with a token and --no-tui as shown above.

Introducing MCP Warp: ngrok for MCP servers

Sat, 10 Oct 2026 08:00:00 GMT

MCP Warp gives the MCP servers on your machine a public HTTPS URL with OAuth in front of it, so claude.ai, ChatGPT and the Claude mobile apps can use them while the server keeps running locally.

If you’ve used AnkiMCP, MCP Warp is from the same person. I built it because I kept needing a simple way to give a local MCP server a public URL.

The problem

You have an MCP server running on your laptop. Claude Desktop and Claude Code can use it, because they run on the same machine. claude.ai can’t. When you add a custom connector, the request comes from Anthropic’s servers, not your browser, and to them localhost is their own machine. ChatGPT works the same way, and so does a connector you use from the Claude app on your phone. Why claude.ai can’t connect to your local MCP server explains this in detail.

So the server needs a public HTTPS URL. And once a URL points at your machine, something has to decide who may call it, or anyone who finds the link can run your tools with your permissions.

What MCP Warp does

You run mcpwarp up on your machine. It opens an outbound connection to the MCP Warp edge and registers the servers in your config. Each one gets its own public URL:

https://<name>-<username>.tunnel.mcpwarp.io/mcp

OAuth on every request. There is no anonymous access. An unauthenticated request gets a 401 that MCP clients use to start the sign-in by themselves, and the edge only lets through tokens that belong to the server’s owner. A valid token from another account gets a 403. See Security.
stdio or HTTP. If your server speaks Streamable HTTP on localhost, mcpwarp proxies to it. If it only speaks stdio, the kind you start with uvx or npx, mcpwarp spawns it and bridges it to HTTP.
One subdomain per server. Clients such as VS Code and Claude Desktop cache OAuth credentials per origin, so two servers on one shared host could overwrite each other’s tokens. Separate subdomains avoid that.
Streaming the whole way. Long-running tool calls and large responses work as they do locally.
Nothing inbound. The connection is outbound from your machine, so there is no port to open, no domain to buy and no certificate to manage.

How MCP Warp works traces a request end to end.

Setting it up

The first run takes a few steps. After that it’s mcpwarp up.

Install the CLI. With Homebrew on macOS or Linux:

brew tap mcpwarp/tap
brew trust --tap mcpwarp/tap
brew install --cask mcpwarp

Scoop and Linux packages are in Get started.

Sign in once at web.mcpwarp.io to create your account and pick a username. The username goes into your URLs, and mcpwarp up fails with USERNAME_REQUIRED until you have one. Then log the CLI in to the same account:

mcpwarp login

Add your server to ~/.mcpwarp/config.json. For a server already running on port 8765:

{
  "servers": [
    { "name": "notes", "kind": "http", "url": "http://127.0.0.1:8765/mcp" }
  ]
}

For a stdio server, use "kind": "stdio" with command and args instead. Expose a stdio server has the full shape.

Start the tunnel:

mcpwarp up

NAME     KIND   URL
notes    http   https://notes-anatoly.tunnel.mcpwarp.io/mcp

Paste the URL into claude.ai or ChatGPT as a custom connector and complete the sign-in when it asks. A connector you add on claude.ai also shows up in the Claude mobile apps. The URL stays the same every time you run mcpwarp up, as long as the server name doesn’t change, so you add the connector once.

mcpwarp up runs in the foreground. Stop it, or let the laptop sleep, and the URL returns 503 until it reconnects.

Where it fits

ngrok and Cloudflare Tunnel will give you a public URL too, but OAuth and the stdio bridge are yours to set up, and Cloudflare Tunnel also needs a domain on Cloudflare. OpenAI’s Secure MCP Tunnel has an open-source client and handles stdio, but it only serves OpenAI products such as ChatGPT and Codex. Anthropic’s own MCP tunnels are for organizations on the Claude Enterprise plan, by request. MCP Warp is for the person in between: one named URL with OAuth already in front of it, usable from Claude and ChatGPT.

MCP Warp isn’t certified by Anthropic or OpenAI; it’s built to work with Claude and ChatGPT as a standard Streamable HTTP MCP client.

Plans

Free is 100 requests a month and 1 server. Every HTTP request a client makes to your URL counts, and one chat with a few tool calls makes several, so Free is for trying it out. Plus is $5 a month with unlimited requests and 1 server. Pro is $10 a month with unlimited requests and servers. Details are on Pricing and in Limits and quotas.

Next steps

Get started walks through the install and first tunnel.
One URL for your MCP server, in every client shows how to add the URL to claude.ai, Claude Desktop, Claude Code, ChatGPT and VS Code.
If Claude says “Couldn’t reach the MCP server”, work through the checklist.

One URL for your MCP server, in every client: claude.ai, Claude Desktop, Claude Code, ChatGPT and VS Code

Fri, 09 Oct 2026 00:00:00 GMT

A remote MCP server URL is a public HTTPS address, usually ending in /mcp, that speaks Streamable HTTP. Add it as a custom connector in claude.ai or ChatGPT, with claude mcp add --transport http in Claude Code, or as an http server in VS Code’s mcp.json. The client then runs an OAuth sign-in.

This page is the reference the other guides on this blog point to. It covers what the URL is, how to get one for a server on your own machine, and the exact steps for each client.

What an MCP server URL is

An MCP server can talk to a client in two ways. Over stdio, the client launches the server as a child process and they exchange messages on stdin and stdout. Over Streamable HTTP, the server listens at an HTTP endpoint and any client that can reach it sends requests there. The endpoint path is usually /mcp, so a URL looks like this:

https://notes-anatoly.tunnel.mcpwarp.io/mcp

The URL is what you paste into a client. If the client runs on your machine (Claude Code, VS Code), http://localhost:8765/mcp can work. If the client runs in someone else’s data centre (claude.ai, ChatGPT), the request comes from their servers, which can’t reach your laptop, so the URL has to be public HTTPS. Why claude.ai can’t connect to your local MCP server explains that in detail, and What is MCP covers the protocol itself. A server that only speaks stdio needs a bridge to HTTP first; Use a stdio MCP server in claude.ai and ChatGPT without deploying it covers the options.

A lot of people still wire remote servers into Claude Desktop through JSON config and mcp-remote, which had about 5.0 million npm downloads between 9 September and 8 October 2026 (npm API). mcp-remote goes the other direction from a tunnel: it lets a stdio-only client reach a server that already has a URL. Every client below can take the URL directly.

Get a URL for a server on your machine

The rest of this page works with any public Streamable HTTP URL: your own reverse proxy, Cloudflare Tunnel with Access, ngrok with an auth layer, or mcptunnels (free, but the URL expires after 24 hours). ngrok alternative for MCP compares the tunnels. The examples use MCP Warp, the tunnel we build.

The first run, once:

Install the CLI (Homebrew shown; Scoop and Linux packages are in Get started):

brew tap mcpwarp/tap
brew trust --tap mcpwarp/tap
brew install --cask mcpwarp

Add the server to ~/.mcpwarp/config.json. An HTTP server you already run:

{
  "servers": [
    { "name": "notes", "kind": "http", "url": "http://127.0.0.1:8765/mcp" }
  ]
}

Or a stdio server that mcpwarp should spawn itself:

{
  "servers": [
    {
      "name": "blender",
      "kind": "stdio",
      "command": "uvx",
      "args": ["blender-mcp"],
      "env": { "BLENDER_PATH": "/Applications/Blender.app" }
    }
  ]
}

Check the config, log in and start the tunnel:

mcpwarp status
mcpwarp login
mcpwarp up

NAME     KIND   URL
notes    http   https://notes-anatoly.tunnel.mcpwarp.io/mcp

After that, every session is mcpwarp login (when your session expires) and mcpwarp up. In the full-screen view, c copies the selected row’s URL.

Each server gets its own subdomain, <name>-<username>.tunnel.mcpwarp.io, instead of a path under one shared host. Clients such as VS Code and Claude Desktop cache OAuth credentials per origin, so two servers on one host could clobber each other’s tokens. Why one subdomain per server has the detail.

Two things to keep in mind. mcpwarp up has to be running on your machine, or the URL returns 503. And the Free plan covers 100 requests a month and 1 server; every HTTP request a client makes counts. See Limits and quotas.

Add it to each client

claude.ai and Claude Desktop

Both use custom connectors, and Anthropic documents the same steps for each.

In claude.ai, go to Customize > Connectors (Pro/Max), click “+ Add”, then “Add custom connector”. The steps are in Anthropic’s help article on custom connectors.
Give it a name and paste the URL.
Click Connect and complete the OAuth sign-in when prompted.

Custom connectors are available “for users on Free, Pro, Max, Team, and Enterprise plans”, and “Free users are limited to one custom connector” (Anthropic help).

The connector also reaches your phone. Per Anthropic, “Once you connect to a service on Claude or Claude Desktop, it will be available to use the next time you log in to your account on Claude for iOS or Android” (Use connectors to extend Claude’s capabilities). Installing connectors on mobile itself is still in beta, so add it on the web or desktop first. Use your laptop’s MCP servers from the Claude app on your phone covers what has to stay running.

Anthropic also runs its own MCP tunnels, but they are for organizations on the Enterprise plan, by request.

MCP Warp steps for Claude are in Connect Claude. MCP Warp isn’t certified by Anthropic; it’s built to work with Claude as a standard Streamable HTTP MCP client.

Claude Code

Claude Code runs on your machine and adds servers from the command line:

claude mcp add --transport http notes https://notes-anatoly.tunnel.mcpwarp.io/mcp

Then authenticate: run /mcp inside a Claude Code session and pick the server, or run claude mcp login notes from your shell. The general form is claude mcp add --transport http <name> <url>; the Claude Code MCP docs list the other options.

If Claude Code is your only client, you can point it at http://localhost:8765/mcp and skip the tunnel. The case for a public URL is that the same address then works in claude.ai, on your phone and in ChatGPT.

ChatGPT

Add a custom connector in ChatGPT’s settings and paste the URL, then complete the OAuth sign-in. Menu names move around as ChatGPT changes; look for “connectors”, “custom connectors”, “apps” or “MCP servers” in settings. Connect ChatGPT has the MCP Warp side.

Check your plan before you start. Custom connectors on ChatGPT Plus and Pro are reported to be limited to read and fetch actions, with full MCP (write actions) on Business, Enterprise and Edu. We couldn’t load OpenAI’s help article on developer mode to confirm this, so read it for your plan.

If ChatGPT is your only client, OpenAI’s Secure MCP Tunnel may be the simpler route. Its open-source client, openai/tunnel-client, connects “private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit” and can spawn stdio servers. It doesn’t serve claude.ai or other clients. OpenAI’s announcement has the setup.

MCP Warp isn’t certified by OpenAI; it’s built to work with ChatGPT as a standard Streamable HTTP MCP client.

VS Code

Add the server to .vscode/mcp.json with "type": "http":

{
  "servers": {
    "notes": {
      "type": "http",
      "url": "https://notes-anatoly.tunnel.mcpwarp.io/mcp"
    }
  }
}

VS Code runs the OAuth sign-in when it first connects. Like Claude Code, it runs locally, so a localhost URL also works if you don’t need the server anywhere else. Connect other clients has the same snippet.

Anything else

Any client that speaks Streamable HTTP can use the URL: add a remote server pointing at it and complete the OAuth sign-in when the client asks. The legacy 2024-11-05 HTTP+SSE transport (a GET /sse endpoint plus POST /messages) is not supported by MCP Warp, so a client that only knows SSE won’t connect.

Comparison table

As of 9 October 2026. Cells marked “unverified” are ones we haven’t confirmed against the vendor’s documentation.

Client	Where to add it	Runs OAuth	Accepts localhost	Plan requirements
claude.ai	Customize > Connectors > Add custom connector	Yes	No	Free (1 custom connector), Pro, Max, Team, Enterprise
Claude Desktop	Connectors settings, same steps as claude.ai	Yes	No, for custom connectors	Same as claude.ai
Claude mobile apps	Add on web or desktop; it syncs	Uses the web grant (unverified)	No	Same as claude.ai
Claude Code	`claude mcp add --transport http`	Yes, via `/mcp` or `claude mcp login`	Yes	Unverified
ChatGPT	Settings, connectors or apps	Yes	No	Plus/Pro reported read-only (unverified)
VS Code	`.vscode/mcp.json`, `"type": "http"`	Yes	Yes	Unverified

The URL is tied to your MCP Warp account. Every request needs an OAuth token that belongs to the server’s owner, so other people can’t use your server through it even if they have the link. See Security.

When it doesn’t connect

Start with the status code at the URL. With MCP Warp, 503 means mcpwarp up isn’t connected, 404 means a wrong URL or a server disabled in the dashboard, and 429 means the month’s quota is used up. Troubleshooting lists every message.

If claude.ai says “Couldn’t reach the MCP server”, work through the checklist for that error. It applies to any server and any tunnel.

More guides

"Couldn't reach the MCP server" in Claude: a checklist

Thu, 08 Oct 2026 00:00:00 GMT

“Couldn’t reach the MCP server” means Claude’s servers couldn’t complete a connection to your URL. Check in order: the URL is public HTTPS (localhost won’t work); a request reaches your server; the endpoint speaks Streamable HTTP; if you use OAuth, an unauthenticated request returns 401 with discovery metadata; nothing blocks Anthropic’s IP range, 160.79.104.0/21.

This checklist works with any server and any tunnel. Each item has a test you can run yourself. For the client-by-client setup steps, see One URL for your MCP server, in every client.

What the error means

The full message in claude.ai and Claude Desktop reads like this (from anthropics/claude-ai-mcp #227):

Couldn’t reach the MCP server. You can check the server URL and verify the server is running. If this persists, share this reference with support: ofid_c58995a431270861

When you click Connect, Anthropic’s servers make the request. Anthropic’s help article on custom connectors says “Claude connects to your remote MCP server from Anthropic’s cloud infrastructure, rather than from your local device.” So curl working from your laptop proves less than it seems.

The message is a catch-all. DNS, TLS, firewalls, the wrong transport and a broken OAuth discovery step can all end up here. Keep the ofid_ reference from each attempt; you’ll want it if you report the problem.

Some failures are on Anthropic’s side. Several reports in the issue tracker show fully working servers that never receive a request. A different tunnel won’t fix those, and it’s worth knowing before you spend an evening rewriting your auth.

First, did any request arrive?

This one test splits the list in half. Open your server logs, or your reverse proxy or tunnel logs, and click Connect in Claude. Then look for any request to your hostname in that minute:

GET or POST to /mcp
GET /.well-known/oauth-protected-resource (or /.well-known/oauth-protected-resource/mcp)
GET /.well-known/oauth-authorization-server

If nothing arrived, the problem is between Anthropic and your server, or inside Anthropic. If something arrived, the problem is in what your server answered.

The reporter on #227 saw the worst case: “zero inbound requests from Anthropic on every Connect click”, even though the same server worked end to end in Cursor and Postman. That issue was closed as “not planned”.

If nothing arrived

The URL is localhost, a LAN address or plain http

localhost, 127.0.0.1, 192.168.x.x, 10.x.x.x and tailnet-only names point at nothing Anthropic’s servers can reach. For localhost, Claude Desktop refuses the URL up front: the dialog says “Failed to add connector”, and the log files give the reason (#9):

Localhost URLs cannot be used because our servers cannot reach your local machine. Provide a publicly accessible MCP server URL.

It rejects http:// URLs too. Why claude.ai can’t connect to your local MCP server explains the mechanism and the ways around it.

Test from a network that isn’t yours, for example a phone hotspot or a cheap VPS:

curl -sv -o /dev/null https://mcp.example.com/mcp

Look for a resolved public address and a completed TLS handshake.

Tailscale Funnel

Tailscale Funnel does put a service on the public internet, so it can work in principle. In practice there are open reports of it failing with claude.ai. #953 is titled “Custom MCP connector consistently fails with “Couldn’t reach the MCP server”” and describes a Funnel-hosted server “being fully reachable and functional from outside”. #864 reports “Authorization with the MCP server failed” through Funnel, after the setup had worked the day before.

Two things to keep in mind. claude.ai can’t join your tailnet, so only Funnel (public) URLs are candidates, never plain tailnet addresses. And Funnel adds no auth of its own; whatever protects the server has to be in the server or a proxy in front of it.

A firewall or IP allowlist

If you allowlist inbound traffic, the range to admit is Anthropic’s outbound IPv4 range, 160.79.104.0/21, published on Anthropic’s IP addresses page. The same page lists phased-out addresses (34.162.46.92/32 and four others). An allowlist written before the change may only contain those.

An outbound tunnel avoids the question: your machine dials out, and nothing needs an inbound rule.

A bot or WAF rule at the edge

A CDN can block the request before it reaches your origin, so your origin logs show nothing. In #76, the cause was Cloudflare’s managed rule “Block AI training bots”, which “blocks the Claude-User user agent with a 403 at the edge before requests reach the origin server.” Check your CDN’s firewall events as well as your server logs.

Certificate problems

Self-signed certificates and private CAs are trusted only on machines you configured. The reporter on #9 tried exactly that: “I even tried setting up a self-signed certificate and CA, which works in my browser, but Claude Desktop won’t trust it.” Use a certificate from a public CA such as Let’s Encrypt, and serve the full chain.

openssl s_client -connect mcp.example.com:443 -servername mcp.example.com </dev/null

Verify return code: 0 (ok) is what you want.

If requests arrived but it still fails

Wrong transport or path

Custom connectors expect Streamable HTTP at the URL you paste, usually ending in /mcp. A server that only speaks the legacy 2024-11-05 HTTP+SSE transport (GET /sse plus POST /messages) is a common mismatch, as is pasting the host without the path.

Send an initialize request by hand:

curl -i -X POST https://mcp.example.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"0"}}}'

A server without auth should answer 200 with a JSON-RPC result. A 404 or 405 means the path or transport is wrong. If your server is behind MCP Warp, Expose an HTTP server covers the same requirement: Streamable HTTP only, no legacy SSE.

Broken OAuth discovery

If your server uses OAuth, the unauthenticated request above should get a 401 with a WWW-Authenticate header pointing at Protected Resource Metadata (RFC 9728). That’s how MCP clients find the authorization server. It should look roughly like this:

HTTP/2 401
www-authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/mcp"

Then fetch the metadata it points at:

curl -s https://mcp.example.com/.well-known/oauth-protected-resource/mcp

It should return JSON with resource matching your MCP URL and an authorization_servers list.

A 401 without that header is a common trap. On #953, a commenter who ran the URL through a checker reported that the server answered “401 with no WWW-Authenticate header and no /.well-known/oauth-protected-resource document”, and suggested that Claude started OAuth, found no metadata, and showed “Couldn’t reach”. Judging by the issue body (“401 without token, 200 with correct token”), that server appears to have used a static token.

If you protect your server with a fixed API key or bearer token, configure it in the connector itself. Anthropic’s help article describes a “Request headers” setting for “fixed credentials such as API keys that Claude sends on every request”. For how MCP Warp does the OAuth side, see Security.

“Authorization with the MCP server failed”

This is the neighbouring error. Claude reached the server, started OAuth, and something in the flow failed. The issue tracker has many reports with that error, for example #978 and #864.

Things worth checking on your side:

The resource value in your Protected Resource Metadata matches the URL in the connector exactly, including the path.
Your authorization server accepts https://claude.ai/api/mcp/auth_callback as a redirect URI.
Your token endpoint is reachable from the internet, and admits Anthropic’s IP range if you allowlist.

In #864 the server logged a successful authorize step and a redirect back to Claude, then no /token request at all. If your logs look like that, the failure is likely past your server. Report it with the ofid_ references.

A related symptom: #457 reports a public server with no auth where claude.ai still tried to register with a sign-in service and failed with “Couldn’t register with CBETA_search_by_mcp’s sign-in service”.

Connected, but no tools

Sometimes OAuth completes and the connector still never shows as Connected. claude-code #88831 describes this: the token exchange succeeds on the server, but the connector backend “never follows up with a request to the MCP resource endpoint itself”. If your logs show a successful /token response and no authenticated /mcp request after it, you’re likely looking at the same thing.

If you use MCP Warp

MCP Warp is the tunnel we build. If your URL is a *.tunnel.mcpwarp.io/mcp address, check the status code at the URL first. From Troubleshooting:

Status at the URL	Meaning	Fix
`503`	The server is enabled, but no `mcpwarp up` is connected for it.	Start `mcpwarp up` on the machine that hosts the server.
`404`	Unknown subdomain, or the server is disabled in the dashboard.	Check the URL; check the server’s status in the dashboard.
`429`	The plan’s request quota is used up for this month.	Upgrade, or wait for the reset at the start of the UTC month.
`502`	A stdio server crashed 10 times in a row without a 60-second healthy run.	Run `mcpwarp up --verbose`, fix the server, restart.

MCP Warp takes care of the public HTTPS URL, the certificate, inbound firewall rules (the tunnel is outbound from your machine), and OAuth discovery: an unauthenticated request gets a 401 with a WWW-Authenticate header pointing at Protected Resource Metadata. It can’t fix failures inside Anthropic’s connector backend.

Getting there takes a one-time setup: install the CLI, sign in at web.mcpwarp.io to choose a username, and add the server to ~/.mcpwarp/config.json. After that it’s two commands:

mcpwarp login
mcpwarp up

Get started has the full walkthrough. The Free plan is 100 requests a month and 1 server, and every request a client makes counts.

Still stuck

Open an issue on anthropics/claude-ai-mcp, after searching for your symptom. Include:

The ofid_ reference for each attempt, with the time and timezone.
Whether any request arrived, and which paths, with timestamps.
The full response headers of an unauthenticated POST to your MCP URL, including WWW-Authenticate.
The body of your Protected Resource Metadata.
Your transport and client registration type (none, static, or dynamic client registration).

Redact tokens and anything private before you post.

Why claude.ai can't connect to your local MCP server (and how to fix it)

Wed, 07 Oct 2026 00:00:00 GMT

claude.ai can’t use a localhost MCP server because the connection comes from Anthropic’s servers, and they can’t reach your machine. The server needs a public HTTPS URL, ideally with OAuth in front of it. A tunnel such as MCP Warp, Cloudflare Tunnel with Access, or ngrok plus your own auth provides one; add it as a custom connector.

If you want the same URL working in every client at once, the companion guide One URL for your MCP server, in every client covers claude.ai, Claude Desktop, Claude Code, ChatGPT and VS Code side by side.

The short answer

When you add a custom connector in claude.ai, your browser doesn’t talk to the MCP server. Anthropic’s backend does. Anthropic’s help article on custom connectors puts it this way: “When you add a custom connector, Claude connects to your remote MCP server from Anthropic’s cloud infrastructure, rather than from your local device.” To that infrastructure, localhost is Anthropic’s own machine, and your laptop is somewhere on a private network it has no route to.

So the URL has to be reachable from the public internet over HTTPS with a certificate a normal client trusts. Because that URL now points at your machine, you also want something deciding who may call it, and OAuth is the option claude.ai is built around.

What the error looks like

Paste a localhost URL into a custom connector in Claude Desktop and the dialog only says “Failed to add connector”. The reason is in Claude Desktop’s log files (quoted from anthropics/claude-ai-mcp #9):

Localhost URLs cannot be used because our servers cannot reach your local machine. Provide a publicly accessible MCP server URL.

There is a second variant. Claude Desktop also refuses http:// URLs outright, even for localhost. The issue is titled:

Claude Desktop rejects URLs with http even on localhost

and the report on #9 says:

I even tried setting up a self-signed certificate and CA, which works in my browser, but Claude Desktop won’t trust it.

That issue was closed as “not planned”. An Anthropic collaborator explained why in the thread: “Custom connectors added through the connector settings are reached from Anthropic’s servers, not your local machine, so a localhost or http:// URL would not work even if accepted.”

Not everyone took that well. One commenter wrote “Codex takes an http localhost url without missing a beat.” Another: “This issue forced me off Claude.” Both are in #9.

Why claude.ai can’t see your machine

Here is the path a custom connector request takes:

Your browser (claude.ai)
   │  "use connector X"
   ▼
Anthropic's servers          160.79.104.0/21
   │  HTTPS request to the connector URL
   ▼
The public internet
   │
   ▼
Your laptop                  behind a home router, no public address

Anthropic publishes the address range its outbound MCP calls come from. On its IP addresses page, the outbound IPv4 range “that Anthropic uses for outbound requests (for example, when making MCP tool calls to external servers)” is 160.79.104.0/21.

That explains every failed workaround:

localhost or 127.0.0.1 resolves to the machine making the request, which is Anthropic’s.
A LAN address like 192.168.1.20 is private. Anthropic’s servers have no route to it.
A self-signed certificate or a local CA is trusted only by machines you configured. Your browser trusting it says nothing about Anthropic’s servers.
A VPN or tailnet address works for your devices only. Anthropic’s help article on custom connectors says it directly: “Servers hosted on a private corporate network, behind a VPN, or blocked by a firewall won’t connect, even if you can reach them from your own machine.”

If you want the full request path for a tunnel, How MCP Warp works walks through one end to end.

What a URL needs before claude.ai will use it

Public HTTPS with a real certificate

The hostname must resolve in public DNS, the port must be reachable from the internet, and the certificate must chain to a public CA. Let’s Encrypt is fine. If you run a firewall or IP allowlist in front of the server, it has to admit 160.79.104.0/21, per Anthropic’s IP addresses page.

Auth that matches what you configure in the connector

The custom connector dialog has two separate auth settings, according to Anthropic’s help article. Under Authentication you pick “Sign in now”, “Sign in when needed” or “No sign in”; the first two run OAuth. Separately, a “Request headers” field takes fixed credentials such as an API key or bearer token that Claude sends on every request.

No sign-in means anyone who finds the URL can call your tools, on your laptop, with your permissions. A fixed header is a shared secret that lives in a connector setting. OAuth ties each call to an account and is what MCP clients discover automatically: an unauthenticated request gets a 401 with a WWW-Authenticate header pointing at Protected Resource Metadata (RFC 9728), and the client runs the sign-in from there. Security covers that flow as MCP Warp implements it.

Expect some friction even when you do everything right. The claude-ai-mcp issue tracker has many reports of OAuth connectors failing on Anthropic’s side; the companion checklist for “Couldn’t reach the MCP server” collects them.

Streamable HTTP

claude.ai can’t launch a process on your machine, so a server that only speaks stdio (the kind you start with uvx something or npx something in Claude Desktop’s JSON config) needs a bridge to HTTP first. Expose a stdio server shows one way to do it.

Your options

As of 7 October 2026. Check each project’s page for current terms.

Option	Cost	Needs your own domain	Auth handled for you	stdio	URL stays the same
Deploy the server to a host	Hosting cost	No, most hosts give you a subdomain	No, you build it	Needs a bridge	Yes
ngrok plus your own auth	Free tier and paid plans	No, ngrok gives you a hostname	Partly (Traffic Policy rules, no MCP OAuth)	Needs a bridge	Yes, one auto-assigned dev domain on Free
Cloudflare Tunnel plus Access	Free	Yes, a domain on Cloudflare	You configure Access and an identity provider	Needs a bridge	Yes
mcptunnels	Free	No, it uses its relay’s hostname	Yes, by default	Yes	No, random URL, expires after 24h
MCP Warp	Free (100 requests/month), then $5 or $10/month	No, URLs are under `tunnel.mcpwarp.io`	Yes, OAuth at the edge	Yes	Yes, named per server
Anthropic MCP tunnels	Enterprise plan only, by request	No, Anthropic assigns one	No, OAuth on each server is yours	No, Streamable HTTP only	Yes
OpenAI Secure MCP Tunnel	Open-source client; no cost stated	No	n/a	Yes	n/a, OpenAI products only

A few notes on the rows:

Deploying works when the server only calls cloud APIs. It doesn’t work for servers that need your files, a desktop app like Blender, or a local database.
Cloudflare Tunnel plus Access is free and solid, but you need a domain on Cloudflare, a Zero Trust setup, an Access application and an identity provider, plus a stdio bridge if your server needs one. This write-up on zenn shows what the DIY route takes, and mcp-ferry exists to glue the pieces together.
mcptunnels is the fastest free option: no account, stdio support, auth on by default. The catch is that the tunnel and its URL disappear after 24 hours, so the connector has to be re-added.
Anthropic’s MCP tunnels are real and first-party, but they are “available to organizations on the Claude Enterprise plan by request”, need Kubernetes or Docker Compose plus cloudflared inside your network, and by default only forward to RFC 1918 private addresses (Anthropic docs).
OpenAI’s tunnel connects private MCP servers to “ChatGPT, Codex, the Responses API, and AgentKit” (openai/tunnel-client). Great if ChatGPT is your only client; it does nothing for claude.ai.

The MCP Warp way

MCP Warp is the tunnel we build. It gives each local server a public HTTPS URL with OAuth at the edge, and it can spawn stdio servers itself. The first run has a few steps; after that it is two commands.

Install the CLI. On macOS or Linux with Homebrew:
```
brew tap mcpwarp/tap
brew trust --tap mcpwarp/tap
brew install --cask mcpwarp
```
Scoop, .deb, .rpm and .apk packages are in Get started.
Sign in once at web.mcpwarp.io to create your account and pick a username. Skip this and mcpwarp up fails with USERNAME_REQUIRED.
Add your server to ~/.mcpwarp/config.json. For a server already running Streamable HTTP on port 8765:
```
{
  "servers": [
    { "name": "notes", "kind": "http", "url": "http://127.0.0.1:8765/mcp" }
  ]
}
```
For a stdio server, use "kind": "stdio" with command and args instead.

mcpwarp login
mcpwarp up

NAME     KIND   URL
notes    http   https://notes-anatoly.tunnel.mcpwarp.io/mcp

In claude.ai, add a custom connector, paste the URL, and complete the OAuth sign-in when prompted. Connect Claude has the details.

MCP Warp isn’t certified by Anthropic; it’s built to work with Claude as a standard Streamable HTTP MCP client.

Things to know

mcpwarp up runs in the foreground. Close it, or let the laptop sleep, and the URL returns 503 until it reconnects.
The Free plan is 100 requests a month and 1 server. Every HTTP request a client makes to your URL counts, and a single chat with a few tool calls makes several. Plus ($5/month) and Pro ($10/month) remove the request cap. See Limits and quotas.
Only your account can use the URL. The edge checks that the token belongs to the server’s owner; a valid token from another account gets a 403.

FAQ

Can I use http on localhost in Claude Desktop?

Not as a custom connector. The Anthropic reply on #9 points to the alternative: run the server as a local stdio server in Claude Desktop’s developer settings (claude_desktop_config.json), which connects directly on your machine.

Does Claude Code accept localhost?

Claude Code runs on your machine, so it can reach a local server directly:

claude mcp add --transport http notes http://localhost:8765/mcp

The Claude Code MCP docs cover the --transport http option. A public URL only matters if you want the same server in claude.ai, the mobile apps or ChatGPT too.

Is my server exposed to everyone?

With a plain tunnel and no auth, yes. With MCP Warp, every request needs a valid OAuth token belonging to you. The URL itself is only an identifier; the token is what protects the server.

MCP Warp | Blog

ngrok alternative for MCP: ngrok vs Cloudflare Tunnel vs Tailscale Funnel vs MCP Warp

What an MCP tunnel has to do that a web tunnel doesn’t

Comparison table

ngrok

Cloudflare Tunnel with Access

Tailscale Funnel

MCP Warp

Other options worth knowing

Which one to pick

Use a stdio MCP server in claude.ai and ChatGPT without deploying it

Why web clients can’t use stdio

stdio, Streamable HTTP and SSE in two minutes

The three jobs

Option A: bridge plus tunnel plus auth

Option B: one tool for all three

How the bridge works

Limits

Option C: OpenAI’s tunnel, for ChatGPT only

Option D: mcptunnels, free with a 24-hour URL

Which servers this suits

Use your laptop's MCP servers from the Claude app on your phone

The short answer

How connectors reach the mobile app

Why your laptop’s server doesn’t show up

Give the server a public URL

What has to stay on

Good first servers to try

Is this safe?

FAQ

Does this work on Claude Free?

Will the phone ask me to sign in to the server again?

Does the ChatGPT mobile app work the same way?

Do I need to keep the terminal open?

Introducing MCP Warp: ngrok for MCP servers

The problem

What MCP Warp does

Setting it up

Where it fits

Plans

Next steps

One URL for your MCP server, in every client: claude.ai, Claude Desktop, Claude Code, ChatGPT and VS Code

What an MCP server URL is

Get a URL for a server on your machine

Add it to each client

claude.ai and Claude Desktop

Claude Code

ChatGPT

VS Code

Anything else

Comparison table

When it doesn’t connect

More guides

"Couldn't reach the MCP server" in Claude: a checklist

What the error means

First, did any request arrive?

If nothing arrived

The URL is localhost, a LAN address or plain http

Tailscale Funnel

A firewall or IP allowlist

A bot or WAF rule at the edge

Certificate problems

If requests arrived but it still fails

Wrong transport or path

Broken OAuth discovery

“Authorization with the MCP server failed”

Connected, but no tools

If you use MCP Warp

Still stuck

Why claude.ai can't connect to your local MCP server (and how to fix it)

The short answer

What the error looks like

Why claude.ai can’t see your machine

What a URL needs before claude.ai will use it

Public HTTPS with a real certificate

Auth that matches what you configure in the connector

Streamable HTTP

Your options

The MCP Warp way

Things to know