Provides /create-docker-mcp-tunnel, which drives the MCP tunnels quickstart: certificates, proxy config and cloudflared. No inbound ports are opened. It is a research preview.
What it does
Where MCP Tunnels runs and what it adds, from its documentation
Preflight checks Docker, Compose, OpenSSL and connectivity
Generates a CA and server certificate with OpenSSL
Scaffolds a FastMCP sample or wires an existing server
Writes mcp-proxy.yaml and a digest-pinned docker-compose.yaml
Starts the stack and checks logs
Includes a troubleshooting matrix and rotation basics
When to use it
Good fit
Local testing of a private MCP server behind a tunnel
Exposing an internal MCP server with no inbound ports
Not for
Hardened, Kubernetes or Workload Identity deployments; see the official guides
How to install MCP Tunnels
You need: Docker and Docker Compose; OpenSSL 1.1.1+; Console role able to manage MCP tunnels; Outbound access to api.anthropic.com:443 and tunnel edge 7844 TCP/UDP
Run Claude Code
Run /plugin install mcp-tunnels@claude-plugins-official
Run /create-docker-mcp-tunnel [deployment-dir]
Create the tunnel in the Claude Console and upload ca.crt when asked
Start the stack and verify logs
Permissions and security
What it can access
Runs Docker containers and OpenSSL locally
Token stored in a locked-down gitignored .env
Security notes from the maintainers
Research preview, as-is, no uptime or support commitment
Depends on Cloudflare transport
Never copy ca.key or tls.key off the host
Review the source before granting an agent access to credentials or production systems. We document what the maintainers state; we do not audit code.
Limitations
Targets manual-credentials, single-host, local testing
