Connection options
Choose between ngrok, Cloudflare Tunnel, Direct HTTPS or the optional OpenAI Secure MCP Tunnel.
Guides follow the current project source. Check the release notes for your installed version.
Raw MCP stays local
The raw MCP gateway binds to loopback. Remote providers forward authenticated traffic to that local service rather than opening the workspace gateway directly to the Internet.
Choose a provider
- ngrok: simplest built-in managed path; uses your ngrok account/authtoken
- Cloudflare Tunnel: uses your cloudflared runtime, tunnel configuration and hostname
- Direct HTTPS: advanced self-routed TLS/ACME path
- OpenAI Secure MCP Tunnel: optional official tunnel-client path for environments that use it
When a connection is actually healthy
A green transport status alone does not prove your AI client can call RepoTunnel. You need the complete path: reachable HTTPS, valid OAuth authorization, MCP tool discovery and a successful tool call against an approved workspace.
The raw local gateway listens on loopback. A public provider exposes only the intended remote surface and must not permit arbitrary local file paths or desktop UI access.
Choose based on your situation
Use managed ngrok for a straightforward public HTTPS path when you have an ngrok account. Use Cloudflare Tunnel if you already operate a configured cloudflared tunnel. Use Direct HTTPS when you control the required public hostname, routing and trusted certificate setup.
The optional OpenAI Secure MCP Tunnel is a separate transport for environments with official tunnel-client access. These paths are alternatives; you do not need to enable all of them.
Where connection setup lives
Open Connect to inspect the local Gateway, configure the public provider and manage the optional tunnel-client path. The public-provider panel handles configured endpoints and remote authorization lifecycle.
Use HTTPS Setup for the staged advanced Direct HTTPS guidance. When revoking remote access or forgetting a provider, inspect the app’s confirmation and current state; approved local projects are a separate part of the product.