ap-tunnels

ap-tunnels

When to use

• A local dev server must be reachable from the internet (webhook targets, demo links, mobile testing).
• You want to drive this daemon's MCP gateway from a remote client.
• A tunnel is stuck or duplicated and needs to be found and rotated.

tunnel_*: expose any local port

// 1. Always check first — one tunnel per port; duplicates just fail
tunnel_list({ "onlyActive": true })

// 2. Quick tunnel: no account, ephemeral URL, ready in seconds
tunnel_create({ "targetPort": 3000, "provider": "cloudflare-quick", "label": "vite-preview" })
// → { "id": "uuid", "publicUrl": "https://random-words.trycloudflare.com",
//     "url": "https://random-words.trycloudflare.com/?t=<signed token>", "access": "private", ... }
// Share `url`, not `publicUrl` — the bare host rejects requests without the token.

// 3. Named tunnel: stable hostname you provisioned once
tunnel_create({
  "targetPort": 3000,
  "provider": "cloudflare-named",
  "hostname": "app.example.com",
  "tunnelId": "11111111-2222-3333-4444-555555555555",
  "credentialsFile": "~/.cloudflared/<tunnelId>.json",
  "autostart": true
})

// 4. Inspect / revoke the link / stop (stop is idempotent)
tunnel_status({ "tunnelId": "uuid" })
tunnel_revoke({ "tunnelId": "uuid" })   // invalidate the current link, get a fresh `url`; tunnel keeps running
tunnel_stop({ "tunnelId": "uuid" })

tunnel_create is private by default: an access guard (random bearer token, ttl default 24h, X-Robots-Tag: noindex, blocks /@fs/ and *.map) sits in front of targetPort, and the returned url carries the signed token. Pass "public": true only for content meant to be public — it skips the guard entirely (no token, no TTL, no revoke) and the descriptor carries a warning. list_tunnel_adapters enumerates the installed tunnel backends and their capabilities. Providers with credentials (e.g. ngrok authtokens, named-tunnel ids) are configured once, stored sensitively, and never echoed.

remote_enable: publish the gateway itself