tunnel-client — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of github.com/openai/tunnel-client: Have runtime/admin keys, tunnel authorization and private endpoint exposure defaults changed?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Reach internal MCP servers from clients through controlled tunnel

What we know

OpenAI Secure MCP Tunnel customer-run client connects private MCP servers without public exposure.

Maintenance / activity evidence

OpenAI tunnel-client v0.0.15 was released 2026-09-25.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Customer-run transport gateway/control-plane connector, not independent MCP domain tool; platform account/tunnel_id/runtime key and local private MCP needed. Reported action classes: Establish and maintain authenticated transport tunnel sessions; downstream capabilities depend on connected server. Complete write authority is not verified.
Authentication not yet verified.
Private MCP server capabilities are exposed to authorized tunnel consumers; organization roles and groups govern access.

Private MCP server capabilities are exposed to authorized tunnel consumers; organization roles and groups govern access.
Advisory/security review not completed; no safety badge.
Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

550 repository stars

Stars observed Oct 9, 2026.

Repository total for openai/tunnel-client.

All limitations / Review context

Have runtime/admin keys, tunnel authorization and private endpoint exposure defaults changed?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Private MCP server capabilities are exposed to authorized tunnel consumers; organization roles and groups govern access.
Advisory/security review not completed; no safety badge.
Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.
Customer-run transport gateway/control-plane connector, not independent MCP domain tool; platform account/tunnel_id/runtime key and local private MCP needed.
Reviewed write actions: Establish and maintain authenticated transport tunnel sessions; downstream capabilities depend on connected server
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Private MCP tool access is mediated by tunneling; runtime and administrator tokens have different privileges and must be scoped.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
verified install or launch command
exact authentication contract
first-party data processing and retention
transport verification
data retention and permission scope
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Not itself a business-domain MCP Server; depends on tunnel control plane and operator policy.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

OpenAI tunnel-client v0.0.15 was released 2026-09-25.

Technical identity

github.com/openai/tunnel-client

Exact implementation source: https://github.com/openai/tunnel-client ↗
Reviewed resource type: Gateway
Repository identity: openai/tunnel-client

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
openai/tunnel-client
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Gateway setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
OpenAI tunnel-client bridges a private MCP server to OpenAI-hosted tunnel; organization tunnel ID and runtime API key required.
package install · Publisher instructions
brew install openai/tools/tunnel-client
mcp stdio launcher or diagnostic · Publisher instructions
tunnel-client --version tunnel-client help quickstart
Configure / authenticate
Publisher instructions
openai/tunnel-client uses Homebrew tap on macOS, then guided runtimes connect. Runtime API key differs from OpenAI admin API key; never use admin credential as runtime key.
Check connection
Suggested check
Check tunnel-client runtimes status <alias>, not production key rotation as smoke test.
Remove / uninstall / revoke
MCP100 setup guide
For macOS Homebrew installed OpenAI tunnel-client; stop managed runtime/tunnel via supported CLI before removing. This is a tunnel agent, not a general MCP server.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
brew uninstall tunnel-client

Official Documentation & Sources

What it does

OpenAI Secure MCP Tunnel customer-run client connects private MCP servers without public exposure.

Capability: Cloud & DevOps
Resource type: Gateway
Best fit: Reach internal MCP servers from clients through controlled tunnel

Representative uses

Private-server relay
auth and network boundary

Limitations

Not itself a business-domain MCP Server; depends on tunnel control plane and operator policy.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Customer-run transport gateway/control-plane connector, not independent MCP domain tool; platform account/tunnel_id/runtime key and local private MCP needed.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Private MCP server capabilities are exposed to authorized tunnel consumers; organization roles and groups govern access.

Access scope and cautions

Write actions: Not verified Establish and maintain authenticated transport tunnel sessions; downstream capabilities depend on connected server
Risk level: high
Security notes: Advisory/security review not completed; no safety badge. Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Private-server relay; auth and network boundary.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded transport: https_outbound_tunnel. Client notes: Verify local /readyz and tunnel binding per operator guide; do not assume public endpoint. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Separate runtime API key and tunnel_id. Admin key only for management; outbound-only HTTPS tunnel to OpenAI control plane.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Establish and maintain authenticated transport tunnel sessions; downstream capabilities depend on connected server. Recorded permission context: Customer-run transport gateway/control-plane connector, not independent MCP domain tool; platform account/tunnel_id/runtime key and local private MCP needed.

What limitations and risks should I check before use?

Private MCP server capabilities are exposed to authorized tunnel consumers; organization roles and groups govern access. Not itself a business-domain MCP Server; depends on tunnel control plane and operator policy. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Private MCP tool access is mediated by tunneling; runtime and administrator tokens have different privileges and must be scoped. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.