1# Secure MCP Tunnel
2
3Secure MCP Tunnel lets you connect private MCP servers to supported OpenAI products without opening inbound firewall ports or exposing those servers to the public internet. Run `tunnel-client` inside the network that can already reach your MCP server; it opens an outbound HTTPS path to OpenAI, pulls queued MCP work, forwards requests locally, and returns responses through the same tunnel.
4
5## Use Secure MCP Tunnel when
6
7- Your MCP server runs on a private network, on-premises, on a developer machine, or behind existing access controls.
8- You want ChatGPT, Codex, the Responses API, or another supported OpenAI surface to use that server without making the MCP server public.
9- Your network allows the host running `tunnel-client` to make outbound HTTPS requests to OpenAI.
10- Start with the [MCP and Connectors guide](https://developers.openai.com/api/docs/guides/tools-connectors-mcp) for general MCP concepts.
11
12## How it works
13
141. Create or manage an OpenAI-hosted MCP tunnel endpoint in Platform tunnel settings.
152. Run `tunnel-client` inside the network that can reach your private MCP server.
163. Configure `tunnel-client` with the tunnel identity and the private MCP server address.
174. OpenAI products send MCP requests to the OpenAI-hosted tunnel endpoint.
185. `tunnel-client` long-polls for queued work, forwards each `JSON-RPC` request to the private MCP server, and posts the response back through the tunnel.
19
20The private MCP server does not need a public listener. The OpenAI-hosted endpoint gives supported products a normal MCP request path, while the network initiation point stays inside your boundary. When a connector asks for streamed results, the tunnel path can forward intermediate server-sent events.
21
22<figure className="not-prose my-8">
23 <figcaption className="mt-3 text-sm text-gray-600 dark:text-gray-400">
24 OpenAI products call the OpenAI-hosted tunnel endpoint; `tunnel-client`
25 long-polls for queued work and returns the MCP response through the same
26 tunnel.
27 </figcaption>
28</figure>
29
30## Before you start
31
32You need:
33
34- A `tunnel_id` from [Platform tunnel settings](https://platform.openai.com/settings/organization/tunnels).
35- A runtime API key for `tunnel-client`. The key principal needs Tunnels **Read** + **Use** for the target tunnel.
36- A tunnel manager with Tunnels **Read** + **Manage** if you need to create or edit tunnel metadata.
37- An MCP server that `tunnel-client` can reach over stdio or HTTP from inside your network.
38
39## Set up tunnel-client
40
41Open [Platform tunnel settings](https://platform.openai.com/settings/organization/tunnels), then download the latest public `tunnel-client` release from [openai/tunnel-client](https://github.com/openai/tunnel-client/releases/latest). Keep your runbook pointed at the latest-release URL instead of hard-coding a specific release URL.
42
43For a local stdio MCP server, the shortest profile-based flow is:
44
45```bash
46export CONTROL_PLANE_API_KEY="sk-..."
47
48tunnel-client init \
49 --sample sample_mcp_stdio_local \
50 --profile local-stdio \
51 --tunnel-id tunnel_0123456789abcdef0123456789abcdef \
52 --mcp-command "python /path/to/server.py"
53
54tunnel-client doctor --profile local-stdio --explain
55tunnel-client run --profile local-stdio
56```
57
58For an HTTP MCP server, use `--mcp-server-url https://mcp.internal.example.com/mcp` instead of `--mcp-command`.
59
60Keep `tunnel-client run ...` healthy while you create or test the connector. Connector discovery and MCP tool calls depend on the running client.
61
62## Connect from ChatGPT
63
64Open [ChatGPT connector settings](https://chatgpt.com/#settings/Connectors), create a custom connector, and choose **Tunnel** under **Connection**. Select an available tunnel when ChatGPT lists it, or paste a valid `tunnel_id` if you already have one.
65
66If the tunnel does not appear in ChatGPT, verify that the tunnel is associated with the target workspace and that the connector operator has Tunnels **Read** + **Use**.
67
68## Security and networking
69
70<figure className="not-prose my-8">
71 <figcaption className="mt-3 text-sm text-gray-600 dark:text-gray-400">
72 The private MCP server stays inside the customer-controlled environment.
73 `tunnel-client` reaches OpenAI over outbound HTTPS using the runtime API key
74 and, when required, optional control-plane mTLS.
75 </figcaption>
76</figure>
77
78- The MCP server address stays private and is used only from inside the environment where `tunnel-client` runs.
79- `tunnel-client` authenticates to the OpenAI tunnel control plane; supported OpenAI products use the OpenAI-hosted tunnel endpoint.
80- Tunnel access follows the existing organization and workspace context instead of introducing a separate public ingress path.
81- `tunnel-client` supports enterprise networking requirements such as outbound proxies, custom CA bundles, control-plane client certificates, and MCP-side `mTLS`.
82- The embedded Harpoon MCP server is limited to labeled, allowlisted HTTP callouts used by flows such as OAuth metadata handling. It is not a general-purpose outbound proxy.
83
84## Troubleshooting
85
86- **Tunnel not visible in ChatGPT:** Check the tunnel workspace scope and the connector operator's Tunnels **Use** permission.
87- **Connector discovery or tool calls fail:** Confirm that `tunnel-client run ...` is still running, then re-run `tunnel-client doctor --profile <name> --explain`.
88- **You can inspect a tunnel but cannot edit it:** The operator likely has Tunnels **Read** but not Tunnels **Manage**.
89- `tunnel-client` exposes `/healthz`, `/readyz`, `/metrics`, and a local admin UI at `/ui`.
90- Use those surfaces to confirm that the client is healthy, ready, and polling before testing from ChatGPT, Codex, or an API flow.
91- If the client is not connected, requests through the tunnel fail until `tunnel-client` reconnects.
92- Raw HTTP logging is disabled by default, and support exports are redacted.
93
94## OAuth
95
96- OAuth discovery can travel through the tunnel path so the MCP server itself can remain private.
97- The tunnel preserves the upstream authorization server metadata needed for browser-facing OAuth flows.
98- The authorization server itself is not automatically tunneled. If it is unreachable from the public internet and from the `tunnel-client` host, the OAuth flow can still fail even when the MCP server is reachable.
99
100## Where to configure it
101
102- Manage OpenAI-hosted MCP tunnel endpoints in [Platform tunnel settings](https://platform.openai.com/settings/organization/tunnels).
103- Use a tunnel when creating a connector from [ChatGPT connector settings](https://chatgpt.com/#settings/Connectors).
104- For Codex or API flows, use the tunnel-backed MCP target exposed by the supported product surface.
105
106## Next steps
107
108- Create or manage the tunnel in [Platform tunnel settings](https://platform.openai.com/settings/organization/tunnels).
109- Validate your `tunnel-client` profile with `tunnel-client doctor --profile <profile> --explain`.
110- Connect the tunnel from [ChatGPT connector settings](https://chatgpt.com/#settings/Connectors) or the supported OpenAI surface you are using.
111
112<div class="not-prose my-8 grid gap-4 lg:grid-cols-2">
113 <figure>
114 <a href="https://platform.openai.com/settings/organization/tunnels">
115 <img src="https://developers.openai.com/images/platform/guides/secure-mcp-tunnels/platform-tunnels-settings.png"
116 alt="Sanitized OpenAI Platform tunnel settings screenshot."
117 loading="lazy"
118 class="w-full rounded-md border border-gray-200 dark:border-gray-800"
119 />
120 </a>
121 <figcaption class="mt-3 text-sm text-gray-600 dark:text-gray-400">
122 Create and manage OpenAI-hosted MCP tunnel endpoints from Platform tunnel
123 settings.
124 </figcaption>
125 </figure>
126 <figure>
127 <a href="https://chatgpt.com/#settings/Connectors">
128 <img src="https://developers.openai.com/images/platform/guides/secure-mcp-tunnels/chatgpt-connectors-tunnel.png"
129 alt="Sanitized ChatGPT connector settings screenshot with Tunnel selected."
130 loading="lazy"
131 class="w-full rounded-md border border-gray-200 dark:border-gray-800"
132 />
133 </a>
134 <figcaption class="mt-3 text-sm text-gray-600 dark:text-gray-400">
135 Select Tunnel when connecting a ChatGPT connector to a private MCP server.
136 </figcaption>
137 </figure>
138</div>