Reach your local MCP host.
Keep the boundary clear.

1. Do you need a tunnel?

If your AI client can launch or connect to a local MCP server directly, you may not need one. A tunnel is useful when the client is remote and needs to reach a service running on your workstation without opening inbound router ports.

2. Cloudflare Tunnel

1. Install cloudflared on the computer running SFI Agent.
2. Choose a named tunnel for a stable setup, authenticate it with your Cloudflare account, and create a DNS route for a subdomain you control.
3. Configure the tunnel to forward only the intended MCP service port or route. Keep the dashboard bound to localhost unless it has separate, robust access controls.
4. Start the tunnel and verify DNS, TLS, HTTP method handling, request headers, and the MCP initialization/tool-list sequence.

For quick experiments, a temporary tunnel URL can be convenient, but it may change and is not a dependable production endpoint.

3. ngrok

1. Install ngrok using its official instructions and authenticate your local agent.
2. Start the local MCP service on the port your host actually uses.
3. Run a tunnel targeting that port, for example:

ngrok http 3333

Replace 3333 with your actual MCP server port. For a stable URL, configure a reserved domain or custom domain supported by your ngrok plan and account.

4. Attach a custom domain

For Cloudflare, the domain must be managed by an account you control and DNS must route the chosen hostname to the named tunnel. For ngrok, use a domain configured in ngrok and follow its DNS verification steps. DNS records and product steps depend on your provider setup.

Use a dedicated hostname such as mcp.yourdomain.com where practical. The public marketing site and local dashboard do not need to be the same endpoint as the MCP server.

5. Secure the route before connecting AI

• Expose only the MCP endpoint; never proxy the entire workstation or dashboard without protection.
• Use authentication/access policy for tools that can read private code, modify files, or run commands.
• Use workspace allowlists, secret-file protection, least-privilege command policies, and audit logs.
• Do not place bearer tokens in URLs or commit credentials into source control.
• Disable the tunnel when you no longer need remote access; rotate/revoke credentials if exposed.
• Test from outside your network and confirm unauthorized requests are rejected.