Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Developer Platform 21 Oct 2026
One change · api

reference changedagents-and-tools/mcp-tunnels/reference

Nearest release: v2.1.307, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here
Lines+3added
Lines−3removed
From line 21 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits4to this page, all time

The whole hunk

from line 21, old and new numbered
/
lines
from line 21
2121| `tls.cert_file` | Path to the server TLS certificate. | Required |
2222| `tls.key_file` | Path to the server TLS private key. | Required |
2323| `routes` | Map of subdomain or full hostname to upstream URL. See [Route matching](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference#route-matching). | Required |
24| `upstream.allowed_ips` | IPv4 CIDR ranges or single addresses the proxy is permitted to connect to. Mutually exclusive with `disable_ip_validation`. | RFC1918 private ranges |
24| `upstream.allowed_ips` | IPv4 CIDR ranges or single addresses the proxy is allowed to connect to. Mutually exclusive with `disable_ip_validation`. | RFC1918 private ranges |
2525| `upstream.disable_ip_validation` | Disable upstream IP validation entirely. Mutually exclusive with `allowed_ips`. | `false` |
2626| `upstream.tls.ca_file` | CA bundle for validating upstream TLS. | None |
2727| `upstream.tls.include_system_cas` | Also trust the system CA bundle for upstream TLS. | `false` |
from line 62
6262 
6363Upload with `POST /v1/tunnels/{tunnel_id}/certificates`. A tunnel can hold up to two active CA certificates at a time, which allows zero-downtime rotation.
6464 
65* PEM-encoded, single certificate, up to 8 kB.
65* PEM-encoded, single certificate, up to 8 kB.
6666* `BasicConstraints` extension present with `CA:TRUE`, marked critical.
6767* `SubjectKeyIdentifier` extension present.
6868* `KeyUsage` includes `keyCertSign`.
from line 80
8080* Within its validity period.
8181* RSA 2048-bit or larger, or ECDSA P-256 or larger, with a SHA-256 or stronger signature.
8282 
83The setup component generates an ECDSA P-256 CA with five-year validity and an RSA 4096-bit server certificate with a wildcard SAN and 90-day validity.
83The setup component generates an ECDSA P-256 CA with 5-year validity and an RSA 4096-bit server certificate with a wildcard SAN and 90-day validity.
8484 
8585## Setup component
8686 
Feedback