Set up an MCP tunnel changedconnectors/mcp-tunnels/setup
Nearest release: v2.1.305, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 20 Oct 2026 17:01 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 23 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+8added
Lines−8removed
From line
6
where the diff opens
First seen
31 Aug 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 6, old and new numbered
/
from line 6
66>
77> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
88
9This page covers the full setup of an MCP tunnel for a claude.ai Enterprise organization, from creating the API key that provisioning uses to members calling a tunneled MCP server from Claude. You need the Owner or Primary Owner role in claude.ai, and someone who can deploy containers to a Kubernetes cluster or a Docker host inside your network. Read [MCP tunnels](/docs/connectors/mcp-tunnels/overview) first if the tunnel stack, the tunnel domain, and routes are unfamiliar.
9This page covers the full setup of an MCP tunnel for a claude.ai Enterprise organization, from creating the API key that provisioning uses to members calling a tunneled MCP server from Claude. You need the Owner or Primary Owner role in claude.ai, and someone who can deploy containers to a Kubernetes cluster or a Docker host inside your network. Read [MCP tunnels](https://claude.com/docs/connectors/mcp-tunnels/overview) first if the tunnel stack, the tunnel domain, and routes are unfamiliar.
1010
1111## Create a Tunnels API key
1212
from line 63
6363 search: http://10.0.12.7:9000
6464```
6565
66With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#proxy-logs-ip-validation-failed).
66With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#proxy-logs-ip-validation-failed).
6767
6868**3. Review the rendered manifests**
6969
from line 94
9494 --set api.token="$API_TOKEN"
9595```
9696
97The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#helm-install-fails-with-a-hook-error).
97The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#helm-install-fails-with-a-hook-error).
9898
9999> [!WARNING]
100100>
from line 267
267267docker compose logs mcp-proxy | grep "route configured"
268268```
269269
270The containers take a few seconds to start, so rerun the commands if they come back empty. If cloudflared never registers, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#the-tunnel-stack-starts-but-cloudflared-never-connects). The end-to-end check happens from Claude, in the next section.
270The containers take a few seconds to start, so rerun the commands if they come back empty. If cloudflared never registers, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#the-tunnel-stack-starts-but-cloudflared-never-connects). The end-to-end check happens from Claude, in the next section.
271271
272272## Add tunneled servers as connectors
273273
from line 287
287287
288288**4. Configure authentication**
289289
290Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md).
290Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md).
291291
292292**5. Add the connector**
293293
294294Select **Add**.
295295
296Members then find the connector in their own connector settings and select **Connect** to sign in, as described in [Add a connector by URL](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url). To confirm the tunnel end to end, connect the server yourself and ask Claude to use one of its tools while you watch the proxy logs for the request.
296Members then find the connector in their own connector settings and select **Connect** to sign in, as described in [Add a connector by URL](https://claude.com/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url). To confirm the tunnel end to end, connect the server yourself and ask Claude to use one of its tools while you watch the proxy logs for the request.
297297
298298### Add more servers later
299299
from line 464
464464
465465## Next steps
466466
467* [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md): make OAuth sign-in work when your authorization server is inside your network
468* [Troubleshoot MCP tunnels](/docs/connectors/mcp-tunnels/troubleshooting.md): diagnose connection, certificate, routing, and sign-in failures
467* [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md): make OAuth sign-in work when your authorization server is inside your network
468* [Troubleshoot MCP tunnels](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md): diagnose connection, certificate, routing, and sign-in failures
469469* [MCP tunnels reference](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference): proxy configuration fields, certificate requirements, and the setup component
470470
No line in this hunk matches that.