Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Documentation 25 Sep 2026
One change · claude-docs

MCP tunnels changedconnectors/mcp-tunnels/overview

Nearest release: v2.1.283, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 25 Sep 2026 18:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.

Upstream edited
Recorded here
Lines+18added
Lines−18removed
From line 43 where the diff opens
First seen 31 Aug 2026 this site's first read of the page
Recorded edits6to this page, all time

The whole hunk

from line 43, old and new numbered
/
lines
from line 43
4343 
4444### Network requirements
4545 
46| Component | Destination | Port and protocol | Used during |
47| --------------- | ---------------------------------------------------- | ---------------------------- | ---------------------------- |
48| Setup component | `api.anthropic.com` | 443 TCP | Provisioning, token rotation |
49| cloudflared | Tunnel edge (`198.41.192.0/19`, `2606:4700:a0::/44`) | 7844 TCP and UDP | Runtime |
50| Proxy | Your MCP servers | As configured in your routes | Runtime |
46| Component | Destination | Port and protocol | Used during |
47| - | - | - | - |
48| Setup component | `api.anthropic.com` | 443 TCP | Provisioning, token rotation |
49| cloudflared | Tunnel edge (`198.41.192.0/19`, `2606:4700:a0::/44`) | 7844 TCP and UDP | Runtime |
50| Proxy | Your MCP servers | As configured in your routes | Runtime |
5151 
5252No inbound rules are required. See [Cloudflare's tunnel firewall documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/) for the authoritative edge IP list.
5353 
from line 55
5555 
5656Three independent layers protect every request through a tunnel.
5757 
58| Layer | Protects against |
59| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
60| Outer mutual TLS between Anthropic and the transport provider, with IP validation | Unauthorized clients reaching the tunnel |
61| Inner TLS from Anthropic's backend to your proxy | Payload inspection by the transport provider or any network intermediary |
62| OAuth on each MCP server | Unauthorized use of MCP tools by traffic that has reached the server |
58| Layer | Protects against |
59| - | - |
60| Outer mutual TLS between Anthropic and the transport provider, with IP validation | Unauthorized clients reaching the tunnel |
61| Inner TLS from Anthropic's backend to your proxy | Payload inspection by the transport provider or any network intermediary |
62| OAuth on each MCP server | Unauthorized use of MCP tools by traffic that has reached the server |
6363 
6464The proxy terminates inner TLS with a certificate signed by a certificate authority (CA) that the setup component generates inside your environment and registers with Anthropic. Only your deployment holds the private keys, so Cloudflare carries ciphertext and cannot read MCP requests or responses. Anthropic does not connect to a tunnel until a CA certificate is registered for it. Cloudflare does receive connection metadata: the egress IP address and a host fingerprint of the machine running cloudflared, connection timing and byte volume, and the `tunnel.anthropic.com` subdomain assigned to your tunnel. Cloudflare acts as a subprocessor for this research preview.
6565 
from line 67
6767 
6868### Shared responsibility
6969 
70| Anthropic handles | Your organization handles |
71| --------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
72| Restricting tunnel access so that only Anthropic can connect | All content and traffic that transits your tunnel, and compliance with applicable third-party acceptable-use policies, including Cloudflare's |
73| Validating your CA certificate before connecting to your proxy | Securing the tunnel token, the Tunnels API key, and the TLS private keys |
74| Sending Claude's requests only to tunnels that your organization owns | Renewing the server certificate before it expires |
75| | Requiring OAuth on each MCP server and limiting each server to the tools it needs |
76| | Restricting network access for the proxy hosts and MCP servers |
77| | Notifying Anthropic if you suspect a compromise |
70| Anthropic handles | Your organization handles |
71| - | - |
72| Restricting tunnel access so that only Anthropic can connect | All content and traffic that transits your tunnel, and compliance with applicable third-party acceptable-use policies, including Cloudflare's |
73| Validating your CA certificate before connecting to your proxy | Securing the tunnel token, the Tunnels API key, and the TLS private keys |
74| Sending Claude's requests only to tunnels that your organization owns | Renewing the server certificate before it expires |
75| | Requiring OAuth on each MCP server and limiting each server to the tools it needs |
76| | Restricting network access for the proxy hosts and MCP servers |
77| | Notifying Anthropic if you suspect a compromise |
7878 
7979<Warning>
8080 An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](/docs/connectors/mcp-tunnels/setup#rotate-credentials).
Feedback