Connect private MCP servers to OpenAI: a 2026 Secure MCP Tunnel setup guide
Summary. OpenAI's Secure MCP Tunnel, added to the API changelog in 2026, lets ChatGPT, Codex and the Responses API call a private or on-premise MCP server over an outbound-only HTTPS path, with no inbound firewall ports and no public listener. It works through an open-source agent, tunnel-client (Apache-2.0, release v0.0.8 dated May 7, 2026), that runs inside your network, long-polls api.openai.com on port 443, forwards each JSON-RPC request to the MCP server, and posts the response back. This matters because the usual shortcut, publishing the MCP server so a model can reach it, is dangerous: Adversa AI's June 2026 roundup cites a Censys scan that found 12,520 internet-facing MCP services, most unauthenticated, and audits where about 40% required no authentication at all. With the global average data breach at $4.44 million in 2025 and DPDP penalties in India reaching ₹250 crore, keeping the server private is the correct default. This guide covers what the tunnel is, how it works, a full setup, hardening, and when to choose something else.
The problem: don't publish your MCP server
The Model Context Protocol (MCP) is how models call tools, and teams increasingly wrap internal systems as MCP servers. The tempting mistake is to give that server a public URL so ChatGPT or an agent can reach it. The exposure data is bad. Adversa AI's June 2026 security roundup pulls the measurements together. Censys counted 12,520 internet-accessible MCP services, most of them unauthenticated, many exposing database-query and command-execution capabilities to anyone who connects. A first large-scale measurement study found roughly 40% of remote MCP servers expose their tools with no authentication, and traced nine CVEs to broken OAuth flows. A scanning framework, VIPER-MCP, swept about 40,000 server repositories and produced 67 CVEs, and Trend Micro's follow-up counted 1,467 exposed servers, including CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers.
The fix is dull and well understood: put authentication in front of every remote MCP server and take the unauthenticated ones off the public internet, advice the NSA echoed in its own MCP hardening guidance in 2026. The cost of not doing so is concrete. IBM's 2025 Cost of a Data Breach report put the global average at $4.44 million, down 9% from $4.88 million but still high, with the United States average rising to $10.22 million. In India, a personal-data breach can draw penalties of up to ₹250 crore under the Digital Personal Data Protection Act, 2023. The safest MCP server is one that never accepts an inbound connection from the internet at all.
What Secure MCP Tunnel is
Secure MCP Tunnel is an outbound-only connection from a host inside your network to an OpenAI-hosted MCP endpoint. The private MCP server keeps no public listener. Instead, tunnel-client runs where it can already reach the server, opens an outbound HTTPS channel to OpenAI, pulls queued MCP work, forwards each request locally, and returns the response through the same channel. Supported OpenAI surfaces, ChatGPT, Codex and the Responses API, send their MCP requests to the OpenAI-hosted tunnel endpoint and get a normal MCP request path in return.
The design goal is narrow and useful: give a model a working tool call into a system that stays behind your firewall, without a VPN into OpenAI, without an inbound port, and without a new public ingress. Tunnel access follows your existing OpenAI organization and workspace context rather than a separate public door.
How it works
The flow has five steps, per OpenAI's guide. First, you create an OpenAI-hosted MCP tunnel endpoint in Platform tunnel settings and get a tunnel_id. Second, you run tunnel-client inside the network that can reach the private MCP server. Third, you configure it with the tunnel identity and the MCP server address. Fourth, OpenAI products send MCP requests to the hosted tunnel endpoint. Fifth, tunnel-client long-polls for queued work, forwards each JSON-RPC request to the server, and posts the response back.
Under the hood the client talks to a small control-plane API: it long-polls GET /v1/tunnel/{tunnel_id}/poll, sends results to POST /v1/tunnel/{tunnel_id}/response, and reads metadata from GET /v1/tunnels/{tunnel_id}. It forwards JSON-RPC to your MCP server over Streamable HTTP, stdio, or an in-memory transport, and when a connector asks for streamed output the tunnel forwards intermediate server-sent events. No inbound internet access is required; the host only needs outbound HTTPS to api.openai.com:443, or mtls.api.openai.com:443 when control-plane mTLS is configured, plus local reachability to the MCP server.
Setup, step by step
You need three things before you start: a tunnel_id from Platform tunnel settings, a runtime API key whose principal has Tunnels Read and Use on that tunnel, and an MCP server the client can reach over stdio or HTTP. Creating or editing tunnel metadata needs a manager with Tunnels Read and Manage.
For a local stdio MCP server, the documented path is short:
export CONTROL_PLANE_API_KEY="sk-..."
tunnel-client init \
--sample sample_mcp_stdio_local \
--profile local-stdio \
--tunnel-id tunnel_0123456789abcdef0123456789abcdef \
--mcp-command "python /path/to/server.py"
tunnel-client doctor --profile local-stdio --explain
tunnel-client run --profile local-stdio
For an HTTP MCP server, swap the command for the server URL:
tunnel-client init \
--sample sample_mcp_stdio_local \
--profile http-mcp \
--tunnel-id tunnel_0123456789abcdef0123456789abcdef \
--mcp-server-url https://mcp.internal.example.com/mcp
Run tunnel-client doctor --profile <name> --explain before starting; it validates config and names what is missing. Keep tunnel-client run healthy while you create the connector, because connector discovery and every tool call depend on the running daemon. Then open ChatGPT connector settings, create a custom connector, choose Tunnel under Connection, and select the tunnel or paste its tunnel_id. The client also serves /healthz, /readyz, /metrics, and a loopback-only admin UI at /ui so you can confirm it is healthy and polling before testing.
Where to run tunnel-client
Run the client in the same trust boundary that already reaches the private MCP server. OpenAI documents three common patterns.
| Deployment pattern | How it reaches the MCP server | Best for |
|---|---|---|
| Kubernetes sidecar | Same Pod as the server over localhost | Server already runs in Kubernetes |
| Dedicated Kubernetes deployment | Private Service inside the cluster | Shared server behind a cluster Service |
| VM or systemd service | Private networking on the host | Server on a VM or bare metal |
Security and hardening
The tunnel removes the inbound attack surface, but you still own the client and the server. Harden both.
Use mutual TLS where you can. The client can present a separate control-plane certificate and key with --control-plane.client-cert and --control-plane.client-key (or the matching environment variables), and when those are set against the default host it automatically switches control-plane calls to mtls.api.openai.com. The client also supports MCP-side mTLS, outbound proxies, and custom CA bundles for private PKI, exposed through the built-in sample_mcp_enterprise_proxy profile. Keep the admin UI loopback-only unless an operator network genuinely needs it; raw HTTP logging is off by default and support exports are redacted.
Mind your keys. The runtime CONTROL_PLANE_API_KEY used by the long-lived daemon needs only Tunnels Read and Use. The separate OPENAI_ADMIN_KEY is only for administrative tunnel CRUD, and OpenAI's own guidance is not to use the admin key for the daemon. Authenticate the MCP server itself too: the tunnel keeps it private, but a compromised host inside your network could still call it, so least privilege and per-tool authorization still apply. Our guide to MCP server hardening, CVEs and configs covers the server-side controls, and our notes on prompt-injection guardrails for AI agents cover the model-facing risks.
One nuance on OAuth: discovery metadata can travel through the tunnel so the MCP server stays private, and the tunnel preserves the upstream authorization server metadata for browser-facing flows. The authorization server itself is not automatically tunneled, so if your identity provider is unreachable from both the public internet and the tunnel-client host, the OAuth flow can still fail even when the MCP server is reachable.
Troubleshooting the common failures
Most first-run problems come from permissions or a stopped daemon, and OpenAI's guide names the specific checks. If the tunnel does not appear in ChatGPT, confirm the tunnel is associated with the target workspace and that the connector operator has Tunnels Read and Use. If connector discovery or tool calls fail, confirm that tunnel-client run is still running, then re-run tunnel-client doctor --profile <name> --explain. If an operator can inspect a tunnel but cannot edit it, they hold Tunnels Read but not Manage. Use /healthz, /readyz, /metrics and the loopback admin UI at /ui to confirm the client is healthy, ready and polling before testing from ChatGPT, Codex or an API flow; while the client is disconnected, every request through the tunnel fails until it reconnects.
How it compares to the alternatives
Secure MCP Tunnel is not the only way to let a model reach a private service. It is the right one when the caller is an OpenAI product and the server must stay private.
| Approach | Inbound exposure | Best for |
|---|---|---|
| Secure MCP Tunnel | None; outbound-only HTTPS | OpenAI products calling a private MCP server |
| Public MCP server with OAuth 2.1 | Public listener, hardened | Multi-vendor access, many clients |
| Generic tunnel (ngrok, Cloudflare Tunnel) | None, but a public URL is created | Quick demos, not MCP-aware auth |
| Reverse proxy in a DMZ | Inbound, tightly controlled | Existing gateway and WAF investment |
| Cloud private link (AWS PrivateLink) | None, provider-scoped | Same-cloud service-to-service calls |
The trade-off is vendor scope. A tunnel is tied to OpenAI's control plane, so it serves ChatGPT, Codex and the Responses API. If Claude, Gemini or your own clients also need the server, a properly authenticated public MCP server with OAuth 2.1 is the interoperable option, at the cost of running a hardened public listener. The embedded Harpoon component in tunnel-client can expose a small allowlist of internal HTTP endpoints by label with bounded requests, but it is deliberately not a general-purpose proxy: callers cannot pick arbitrary hosts.
India-specific considerations
For Indian enterprises, the outbound-only model helps on two fronts. Data residency stays simpler when the MCP server and its data never leave your on-prem or in-region environment and only responses travel out over HTTPS, which supports a data-localization posture under the Digital Personal Data Protection Act, 2023. Exposure control also lowers breach risk, and DPDP penalties reach ₹250 crore, so removing a public listener is a measurable reduction in liability. Teams building consent and data-handling around this should read our DPDP engineering playbook for Indian startups, and teams that need an MCP server built or integrated in the first place can see our MCP server development and integration work.
FAQ
What is OpenAI's Secure MCP Tunnel?
It is an outbound-only connection that lets supported OpenAI products call a private or on-premise MCP server without a public listener. An agent called tunnel-client runs inside your network, long-polls OpenAI over HTTPS, forwards each JSON-RPC request to the server, and returns the response through the same tunnel.
Which OpenAI products can use a tunnel?
Per OpenAI's guide, Secure MCP Tunnel currently supports ChatGPT, Codex and the Responses API, described as supported OpenAI surfaces. They send MCP requests to an OpenAI-hosted tunnel endpoint and receive a normal MCP request path, while the actual MCP server stays private inside your network boundary.
Do I need to open inbound firewall ports?
No. That is the point of the design. The host running tunnel-client needs only outbound HTTPS to api.openai.com on port 443, or mtls.api.openai.com when control-plane mTLS is set, plus local reachability to the MCP server. No inbound internet access and no public listener are required.
How do I set up tunnel-client for a local stdio server?
Export a runtime CONTROL_PLANE_API_KEY, then run tunnel-client init with the stdio sample profile, your tunnel-id, and an mcp-command pointing at the server binary. Run tunnel-client doctor to validate config, then tunnel-client run to start polling. Finally add a Tunnel connector in ChatGPT connector settings.
Does Secure MCP Tunnel work with Claude or Gemini?
No. The tunnel is tied to OpenAI's control plane, so it serves ChatGPT, Codex and the Responses API. If other vendors or your own clients also need the server, run a hardened public MCP server with OAuth 2.1 instead, accepting the cost of operating a secured public listener for multi-vendor access.
How does the tunnel handle OAuth for a private server?
OAuth discovery metadata can travel through the tunnel, and the tunnel preserves upstream authorization server metadata for browser-facing flows. The authorization server itself is not automatically tunneled, so if your identity provider is unreachable from both the internet and the tunnel-client host, the OAuth flow can still fail.
What is Harpoon in tunnel-client?
Harpoon is an MCP server embedded in tunnel-client that exposes a small, labeled allowlist of internal HTTP endpoints with bounded request and response limits. It lets agents reach a few private REST targets without a public URL, but it is not a general proxy: callers cannot choose arbitrary hosts or methods.
How does this help with DPDP and data residency?
Keeping the MCP server and its data on-prem or in-region, with only responses leaving over HTTPS, supports a data-localization posture under the DPDP Act, 2023. Removing a public listener also lowers breach exposure, which matters because DPDP penalties reach ₹250 crore for personal-data breaches.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, appraised at CMMI Level 5 and MSME certified, with senior-led, multi-disciplinary teams and partnerships with AWS, Microsoft and Google. We design and integrate MCP servers and connect them to enterprise AI surfaces aligned with least-privilege, mTLS and DPDP requirements, whether that means an outbound-only tunnel for OpenAI products or a hardened, OAuth 2.1 public server for multi-vendor access. If you are wiring internal systems into AI agents and want the exposure and audit story right from day one, talk to our team.
References
- Secure MCP Tunnel guide — OpenAI
- openai/tunnel-client repository and README — GitHub
- tunnel-client latest release — GitHub
- OpenAI API changelog — OpenAI
- MCP and connectors guide — OpenAI
- Top MCP security resources and CVEs, June 2026 — Adversa AI
- MCP servers on the internet: 12,520 exposed services — Censys
- Update on exposed MCP servers: the threat widens to the cloud — Trend Micro
- MCP security design considerations for AI-driven automation (PDF) — NSA
- 2025 Cost of a Data Breach report — IBM
- Average global data breach cost now $4.44 million — Help Net Security
- Platform tunnel settings — OpenAI
- DPDP Act compliance and penalties for Indian startups — Inc42
Last updated: July 26, 2026.
Top comments (0)