Comparison

TunnelGPT vs DIY MCP tunnels: which setup fits?

What are you paying for?

TunnelGPT is a paid Mac desktop app for people who want a guided way to connect selected local projects to ChatGPT. A self-managed setup may suit people who want to choose, inspect, and operate the pieces themselves. The choice is between a packaged workflow and more direct control. With a DIY tunnel, you still operate the MCP server and its access permissions.

• A guided Mac workflow for connecting selected local projects to ChatGPT.
• Separate profiles and connections for each project.
• Project file access starts in read-only mode.
• Editing and command execution have separate permissions.

Open-source projects vary: some provide installers, updates, or support, and their setup requirements differ. Compare the workflow and responsibilities of the specific project rather than assuming that every open-source option requires manual assembly or is maintenance-free.

If you use ChatGPT, model availability, account permissions, connector access, and usage limits still depend on OpenAI. TunnelGPT does not add quota or guarantee access after a Work or Codex limit.

Before choosing, check the current setup requirements and TunnelGPT pricing.

TunnelGPT is a guided desktop layer for connecting selected local projects and MCP servers to ChatGPT through OpenAI's Secure MCP Tunnel flow. A self-managed setup is a better fit when you need headless operation, repeatable deployment, infrastructure as code, or direct control over the runtime. If the MCP client and server are already on the same computer and the client can start the server locally, a direct stdio connection may be simpler than either.

These are different layers, not interchangeable products. TunnelGPT Desktop is the commercial application. TunnelGPT Core is the MIT-licensed open-source core. OpenAI Secure MCP Tunnel is the underlying OpenAI-supported tunnel flow. Cloudflare Tunnel and ngrok are general-purpose network products that can carry MCP traffic when the server and client use a compatible transport.

Choose by the operating model you need

TunnelGPT Desktop packages a guided ChatGPT workflow

TunnelGPT Desktop is designed for a person who wants to choose a local project, connect it to ChatGPT, and control what that project exposes without assembling the whole workflow by hand. Each project has its own profile and connection. The file workflow starts in read-only mode. Editing and command execution are separate permissions.

The current setup requires a ChatGPT account with access to custom connectors and Secure MCP Tunnels, permission in the relevant OpenAI organization, Docker 24 or later, a restricted credential, a tunnel identifier, and a local project directory. TunnelGPT does not create the OpenAI tunnel or credential for you. A ChatGPT subscription and third-party services are separate; Docker Desktop may be free or may require a paid subscription depending on your use and organization. Check Docker's license terms for your situation. The computer must stay awake, online, with Docker and the connection running while the project is needed.

TunnelGPT can also connect a local MCP by local HTTP address or an installed command. That MCP keeps its own permissions and data practices. Approving a local MCP in TunnelGPT does not make that MCP trustworthy or narrow permissions it already has.

TunnelGPT is independent software, not an official OpenAI application. The desktop app runs on Mac with Apple Silicon; TunnelGPT for Windows shows the current Windows status, and Linux is planned after the initial launch.

TunnelGPT Core gives you code, not a hosted product

TunnelGPT Core is the MIT-licensed open-source core behind the commercial application. The repository includes one-project file tools, path authorization, confirmed writes, MCP protocol handling, and bounded HTTP over a Unix socket.

The repository does not include the desktop interface, accounts, licenses, guided setup, remote tunnel, ChatGPT connector, or multi-project routing. It also does not supply the host's authentication, user approval, process isolation, or remote deployment. Those are responsibilities of the system you build around the core.

This makes Core a different choice from TunnelGPT Desktop. Use Core when inspecting or adapting the code is more important than receiving the product workflow. A local Unix socket is a local transport. It does not create a remote connection by itself.

OpenAI Secure MCP Tunnel is the self-managed path for supported OpenAI products

OpenAI's Secure MCP Tunnel is an outbound-only connection from a host that can reach a private MCP server. The host runs tunnel-client, which polls OpenAI for queued MCP work, forwards requests to the local MCP server, and returns responses through the same tunnel. The private MCP server does not need a public listener.

The current OpenAI documentation lists ChatGPT, Codex, the Responses API, and other supported OpenAI surfaces as possible consumers. It also documents two transport choices for the private server: a configured local stdio command or an MCP server using HTTP. For a remote MCP connection, the standard transport is Streamable HTTP. Legacy HTTP+SSE can work when the client supports it. A generic HTTP endpoint is not automatically an MCP transport. That does not mean every OpenAI client can use local stdio directly. The client process and the server process still need to be in a relationship where the client can start or reach the server.

The self-managed path gives you direct control over:

• where tunnel-client runs, such as a Kubernetes sidecar, a VM, or a system service;
• how the local MCP server starts and restarts;
• the credential and profile configuration;
• health checks, logs, updates, and incident handling;
• the tools and resources exposed by the MCP server;
• the OpenAI organization and ChatGPT workspace associations.

That control comes with the work of operating each boundary. Creating or editing a tunnel needs the documented Tunnels Read and Manage permissions. Running tunnel-client or selecting the tunnel needs Tunnels Read and Use. Adding and using a custom MCP server in ChatGPT is subject to separate workspace permissions and security restrictions.

General-purpose tunnels solve a different network problem

Cloudflare Tunnel and ngrok can connect a service behind a firewall to a provider network without requiring the origin to accept ordinary inbound connections. They are useful when the requirement is broader than the OpenAI Secure MCP Tunnel flow, such as a web endpoint, a non-OpenAI client, a remote integration, or a provider-managed access policy.

They do not automatically provide project-scoped file access, read-only defaults, per-tool approval, or an MCP server's application authorization. Those controls must come from the MCP server, the client, the provider policy, or a combination of them.

Cloudflare Tunnel

Cloudflare documents cloudflared as a lightweight daemon that creates outbound-only connections from infrastructure to the Cloudflare network. The same tunnel can carry traffic in both directions after the connection is established. The documented use cases include HTTP, SSH, remote desktops, and other protocols.

For an MCP use case, you still need an MCP server that exposes a compatible MCP endpoint, normally Streamable HTTP. A Cloudflare network connector does not make a local stdio process remotely launchable. The routing, authentication, access policy, and origin permissions remain your design work.

ngrok

ngrok's MCP guide is explicit about the remote transport boundary. A remote AI application cannot start a stdio server on your machine. The MCP server must expose Streamable HTTP. A client that supports the legacy transport may use HTTP+SSE, or you can add a stdio-to-HTTP bridge. A generic HTTP endpoint alone is not an MCP transport.

ngrok can put a public HTTPS URL in front of the MCP server and apply traffic policy. Its documentation recommends authentication before exposing tools and distinguishes a bearer token, a secret path, and OAuth depending on what the client can send. A secret path is a shared secret, not a user identity. Use it for testing only, never with production data, and rotate it if it leaks. Use OAuth when compatible for real users and real data. ChatGPT connectors that cannot add a custom bearer header need a compatible URL-based approach such as a secret path for testing or OAuth for real users.

The public endpoint model is powerful, but it changes the boundary. Requests and responses pass through the provider's network, and the endpoint policy must prevent unauthorized tool calls. A public URL is not a substitute for least-privilege MCP tools.

Local stdio is often the smallest connection

Use a direct local connection when the MCP client and the MCP server run on the same computer, the client can start the server process, and you do not need another machine or a remote product to reach it. This avoids a tunnel and removes one operational layer.

Use a tunnel when a supported remote product needs to reach a private server or when the server lives behind a network boundary. A client that cannot start a local stdio process may still reach an accessible MCP endpoint directly over Streamable HTTP. The inability to launch stdio alone does not require a tunnel. When a tunnel is needed, choose it by the product and transport requirements:

• Choose TunnelGPT Desktop for a guided ChatGPT workflow around selected local projects on a supported Mac.
• Choose OpenAI Secure MCP Tunnel when you want to operate the OpenAI flow directly from a host or service.
• Choose Cloudflare Tunnel when you need a general network connector for services and will design the MCP HTTP and access layers yourself.
• Choose ngrok when a public HTTPS endpoint, traffic policy, and inspection are useful for an HTTP MCP service.
• Choose TunnelGPT Core when you want the open-source local core and are prepared to build the surrounding host and integration.

The security boundary is the whole system

No option is secure merely because it is called a tunnel. Evaluate the MCP server tools, filesystem roots, credentials, process privileges, authentication, network policy, logs, and update path together.

TunnelGPT's file workflow starts with one selected project in read-only mode. Its file service and connector are separate local components, and requested tool results travel to OpenAI so ChatGPT can answer. The original project files stay on the computer, and the content does not pass through TunnelGPT's commercial servers during normal operation. These statements do not apply unchanged to every command, native Mac job, or external local MCP. Those components have their own permissions and data practices.

What you can inspect without trusting a black box

Choosing the guided app does not mean giving up visibility. The parts that carry your data are inspectable, and the controls stay with you:

• The connector is OpenAI's own open-source tunnel-client (Apache-2.0), the same component the self-managed path uses.
• The core file-access engine, with path scoping, deny rules and confirmed-write primitives, is open source under MIT in TunnelGPT MCP Core.
• Project files start read-only, and every write is previewed and needs your confirmation.
• For each local MCP, you choose which tools ChatGPT can use, and an activity log shows each call's tool, status, time and duration.
• Local diagnostics are readable files on your Mac, and you can stop one connection or all of them at any time.
• Project content, prompts, tool calls, results and keys never reach TunnelGPT's servers. The privacy page lists every request the app sends to TunnelGPT.

What the self-managed path still gives you is ownership of where and how the connector runs: service supervision, restart policy, your own logging pipeline and deployment outside a Mac desktop.

With OpenAI Secure MCP Tunnel, the private MCP server stays inside the environment you control, while the OpenAI product receives the MCP responses needed for the interaction. With Cloudflare or ngrok, traffic crosses the provider network as part of the service design. Review each provider's current terms, logging controls, authentication options, and data handling before connecting sensitive tools.

Costs include published prices and unpriced work

Published prices are only one part of the decision:

• TunnelGPT Desktop: $9.97 USD as a one-time payment for a version 1 Perpetual License, with a three-day trial lasting 72 consecutive hours from the first successful connection, including disconnected time. A ChatGPT subscription and third-party services are separate; Docker Desktop may be free or may require a paid subscription depending on your use and organization. Future major versions are not included.
• TunnelGPT Core: MIT-licensed code with no application license price in the repository. Hosting, integration, authentication, supervision, maintenance, and support remain your responsibility.
• OpenAI Secure MCP Tunnel: The reviewed OpenAI documentation describes credentials, permissions, limits, and supported flows, but does not state a standalone tunnel price. Account, product, and usage terms should be checked for the OpenAI surface you use.
• Cloudflare Tunnel: The reviewed Tunnel documentation explains the connector and its network model, but does not state a Tunnel-specific total price. Account plans, services, hosting, domains, and operational requirements can change the total.
• ngrok: Checked 22 October 2026, the public pricing page lists a Free plan at $0 USD, Hobbyist at $10 USD per month, and Pay-as-you-go at $20 USD per month plus additional usage. It also lists plan limits and paid features. Check the pricing page before budgeting.

DIY also has an operational cost that vendor pricing pages cannot calculate for your environment. Someone must choose least-privilege tools, keep credentials out of responses and logs, supervise processes, rotate secrets, patch the runtime, monitor failures, and decide what happens when the computer or service is offline.

The practical decision

Choose the smallest connection that meets the actual requirement. A local stdio connection is usually the cleanest starting point when everything runs together. TunnelGPT Desktop is the guided choice for a supported Mac and a project-by-project ChatGPT workflow. OpenAI Secure MCP Tunnel is the direct operating choice when you need headless deployment and control over the runtime. Cloudflare Tunnel and ngrok make sense when the requirement is a general network endpoint or a client outside the OpenAI flow. TunnelGPT Core is the code-level choice when you want to build the surrounding system yourself.

Sources

• TunnelGPT product page, project boundaries, permissions, platform availability, pricing, and data path.
• TunnelGPT setup guide, prerequisites, roles, credential handling, project setup, and local MCP connection.
• TunnelGPT privacy page, local execution and the distinction between OpenAI's data path and TunnelGPT's commercial servers.
• TunnelGPT Core on GitHub, MIT scope and what the open-source core does not include.
• OpenAI Secure MCP Tunnel documentation, supported surfaces, local transports, permissions, network requirements, and limits.
• MCP transport specification, stdio, Streamable HTTP, and legacy HTTP+SSE compatibility.
• Cloudflare Tunnel documentation, outbound connector model and supported protocol examples.
• ngrok MCP Gateway documentation, MCP transports, authentication, public endpoint model, and ChatGPT compatibility considerations.
• Docker Desktop license agreement, when Docker Desktop is free and when commercial use requires a paid subscription.
• ngrok pricing, current public plan prices and usage limits.