Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

tunnel-client MCP server

by openai/tunnel-clientApache-2.0 licenceAudited 23 Oct 2026 · source ea9e397e0096

npm @openai/tunnel-client-mcp-tunnel-proxystdiostreamable-http★ 594
!CAUTIONGrade F · 57/100 · 23 Oct 2026 · ea9e397
594GitHub stars
InstallView source on GitHub ↗

Is it safe? With care — CAUTION, grade F (57/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 32 findings (0 critical, 0 high, 10 medium, 20 low). Maintainer's description: Customer-run client for Secure MCP Tunnel: connect private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit without exposing them to the public internet.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “tunnel-client MCP server (openai/tunnel-client)”. Retrieved 23 Oct 2026. https://modelsatlas.com/mcp/openai/tunnel-client

Trust audit

Audit 0.4.1 · full source read 23 Oct 2026

Trust score57/100!CAUTION F
0 critical0 high10 medium20 low2 info

32 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared4 observations
  • NetworkDeclared8 observations
  • ShellDeclared3 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

LayerWhat we checkResult
L0 ProvenanceRepo owner, licence, archive status, activityPASS
L1 Static sourceSecrets, path traversal, supply chainWARN 25 findings
L2 InstructionsPrompt injection and authority framing in docs and tool descriptionsPASS
L3 InventoryDeclared tools match the sourcePASS
L4 SandboxRun in isolation and watch behaviourSKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

  • Repository owner openaiOrganizationAccount type recorded when we read the repository.
  • PackagePublished on npm@openai/tunnel-client-mcp-tunnel-proxy, no version recorded
  • LicenceApache-2.0From the repository, as read at the audited commit.
  • Last pushTodayActivity of the repository when we read it.
  • Source commit readea9e397e0096The audit covers exactly this commit, read on 23 Oct 2026.

Runtime

  • Sandbox runNot run yetThis audit read the source only; it did not execute the server.
  • Tool inventory2 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (32)

Sorted by severity · the 25 most severe of 32 are listed

MEDIUMNetwork egressnet.raw_ip · adminui/vite.config.ts:4
F-04 Network egressCWE-200 · CWE-319Layer L1
const adminProxyTarget = process.env.ADMIN_UI_PROXY_TARGET ?? "http://127.0.0.1:8080";
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · pkg/controlplane/internal/testdata/routing_sequences.json:440
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"response": {"status": 409, "headers": {"X-Tunnel-Shard-Token": ["xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · cmd/client/main_test.go:363
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · pkg/adminui/log_export_test.go:563
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · pkg/adminui/log_export_test.go:576
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · pkg/cloudflared/runtime/supervisor_test.go:140
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · pkg/controlplane/internal/routing_test.go:506
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.private_key · e2e/testdata/test_server_key.pem:2
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.private_key · plugins/tunnel-mcp/mcp/server.test.cjs:600
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.private_key · plugins/tunnel-mcp/mcp/server.test.cjs:931
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · scripts/augment_sbom_files.sh:88
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
sha1 = hashlib.sha1()
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.credential_store · plugins/tunnel-mcp/mcp/server.test.cjs:211
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
mcp_command: "AWS_SHARED_CREDENTIALS_FILE=/home/me/.aws/credentials node server.js",
Why
touches a credential store
Fix
—
LOWFilesystem / pathfs.credential_store · plugins/tunnel-mcp/mcp/server.test.cjs:1467
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
credentials_path: "/home/me/.aws/credentials",
Why
touches a credential store
Fix
—
LOWFilesystem / pathfs.traversal · adminui/src/components/__tests__/App.test.ts:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import App from "../../App.svelte";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · adminui/src/components/__tests__/App.test.ts:5
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { jsonResponse, mockFetchRequest, textResponse, type MockFetchRequest } from "../../test/mockFetch";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · adminui/src/components/__tests__/CodexPanel.test.ts:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { jsonResponse, mockFetchRequest } from "../../test/mockFetch";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · adminui/src/components/__tests__/HarpoonPanel.test.ts:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { jsonResponse, mockFetch } from "../../test/mockFetch";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · adminui/src/components/__tests__/LogsPanel.test.ts:5
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { jsonResponse, mockFetchRequest } from "../../test/mockFetch";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.metadata_ip · pkg/mcpclient/channel_transport_factory_test.go:619
F-04 Network egressCWE-200 · CWE-319Layer L1
w.Header().Set("Location", "http://169.254.169.254/latest/meta-data")
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · pkg/mcpclient/channel_transport_factory_test.go:668
F-04 Network egressCWE-200 · CWE-319Layer L1
{name: "link local metadata destination", left: "https://mcp.example.test/mcp", right: "http://169.254.169.254/latest/meta-data", want: false},
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · pkg/oauth/discovery_origin_test.go:95
F-04 Network egressCWE-200 · CWE-319Layer L1
{"https://mcp.example", "http://169.254.169.254/latest/meta-data"},
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · pkg/oauth/discovery_origin_test.go:154
F-04 Network egressCWE-200 · CWE-319Layer L1
req.URL.Host = "169.254.169.254"
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · pkg/runtimeharpoon/host_registration_compat_test.go:434
F-04 Network egressCWE-200 · CWE-319Layer L1
host:       "169.254.169.254",
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.raw_ip · adminui/README.md:15
F-04 Network egressCWE-200 · CWE-319Layer L1
Open the URL printed by Vite (usually `http://127.0.0.1:5173`).
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · adminui/README.md:19
F-04 Network egressCWE-200 · CWE-319Layer L1
- default: `http://127.0.0.1:8080`
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

2 declared in source · 0 destructive

2 read0 write0 destructive
ToolRiskWhat it does
descriptionreadInventory resource identifier
echoreadcalls.append(name)

Install

audited commit ea9e397

Read the findings first. The most severe is Network egress (medium) at adminui/vite.config.ts.

Add to CursorAdd to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit ea9e397 only.

claude mcp add tunnel-client-mcp-tunnel-proxy -- npx -y @openai/tunnel-client-mcp-tunnel-proxy

The command does not pin a version; the audit covers commit ea9e397e0096. Transport: stdio · streamable-http. No environment variables required.

Audit history

  1. !CAUTION F 57 / 100

    First audit · ea9e397e0096

README badge

For maintainers · updates on every re-audit

ModelsAtlas: CAUTION FMODELSATLASCAUTION · F 
[![ModelsAtlas: CAUTION F](https://modelsatlas.com/mcp/openai/tunnel-client/badge.svg)](https://modelsatlas.com/mcp/openai/tunnel-client/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about tunnel-client MCP server

What is the tunnel-client MCP server?
Customer-run client for Secure MCP Tunnel: connect private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit without exposing them to the public internet.
What tools does tunnel-client expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is tunnel-client safe to connect to an agent?
With care. The audit graded it F (57/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does tunnel-client need?
No credential environment variables were found in its source, so it appears to need none.
How does tunnel-client run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @openai/tunnel-client-mcp-tunnel-proxy.
How current is this page?
The grade is for one exact copy of the source (ea9e397e0096), read on 2026-10-23. The repository is watched and re-audited when it changes.

Sources

  • openai/tunnel-client on GitHub — the source we read, its licence, stars and activityObserved · 23 Oct 2026
  • ModelsAtlas trust audit — CAUTION verdict for commit ea9e397e0096Observed · 23 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.