Your Internal Tools, Claude's Reach: Private-Network MCP via Anthropic Tunnels

MCP tunnels (research preview) give Claude Agents access to MCP servers inside your private network via an outbound-only connection — no public endpoints, no inbound firewall rules, no VPN required.

If you're building Claude agents that need access to internal tooling — a private GitHub Enterprise instance, an internal Jira, a database behind a VPN, a proprietary REST API — you've had to either expose it publicly or build a custom proxy. MCP tunnels close that gap.

How it works

Two components run inside your network:

• cloudflared (Cloudflare's open-source connector) opens a single outbound connection to the tunnel edge — no inbound ports, no IP allowlisting needed
• Anthropic's routing proxy terminates inner TLS and routes each request to the correct upstream MCP server by hostname

Anthropic's infrastructure only reaches your network through the tunnel your team controls. Three independent TLS layers protect every request; Cloudflare cannot read payload content because your proxy holds the inner certificate.

Getting started (requires access request)

Step 1 — Request access: claude.com/form/claude-managed-agents

Step 2 — Create a tunnel in the Claude Console (Settings → MCP Tunnels → New Tunnel).

Step 3 — Deploy the stack on a VM (Docker Compose) or Kubernetes (Helm):

# Docker Compose quickstart — fill in TUNNEL_TOKEN and cert from Console
docker compose up -d

Each upstream MCP server you expose gets a subdomain under your tunnel domain (e.g. docs.your-tunnel.anthropic-tunnels.com).

Step 4 — Attach to a session: in the Console (Managed Agents → Sessions → + MCP Server → select your tunnel), or call it from the Messages API:

response = client.beta.messages.create(
    model="claude-opus-5",
    max_tokens=1000,
    messages=[{"role": "user", "content": "Pull the latest sprint tickets."}],
    mcp_servers=[{
        "type": "url",
        "url": "https://jira.YOUR_TUNNEL_DOMAIN/mcp",
        "name": "jira",
    }],
    tools=[{"type": "mcp_toolset", "mcp_server_name": "jira"}],
    betas=["mcp-client-2025-11-20"],
)

The tunnel URL is just your private MCP server's assigned hostname — no changes to the server itself.

What to watch for

• Access is gated — the tunnel won't work until your request is approved; plan for lead time
• Research preview terms — no uptime SLA; Cloudflare is the transport layer
• MCP server auth is separate — the tunnel carries traffic but doesn't authenticate to your server; add authorization_token in the mcp_servers block for that

Sources: MCP tunnels overview — platform.claude.com, Request access form, The New Stack coverage