21tunnel

21tunnel is an open-source tunneling service built for the age of AI coding agents. AI assistants like Claude Code, Cursor, Aider, and Devin increasingly need public URLs for the work they produce on your localhost: webhook endpoints, preview links for teammates, MCP servers. The common workaround — pasting a full-access API token into the agent's environment — hands an autonomous system unlimited, unexpired access to your account. If that token leaks through a log, a transcript export, or a prompt-injection attack, everything it can do is exposed. 21tunnel replaces that with the delegation pattern Stripe and AWS proved for service accounts. You mint a single master key that is deliberately incapable of opening tunnels. The agent uses it to mint its own child keys: scoped to one project namespace with subdomain isolation, time-limited (minutes to hours), and recorded in an audit log. The agent works fully autonomously, never touches a credential worth stealing, and if anything ever looks wrong, one click cascade-revokes the master key, every child key it minted, and every tunnel they opened. Beyond the AI-agent workflow, 21tunnel is a complete, modern ngrok alternative: - HTTP, TCP, SSH, and gRPC tunnels from a single static Rust binary for Linux, macOS, and Windows - Sticky subdomains that persist across agent restarts, plus reserved named subdomains - Bring-your-own custom domains with real TXT-record verification, included on the free tier - Edge auth: gate any tunnel behind Google sign-in with email or domain allowlists - Live request inspector streaming every inbound request, headers and body, to the dashboard - Teams with owner, admin, member, and viewer roles, plus a partitioned, queryable audit log - REST API with an OpenAPI spec for wiring into deploy scripts and CI runners - Multi-tunnel orchestration from a single mytunnel.toml file The entire stack — agent, server, and dashboard — is open-source under MIT and Apache-2.0 and self-hostable free forever. Security features like MFA, RBAC, and the audit log ship on every tier, including the free Hobby plan: you pay for scale, never for security. Who it is for: developers building with AI coding agents, indie developers and teams who need stable public URLs for webhook testing and demos, and self-hosters who want a tunneling stack they fully control. Common use cases: testing Stripe and GitHub webhooks locally, sharing work-in-progress with clients behind a sign-in gate, exposing MCP servers to hosted AI tools, and giving AI assistants safe, revocable infrastructure access.