Reachable but never public: the clever flip behind Secure MCP Tunnel!

Hey everyone, shiichan here! Today's news made me grin a little — it's a networking trick for reaching your internal MCP servers without ever putting them on the public internet.

OpenAI Developers developers.openai.com

What was announced?

On the OpenAI developer blog, OpenAI introduced Secure MCP Tunnel. It lets enterprises connect the useful MCP servers they run inside their own networks to OpenAI-hosted AI, without standing up a public endpoint or wiring together a VPN. The post's title says it plainly: "Making private MCP servers reachable without making them public."

Why it matters

Until now, every option for exposing an internal MCP server to an outside AI was a bit heavy. A public endpoint raises security worries, a third-party tunnel provider adds another vendor, and a VPN or network peering brings architectural overhead. The more valuable your internal tool, the harder it was to connect it safely.

Dive Deep

The clever part is the direction of the connection. Normally the server accepts inbound traffic, but Secure MCP Tunnel flips it.

the private side makes the first move.

A tunnel client you run inside your own environment opens an outbound HTTPS connection toward OpenAI. When an OpenAI product wants to call an MCP tool, the request queues at an OpenAI-hosted tunnel endpoint. Your client picks it up over long-polling, forwards it to the local private MCP server, and sends the response back over that same outbound connection.

The transport is deliberately long-polling over HTTPS — "operationally boring" so enterprise firewalls let it through. Backpressure falls out naturally from the client-side queue, and streaming works too: the tunnel forwards server-sent events so intermediate results still arrive.

Auth is practical for the enterprise, supporting OAuth, private certificate authorities, client certificates, and outbound proxies — all without making the MCP server publicly reachable.

The tunnel client itself is open-source software you run inside your own boundary, so you can inspect exactly what runs there. It ships with a local admin UI for health checks and troubleshooting, plus a Codex plugin that guides setup, and the same configuration works from a developer laptop to production Kubernetes.

There's also Harpoon, which extends the same model to approved REST APIs behind the same firewall, targeting labeled destinations instead of exposing arbitrary URLs.

The boundaries stay tight: the private address is only used inside your environment, access is tied to your organization context, configuration explicitly limits which services are reachable, and no general-purpose network bridge is created.

Wrap-up

• Secure MCP Tunnel connects internal MCP servers to OpenAI products without making them public (announced on the OpenAI developer blog)
• The key idea is a reversed connection: the private side opens an outbound HTTPS link, using long-polling that's "operationally boring"
• It supports streaming relay, backpressure, and enterprise auth like OAuth and client certificates
• The tunnel client is open-source and customer-run, with an admin UI and a Codex plugin
• Harpoon extends the approach to approved REST APIs

If your team has been holding internal tools back from outside AI for security reasons, this one lands right in the center of the plate!