AI Agents Take the Wheel: MCP Servers and Tunnel Automation in 2026
IT
Quick answer
AI Agent Tunnel Automation: MCP Servers, Pinggy, Claude Code: quick comparison answer
Choose the tunnel tool based on the network model: public HTTPS URLs for webhooks and demos, private mesh access for internal apps, and managed infrastructure when policy controls matter most.
Which tunnel tool is best for public webhook testing?
Use a public HTTPS localhost tunnel with stable URLs. InstaTunnel focuses on webhook testing, demos, OAuth callbacks, and MCP endpoint workflows.
When should I choose a private network tool instead?
Choose a private mesh or Zero Trust tool when every user and service should stay inside a controlled private network.
Developers no longer just use AI to autocomplete boilerplate or generate regex. In 2026, many hand complete terminal and environment access to AI coding assistants, and those assistants can execute commands, read the filesystem, and configure networking on their own. One of the clearest examples is local network exposure: sharing a dev server or wiring up a webhook used to mean leaving the editor, running a CLI command by hand, and pasting a temporary URL into a third-party dashboard. Today, some tunneling providers ship a dedicated Model Context Protocol (MCP) server and an “Agent Skill” that let an AI assistant do that work itself, from a plain-language prompt.
This piece walks through how MCP tunneling actually works today, what Claude Code and Cursor can and can’t do with it, and — since the underlying protocol just went through its biggest revision to date — what’s changed in how agents are allowed to touch your network.
1. The Model Context Protocol: a shared connector for AI tools
To understand agent-driven tunneling, start with the protocol that makes it possible.
Anthropic open-sourced the Model Context Protocol on November 25, 2024, as a standard way for AI assistants to connect to external tools and data sources. The problem it targeted is sometimes called the “M×N problem”: without a shared protocol, connecting M different AI applications to N different tools requires roughly M×N custom integrations. MCP collapses that to M+N — each side implements the protocol once.
The architecture has three parts:
- Host — the AI application itself (Claude Code, Cursor, Claude Desktop, Windsurf, and now ChatGPT and Copilot support it too).
- Client — the protocol connection the host maintains with a given server.
- Server — a local or remote process that exposes a specific set of tools, resources, or prompts over that connection.
Adoption moved faster than most open standards do. Microsoft and GitHub joined MCP’s steering committee at Build 2025, and OpenAI added MCP support to its Agents SDK and Responses API the same year. By December 2025, Anthropic had donated MCP to the newly formed Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with OpenAI and Block, with Google, Microsoft, AWS, Cloudflare, and Bloomberg as platinum members. At the time of the donation, Anthropic cited more than 10,000 active public MCP servers and adoption across ChatGPT, Cursor, Gemini, Copilot, and VS Code.
The protocol itself has kept moving. The most recent revision, 2026-07-28, shipped on schedule and is the largest change since launch: it removes the old session-handshake model in favor of a stateless core that’s easier to run behind a load balancer, promotes MCP Apps (server-rendered UI) and a Tasks extension to first-class status, and tightens authorization around OAuth 2.1-style flows. Across the Python and TypeScript SDKs combined, MCP now sees on the order of half a billion downloads a month. None of this changes how a tunneling MCP server feels to use, but it’s worth knowing the ground has shifted if you’re building or auditing one — session-based assumptions from a 2025 tutorial may no longer hold.
2. Pinggy’s Agent Skill and MCP server
Pinggy — the SSH-based tunneling service — is one of the tools that has leaned into this. It ships two separate, independently installable pieces of agent tooling.
The Agent Skill is a packaged set of instructions (SSH flags, CLI usage, SDK examples) that an agent reads and then executes itself with ordinary terminal access. It installs with npx skills add https://pinggy.io and writes into the client’s skills directory — ~/.claude/skills/pinggy/ for Claude Code, for example.
The MCP server goes further: instead of the agent reconstructing an SSH command from documentation, it calls a tool directly and gets back a running tunnel. This is what actually corresponds to “expose my dev server on port 3000” turning into a public URL with no manual command.
A few things are worth getting right that a lot of write-ups gloss over:
- The MCP server,
pinggy_mcp, is a Python package, not an npm package. It requires Python 3.10+ anduv. - It is explicitly labeled experimental in its own README — “shared for early feedback, expect rough edges” — which matters if you’re deciding whether to wire it into something you depend on.
- You don’t install it ahead of time in the usual sense. Your MCP client runs
uvx, which fetches and runspinggy-mcpon demand.
The real setup for Claude Code is:
claude mcp add pinggy-mcp -- uvx --from git+https://github.com/abhimp/pinggy_mcp.git pinggy-mcp
claude mcp list # verify it registered
For Cursor, Windsurf, or Claude Desktop, the equivalent is a JSON block in the client’s MCP config (~/.cursor/mcp.json for Cursor, ~/.codeium/windsurf/mcp_config.json for Windsurf):
{
"mcpServers": {
"pinggy-mcp": {
"command": "uvx",
"args": ["--from", "git+https://github.com/abhimp/pinggy_mcp.git", "pinggy-mcp"]
}
}
}
Once it’s registered, the server exposes thirteen tools across four groups: authentication (authenticate, check_authentication, get_profile, logout — driven by an OAuth 2.0 device-flow login, no token copy-pasting), tunnels (start_tunnel, stop_tunnel, list_tunnels, get_tunnel_info, covering HTTP/TCP/TLS/UDP with optional IP allow-listing and the web debugger), file sharing (share_directory exposes a local folder over WebDAV through a Pinggy URL — “share my ~/Downloads folder” is one of the project’s own example prompts), and token management for saved per-app tokens. You typically never call these tools by name; the agent picks them based on what you ask in plain language.
One practical detail: tunnels live inside the MCP server’s process, so if your AI client restarts, the server restarts too, and any running tunnels die with it. If a tunnel needs to survive a Claude Code restart, that’s a manual re-start, not something the agent handles for you automatically today.
3. Claude Code and localhost exposure
Claude Code — Anthropic’s terminal-native coding agent — runs directly in the shell, which makes it a natural fit for this kind of environment automation. Point it at a repo and ask it to expose a port, and it can read your package.json or .env, start the dev server, call the tunneling MCP tool, and hand you back both the URL and a summary of what it found — all without you leaving the terminal.
Permissions have changed meaningfully since this kind of workflow first appeared. Claude Code supports several permission modes; the one that matters here is full bypass, invoked with --dangerously-skip-permissions or the equivalent --permission-mode bypassPermissions. It skips interactive approval for file edits, bash commands, and MCP tool calls for the session — Anthropic’s own docs describe it as intended only for isolated environments (containers, VMs, sandboxes without internet access) where a compromised action can’t reach anything that matters, and the CLI shows a one-time warning dialog you have to accept before it will run. As of August 14, 2026, Anthropic made a middle-ground “auto mode” the default permission behavior for Pro, Max, and Team plans, rather than manual approval — the company’s own testing found a classifier catches the large majority of a planted dangerous command where human reviewers catch relatively few, which is part of the reasoning for shifting the default. If you set up Claude Code for tunneling before that date, it’s worth checking which mode you’re actually running in now.
The practical takeaway for exposing localhost specifically: MCP scoping — the fact that a server only exposes the specific tools it was built for — narrows what the agent can call, but it is not on its own a security boundary against a compromised session or a malicious prompt reaching the agent through, say, a webpage it just fetched through your new tunnel. Sandboxing and network isolation are what actually contain that risk, not the tool list.
4. Cursor and webhook testing
Cursor’s autonomous coding surface is now called Agent Mode rather than Composer — Composer still exists as the multi-file editing interface, but the long-running, terminal-driving, self-correcting loop is Agent Mode, and it’s what actually chains MCP tool calls together. (Cursor also caps how many MCP tools can be active in a single agent session — currently around 40 — which is a real constraint if you’re running several MCP servers alongside a tunneling one.)
A realistic version of the webhook workflow looks like this: you ask Cursor’s agent to write a Stripe webhook handler, expose it, and test it. The agent can write the route, start your dev server, and call a tunneling MCP tool to get a public URL — that part is solid and works today. Where it gets more nuanced is the “configure Stripe automatically” step. Stripe does publish an official hosted MCP server at mcp.stripe.com with tools for reading account data, searching docs, and a generic stripe_api_write/execute escape hatch that can reach webhook-endpoint creation — but first-class, purpose-built tools for registering a webhook endpoint aren’t part of the core toolset the way customer, payment, and refund operations are. In practice, an agent can usually get there through the generic API tool, but it’s closer to “the agent writes and runs the equivalent API call” than “a dedicated one-word tool for it.” The Stripe CLI’s own stripe listen --forward-to remains the more predictable path for local webhook testing if you want something that just works without depending on generic tool-calling.
5. Setting it up
Claude Code:
claude mcp add pinggy-mcp -- uvx --from git+https://github.com/abhimp/pinggy_mcp.git pinggy-mcp
claude mcp list
Cursor — edit ~/.cursor/mcp.json (global) or .cursor/mcp.json in the project root:
{
"mcpServers": {
"pinggy-mcp": {
"command": "uvx",
"args": ["--from", "git+https://github.com/abhimp/pinggy_mcp.git", "pinggy-mcp"]
}
}
}
Restart the client after saving either config. From then on, a prompt like “expose port 3000 and give me the URL” is enough to trigger the tool call — no separate terminal pane, no copy-paste.
6. What actually keeps this safe
Handing an agent the ability to open a public tunnel is a real permission grant, and 2026’s security research on MCP is more sobered than the “just connect it” tone of a year ago. A few points worth building into any setup, not just Pinggy’s:
- Prompt injection is the live threat, not a hypothetical one. OWASP ranks it as the top LLM vulnerability, and MCP specifically multiplies where it can happen — a malicious instruction hidden in a webpage, ticket, or file your agent reads can trigger real tool calls, including ones involving your tunnel. Treat anything the agent fetched through a public tunnel as untrusted input to that session.
- Scope the ports and services deliberately. Don’t let an agent expose a database port or anything with production credentials just because it technically can; keep tunneling scoped to specific, disposable dev ports.
- Keep tunnels ephemeral. Because the MCP server manages the tunnel as a child process, you can explicitly ask the agent to tear it down once a test passes, and it’s worth building that into your prompts as a habit rather than relying on the process dying when the client restarts.
- Only install MCP servers whose source you’ve actually checked, especially ones still labeled experimental — the registry package doesn’t always match the GitHub source, and unverified provenance has been the root cause of real supply-chain incidents in 2026.
- Prefer bypass-permission modes only inside sandboxes. Anthropic’s own guidance for
--dangerously-skip-permissions/bypassPermissionsis containers or VMs without production access — not a developer laptop with SSH keys and cloud credentials sitting nearby.
7. Where this is headed
The MCP ecosystem’s own numbers make the trend hard to argue with: from a standing start in November 2024 to Anthropic citing over 10,000 active public servers and roughly half a billion combined SDK downloads a month by mid-2026, plus a hand-off to neutral, multi-vendor governance under the Linux Foundation. Tunneling is a small but concrete slice of that: it’s the piece of local development that, by definition, has to cross the boundary between your machine and the internet, so it’s one of the first places “let the agent handle it” gets tested against “should the agent be allowed to do that unsupervised.” For now, the honest state of the art is: yes, an agent can open a tunnel and hand you a URL in one sentence — and yes, that convenience is exactly why the permission model around it deserves more attention than it usually gets.
Changelog
Corrections to the original draft:
- MCP launch date — original text was correct (Nov 25, 2024) but the “adopted across the industry by 2026” claim had no specifics; added the Build 2025 steering-committee detail and OpenAI’s Agents SDK/Responses API support to substantiate it.
- Pinggy MCP install commands were fabricated. The draft’s
claude mcp add pinggy npx -y pinggy-mcpand Cursor JSON usingnpx -y pinggy-mcpdo not match the real package. The actual MCP server (pinggy_mcp) is a Python package requiring Python 3.10+ anduv, run viauvxpointing at its GitHub source, and is explicitly labeled experimental by its maintainers. Replaced with the verified install commands for Claude Code and Cursor from the project’s own README. - Pinggy tool count/behavior was invented. Added the real tool inventory (13 tools across authentication, tunnels, file sharing, token management) and the OAuth2 device-flow login model, sourced from the project README, since the original draft’s description was generic and unverifiable.
- “Bypassing permissions safely” section was vague and slightly out of date. Replaced with the actual flag names (
--dangerously-skip-permissions/--permission-mode bypassPermissions), Anthropic’s documented guidance to use it only in isolated/sandboxed environments, and the August 14, 2026 change making “auto mode” the new default permission behavior for Pro/Max/Team plans — a change that postdates most existing write-ups on this topic. - Overstated security claim removed. The original claimed MCP structure alone “prevents rogue background data exfiltration.” Corrected to reflect the current security consensus: MCP tool scoping narrows what an agent can call, but is not itself a security boundary against prompt injection or a compromised session — sandboxing and network isolation are what actually contain that risk.
- Cursor’s “Composer or Agent mode” was ambiguous/outdated. Cursor now distinguishes Composer (multi-file editing UI) from Agent Mode (the autonomous, terminal-driving loop); corrected the terminology and added the ~40-tool MCP session cap, a real practical constraint not in the original.
- Stripe webhook auto-configuration was overstated. The original implied a smooth “AI configures Stripe’s webhook dashboard” step. Corrected to reflect that Stripe’s official MCP server has first-class tools for account/payment/refund data but reaches webhook-endpoint creation only through a generic API-execute tool, not a dedicated one — a real but more fragile path than the draft implied.
Related InstaTunnel pages
Continue from this article into the most relevant product guides and workflows.
Comments
Post a Comment