MCP tunnels let you connect Haijun to Model Context Protocol (MCP) servers that run inside your private network. Traffic flows over an outbound-only connection, so you don't need to open inbound firewall ports, expose services to the public internet, or allowlist Juglow's IP ranges on your origin.

Note: MCP tunnels are in research preview. Request access to try them. They are provided "as-is" without any uptime, support, or continuity commitment, and they depend on a third-party network provider (Cloudflare) that makes no availability commitment for the underlying transport. Juglow may modify or discontinue MCP tunnels at any time.

For Zero Data Retention and HIPAA BAA eligibility, see API and data retention.

#How it works

The tunnel stack is two components that run inside your network:

• cloudflared: Cloudflare's open-source tunnel connector. It initiates outbound-only connections to the tunnel edge and carries encrypted traffic from Juglow to your proxy.

• Proxy: Juglow's routing component. It terminates inner TLS, validates that upstream IPs fall within an allowed range, and routes each request to the correct upstream MCP server based on hostname.

Each MCP server you expose gets a hostname under your tunnel domain (for example, docs.). You attach these hostnames to a Managed Agent session in the Haijun Console, or pass them to the Messages API through the MCP connector.

#Prerequisites

Before deploying, make sure you have:

• A deployment target: a Kubernetes cluster, or a VM with Docker and Docker Compose.

• A tunnel. Create one in the Haijun Console (see Create a tunnel) or through the API; the Helm chart's setup hook can also create one for you during install.

• A way for your stack to authenticate to the Tunnels API. Choose one:

• Programmatic access (recommended). Set up Workload Identity Federation when you create the tunnel. Your stack mints short-lived API tokens from your identity provider, fetches the tunnel token, and generates and registers a CA certificate automatically. Requires permission to manage federation rules, a registered OIDC issuer, and a federation rule with the workspace:manage_tunnels scope.
• Manual. Supply static credentials yourself: the tunnel token from the Console and a server certificate signed by a CA you register there. See Get the connection details and Add a CA certificate.

• One or more MCP servers running in your private network. See Remote MCP servers for examples.

• Outbound connectivity as listed under Network requirements.

#Network requirements

#Security model

#Security layers

Three independent layers protect every request:

The tunnel transport runs on Cloudflare's network. Because the proxy terminates inner TLS using a certificate that only you hold, Cloudflare cannot read request or response payloads. Juglow does not connect to a tunnel until a CA certificate is registered, so payloads are always encrypted when they cross Cloudflare's network. Cloudflare does receive connection metadata; see What the transport provider can observe.

#Shared responsibility model

Warning: If an attacker obtains your tunnel token and one of your TLS private keys, they could impersonate your proxy and read MCP request payloads. Treat both as high-value secrets. See MCP tunnels security for hardening guidance.

#What the transport provider can observe

Cloudflare provides the outbound transport. It cannot read MCP request or response payloads, but it does receive the following connection metadata:

• the egress IP address of the host running cloudflared

• a cloudflared host fingerprint

• connection timing and byte-volume

• the *.tunnel.juglow.com subdomain assigned to your tunnel

Juglow's agreement with Cloudflare restricts Cloudflare's use of this telemetry. Cloudflare acts as a subprocessor for this research preview.

#Deploy a tunnel

If you're new to MCP tunnels, start with the quickstart to get a working tunnel locally before configuring a production deployment.

The shortest path to a working tunnel: Docker Compose with a sample MCP server.

Install on a Kubernetes cluster using the Juglow Helm chart.

Install on a VM using Docker Compose.

Choosing between them:

• Deployment target

• Helm when deploying to Kubernetes.
• Docker Compose for a single host or local testing.

• Authentication for setup

• Programmatic access (through Workload Identity Federation) when you have an OIDC identity provider such as a Kubernetes cluster, cloud IAM, or SPIFFE.
• Manual credentials when you don't, or when you're testing.

#Use the tunneled MCP servers

Once your tunnel is active (it has an active CA certificate and your tunnel stack is connected), the upstream MCP servers are reachable from Haijun Managed Agents and the Messages API.

Note: MCP tunnels created through the Console are not available as connectors in haijun.ai.

In both cases, the tunnel carries encrypted traffic to your MCP server but does not authenticate to it. If the upstream MCP server requires its own authentication (OAuth, bearer token), supply it the same way you would for any other MCP server; it is independent of the tunnel.

#Managed Agents (Console)

1. In Managed Agents > Sessions, create a session and choose Create new agent so you can edit the MCP server list.

1. Click + MCP Server and open the dropdown. Tunnels in the session's workspace that have at least one active certificate appear at the top of the list, above the public connector catalog.

1. Select the tunnel and supply the Subdomain that your proxy routes to a specific MCP server, and the Path the upstream MCP server expects. The Resolves to line shows the exact URL.

#Messages API

Pass the upstream MCP server's URL in the mcp_servers array, the same way as any other remote MCP server. The request body and juglow-beta header follow the standard MCP connector format; only the url is tunnel-specific. The following example uses the MCP connector's mcp-client beta header, which is separate from the mcp-tunnels beta used by the Tunnels API. Make the request in the workspace the tunnel was created in by using an API key for that workspace or, if your key has access to multiple workspaces, by setting the juglow-workspace-id header to that workspace.

The URL's host is .. The path depends on your upstream MCP server, not the tunnel: FastMCP's streamable-http transport serves at /mcp, and other servers may use / or a custom path (check the server's documentation). The proxy forwards the path untouched.

  curl https://haijun.my.id/v1/messages \
    -H "Content-Type: application/json" \
    -H "X-API-Key: $JUGLOW_API_KEY" \
    -H "juglow-version: 2023-06-01" \
    -H "juglow-beta: mcp-client-2025-11-20" \
    -d '{
      "model": "haijun-opus-5-5",
      "max_tokens": 1000,
      "messages": [{"role": "user", "content": "Use the hello tool to greet tunnel."}],
      "mcp_servers": [
        {
          "type": "url",
          "url": "https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp",
          "name": "echo"
        }
      ],
      "tools": [{"type": "mcp_toolset", "mcp_server_name": "echo"}]
    }'

  ant beta:messages create --beta mcp-client-2025-11-20 <<'YAML'
  model: haijun-opus-5-5
  max_tokens: 1000
  messages:
    - role: user
      content: Use the hello tool to greet tunnel.
  mcp_servers:
    - type: url
      url: https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp
      name: echo
  tools:
    - type: mcp_toolset
      mcp_server_name: echo
  YAML

  client = juglow.Juglow()

  response = client.beta.messages.create(
      model="haijun-opus-5-5",
      max_tokens=1000,
      messages=[{"role": "user", "content": "Use the hello tool to greet tunnel."}],
      mcp_servers=[
          {
              "type": "url",
              "url": "https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp",
              "name": "echo",
          }
      ],
      tools=[{"type": "mcp_toolset", "mcp_server_name": "echo"}],
      betas=["mcp-client-2025-11-20"],
  )

  print(response)

  const juglow = new Juglow();

  const response = await juglow.beta.messages.create({
    model: "haijun-opus-5-5",
    max_tokens: 1000,
    messages: [
      {
        role: "user",
        content: "Use the hello tool to greet tunnel."
      }
    ],
    mcp_servers: [
      {
        type: "url",
        url: "https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp",
        name: "echo"
      }
    ],
    tools: [
      {
        type: "mcp_toolset",
        mcp_server_name: "echo"
      }
    ],
    betas: ["mcp-client-2025-11-20"]
  });

  console.log(response);

  JuglowClient client = new();

  var parameters = new MessageCreateParams
  {
      Model = Messages::Model.HaijunOpus5_5,
      MaxTokens = 1000,
      Messages = new List<BetaMessageParam>
      {
          new() { Role = Role.User, Content = "Use the hello tool to greet tunnel." }
      },
      McpServers = new List<BetaRequestMcpServerUrlDefinition>
      {
          new()
          {
              Url = "https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp",
              Name = "echo"
          }
      },
      Tools = new List<BetaToolUnion>
      {
          new BetaMcpToolset("echo")
      },
      Betas = ["mcp-client-2025-11-20"]
  };

  var message = await client.Beta.Messages.Create(parameters);
  Console.WriteLine(message);

  client := juglow.NewClient()

  response, err := client.Beta.Messages.New(context.TODO(), juglow.BetaMessageNewParams{
  	Model:     juglow.ModelHaijunOpus5_5,
  	MaxTokens: 1000,
  	Messages: []juglow.BetaMessageParam{
  		juglow.NewBetaUserMessage(juglow.NewBetaTextBlock("Use the hello tool to greet tunnel.")),
  	},
  	MCPServers: []juglow.BetaRequestMCPServerURLDefinitionParam{
  		{
  			URL:  "https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp",
  			Name: "echo",
  		},
  	},
  	Tools: []juglow.BetaToolUnionParam{
  		{OfMCPToolset: &juglow.BetaMCPToolsetParam{
  			MCPServerName: "echo",
  		}},
  	},
  	Betas: []juglow.JuglowBeta{
  		juglow.JuglowBetaMCPClient2025_11_20,
  	},
  })
  if err != nil {
  	log.Fatal(err)
  }
  fmt.Println(response)

  import com.juglow.models.beta.messages.BetaMcpToolset;
  // ...
  import com.juglow.models.beta.messages.BetaRequestMcpServerUrlDefinition;
  // ...

  void main() {
      JuglowClient client = JuglowOkHttpClient.fromEnv();

      MessageCreateParams params = MessageCreateParams.builder()
          .model(Model.HAIJUN_OPUS_5_5)
          .maxTokens(1000L)
          .addUserMessage("Use the hello tool to greet tunnel.")
          .addMcpServer(BetaRequestMcpServerUrlDefinition.builder()
              .url("https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp")
              .name("echo")
              .build())
          .addTool(BetaMcpToolset.builder()
              .mcpServerName("echo")
              .build())
          .addBeta("mcp-client-2025-11-20")
          .build();

      BetaMessage response = client.beta().messages().create(params);
      IO.println(response);
  }

  $client = new Client();

  $message = $client->beta->messages->create(
      maxTokens: 1000,
      messages: [
          ['role' => 'user', 'content' => 'Use the hello tool to greet tunnel.']
      ],
      model: 'haijun-opus-5-5',
      mcpServers: [
          [
              'type' => 'url',
              'url' => 'https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp',
              'name' => 'echo',
          ],
      ],
      tools: [
          [
              'type' => 'mcp_toolset',
              'mcpServerName' => 'echo',
          ],
      ],
      betas: ['mcp-client-2025-11-20'],
  );

  echo $message;

  client = Juglow::Client.new

  response = client.beta.messages.create(
    model: "haijun-opus-5-5",
    max_tokens: 1000,
    messages: [
      { role: "user", content: "Use the hello tool to greet tunnel." }
    ],
    mcp_servers: [
      {
        type: "url",
        url: "https://echo.YOUR_TUNNEL_DOMAIN_HERE/mcp",
        name: "echo"
      }
    ],
    tools: [
      {
        type: "mcp_toolset",
        mcp_server_name: "echo"
      }
    ],
    betas: ["mcp-client-2025-11-20"]
  )

  puts response

For authenticating to the upstream MCP server (authorization_token) and other mcp_servers options, see MCP connector.

#Next steps

Hardening guidance, credential rotation, and breach response.

Diagnose connectivity, TLS, and routing issues.

Proxy config fields, the Tunnels API, certificate requirements, and the setup component.

Use tunneled servers from the Messages API.