MCP tunnels

⚠️

Preview — this feature is being built; the design below is the spec.

The MCP connector reaches MCP servers over the public internet. Many useful servers are not public: an ERP inside a data centre, a ticketing system on a private network, a database tool that must never be exposed. MCP tunnels let Syntic reach those servers without opening any inbound port.

How it works

Create a tunnel in a workspace. You get a connector token.
Run the syntic-tunnel connector on a machine that can reach the MCP server. It connects out to Syntic over TLS on port 443.
In a request or an agent definition, list the server with its internal URL and the tunnel_id.
Syntic sends tool calls through the tunnel; the connector forwards them only to URLs on the tunnel’s allowlist.

Set up

Create the tunnel

curl -sS https://app.syntic.ai/v1/tunnels \
  -H "Authorization: Bearer $SYNTIC_API_KEY" \
  -H "syntic-beta: mcp-tunnels-2026-12-01" \
  -H "Content-Type: application/json" \
  -d '{"name": "erp-onprem", "allowed_targets": ["http://erp-mcp.internal:8080/mcp"]}'

Store the connector_token from the response.

Run the connector

docker run -d --restart unless-stopped -e SYNTIC_TUNNEL_TOKEN=stn_live_… syntic/tunnel-connector:0.9

Within a few seconds the tunnel’s status becomes connected.

Use it

{
  "mcp_servers": [{ "name": "erp", "url": "http://erp-mcp.internal:8080/mcp", "tunnel_id": "tnl_01JCE4G6J8L0N2Q4S6U8" }]
}

Security model

Concern	How it is handled
Inbound exposure	None. The connector only makes outbound connections.
Who can use the tunnel	Only requests and agents in the tunnel’s workspace, and only if the organization’s MCP policy allows it.
What the tunnel can reach	Only `allowed_targets`, enforced by the connector on your side as well as by Syntic.
Credentials for the MCP server	Keep them in a vault; they are added to the forwarded request and never shown to the model.
Connector identity	A rotating token, or mTLS certificates for organizations that require them.
Traffic content	Encrypted in transit end to end between Syntic and the connector. Syntic logs tool names, timing and sizes, not payloads, unless request logging is on.

Operating it

Run at least two connectors on different hosts; calls are balanced and fail over.
Subscribe to the tunnel.disconnected webhook event.
Rotate tokens on a schedule with the grace period so no call fails during the switch.

API reference: MCP tunnels.

MCP connector Tool search

Was this page helpful?