New in 0.6.0Dashboard Overview and Analytics

Share, publish and protect your local work.

A free, native app for Cloudflare Tunnel. A public URL in one click, your own domains with every change reviewed, and an inspector for every request. On your own Cloudflare account.

Download
brew install --cask teispace/tap/teitunnel
Teitunnel's Overview: a problem banner, a traffic chart, routes on teispace.com and teispace.dev, and live Quick Shares
app.yourhost.com1,284 requests

  • Free and open source

    MIT licensed. No account with us.

  • Native everywhere

    macOS, Windows and Linux, plus a CLI.

  • Your own domains

    On your own Cloudflare account.

  • Reviewed first

    Nothing changes until you apply it.

Your computer reaches out to Cloudflare, so the internet can reach in. No open ports. No exposed IP. And nothing changes on your account that you didn't read first.

How it reaches you

From a phone anywhere to localhost.

  1. 1A visitor opens your addressA phone anywhere asks for https://app.yourhost.com. DNS points it at Cloudflare, never at your home or office.
  2. 2Cloudflare's edge decides who gets inHTTPS ends there. Your login, bot rules and rate limits run at the edge, so blocked traffic never reaches your computer.
  3. 3Down the tunnel your computer openedcloudflared dialed out to Cloudflare when you shared, so there's no port to forward and your IP address stays private.
  4. 4Teitunnel's inspector sees itHeaders, body and timing are recorded on your computer, with credentials masked. Replay it any time.
  5. 5Your service answers, and back it goeslocalhost:3000 replies as it would to you, and the answer takes the same way back in milliseconds.
  1. A visitorapp.yourhost.com
  2. Cloudflare's edgeyour account
  3. Teitunnelon your computer
  4. Your servicelocalhost:3000
No port forwarding, no public IP: the connection starts on your computer.

Everything in one app

From a quick demo to a site that stays up.

Seven jobs developers do with local work, each a click away and each on your own Cloudflare account.

Share

A public URL for anything on your machine.

Pick a running service and get an HTTPS address in seconds. No account needed; with one, share on your own domain.

  1. Found for you: running dev servers and containers are listed, and a dev server that refuses the public address comes with the fix.
  2. Your rules: a timer, a schedule, pause without losing the address, a QR code for your phone, or a whole folder instead of a server.
  3. Local HTTPS domains: shop.test or app.localhost with certificates your browsers trust, and .local names for phones on your Wi-Fi.
  4. Checked before it's public: a served .env file, the git folder or a debug page is pointed out first.
Quick ShareSharing extrasLocal domains
Quick Share: shares on teispace.com with pause and schedule, and a live trycloudflare.com share with its request count
LiveVite · :5173
https://quiet-river-lamp-orbit.trycloudflare.com
128 requests · 0 errors

Inspect

See every request. Replay any of them.

Requests to your shares and routes stream through Teitunnel's inspector on your computer, untouched and never sent anywhere.

  1. Headers, bodies and timing for every request, WebSocket message and event stream, with credentials masked.
  2. Webhooks recognised: Stripe, GitHub, Slack, Shopify and more, with signatures checked. Replay them, edited or re-signed.
  3. Break things on purpose: 3G or satellite latency, 500s and resets on chosen paths, stubs while your service restarts.
  4. Export as cURL, HAR or Markdown, draft an OpenAPI description, and follow each route's traffic, errors and uptime in Analytics.
InspectorOpenAPI from trafficAnalytics and uptime
The Inspector: a list of requests with method, path, status, duration and size, and one request's summary, timing and headers
POST /webhooks/stripeStripe webhook
ReplayRe-sign

200 OK· 49 ms · signature valid

Publish

Your own domains, with nothing changed behind your back.

Route app.yourhost.com to localhost:3000. The tunnel and DNS record are made for you, as a plan you read before it's applied.

  1. Every change is a plan: tunnels, DNS records, logins and pools. If a step fails, the ones before it are undone.
  2. Activity keeps the history, step by step, with each change undoable afterwards.
  3. Grows with you: several tunnels, load balancing across machines, private networks, and routes that stay up after you quit.
Your first routeSeveral tunnelsLoad balancing
Reviewing a new route for shop.teispace.app: a warning about an existing DNS record and the three steps of the change

Add app.yourhost.com

  1. Create tunnel “MacBook-Pro”the first route in this account
  2. Update tunnel “MacBook-Pro” to serve 1 routeapp.yourhost.com → http://localhost:3000
  3. Add DNS record app.yourhost.com → tunnel “MacBook-Pro”proxied CNAME to <id>.cfargotunnel.com
  4. Check https://app.yourhost.com worksthrough Cloudflare's edge
Live · https://app.yourhost.com works

Keep online

Online while your computer sleeps.

Some things should stay up when you close the lid. Teitunnel puts them on your Cloudflare account, as Workers you own.

  1. Snapshots: a static copy of a folder, a build or a running site, with versions, rollback, a password or a login.
  2. Comments: reviewers click the spot they mean on a Snapshot or share, with nothing to install; you answer in the app, the terminal or an agent.
  3. Offline page and webhook inbox: your own "back soon" page instead of an error, and webhooks kept until you're back.
SnapshotsCommentsOffline pageWebhook inbox
Snapshots: the Launch page Snapshot at preview.teispace.com with its details and three versions

Publish version 4 of Launch page

  1. Upload 3 new or changed files of 48 (212 kB)files Cloudflare already has aren't sent again
  2. Make the new version live once every file is uploadedversion 4
  3. Serve preview.yourhost.com with the SnapshotCloudflare adds its DNS record and certificate
Online · preview.yourhost.com

Protect

Decide who gets in, at Cloudflare's edge.

Rules Cloudflare enforces for one hostname, so they keep working while your computer is off and blocked traffic never reaches it.

  1. Logins: only the people or email domains you list, with a one-time code by email, through Cloudflare Access.
  2. Bots and crawlers: challenge or block automated clients and AI crawlers, limit requests per visitor, set headers.
  3. Service tokens let CI jobs and scripts through a login with two headers.
  4. Quick Shares too: a password, a secret link or an IP allow list, enforced by the inspector on your computer.
Require a loginEdge protectionExposure check
Protect app.teispace.com: automated clients set to allow, block AI crawlers, rate limit and header rules

HighThe .env file is served

/.env answers with APP_KEY, DATABASE_URL and STRIPE_SECRET_KEY. Only the names are shown, never the values.

Share AnywayCancel

Fix

Problems explained, with the fix one click away.

The Doctor checks routes, DNS, connectors, logins and WARP settings, says what's wrong in plain words, and fixes what's safe to fix.

  1. Missing a permission? It shows exactly what to add to your token and picks up where you left off.
  2. Inline everywhere: issues show on the route or tunnel they concern, and in the menu bar.
  3. Notifications when a route goes down, errors or slows down, with quiet hours.
DoctorCloudflare errors, explained
The Doctor: docs.teispace.com has no DNS record, with its explanation and a Fix the DNS Record button

docs.yourhost.com is live

Added a proxied CNAME to this Mac's tunnel and checked it through Cloudflare.

FixedUndo in Activity

Automate

The same engine in your repository, terminal and CI.

Declare what a project needs once. Everyone on the team, and every pull request, gets the same setup with their own addresses.

  1. teitunnel.yml: routes, shares, Snapshots and local domains, applied with teitunnel up or one click, and a no-op when nothing changed.
  2. Pull request previews on your domain from the GitHub Action or GitLab CI template, removed when the pull request closes.
  3. A real CLI with JSON output, plus teitunnel serve for servers: a sandboxed service, Docker image and web dashboard.
Project filesCI previewsServers and Docker
Projects: the shop project's teitunnel.yml with routes, a share, a Snapshot and a local domain, applied or missing
web-01 — ssh
$ export CLOUDFLARE_API_TOKEN=…$ teitunnel route add app.yourhost.com 3000 --yes 1. Create tunnel “web-01” 2. Update tunnel “web-01” to serve 1 route 3. Add DNS record app.yourhost.com → tunnel “web-01”    done: Create tunnel “web-01”    done: Update tunnel “web-01” to serve 1 route    done: Add DNS record app.yourhost.com → tunnel “web-01”Checking https://app.yourhost.com…https://app.yourhost.com works.$ sudo -E teitunnel always-on onTurning Always-on on for web-01…Done: the connectors run as a service and start again after a restart.

Built for AI agents

Let your agent share and fix things. You still say yes.

Agents share dev servers, add routes, read logs, wait for a webhook and replay it, through the same plans as the app.

Every change waits for your answer in the app or the AI app, never for the agent's word, and shows up in Activity with its name.

API, OAuth and tunnel tokens never reach the agent, and captured credentials stay masked.

Found on your computer, connected in one click, tested with a real handshake:

  • Claude Code
  • Claude Desktop
  • Cursor
  • VS Code
  • Codex
  • Windsurf
  • Zed
  • Gemini CLI
  • GitHub Copilot CLI
  • opencode
  • Kiro
  • LM Studio
  • Junie
AI agents (MCP)
claude — ~/shop

Put my API on api.yourhost.com

teitunnel · list_local_services⎿ api · localhost:8080

teitunnel · plan_change⎿ 2 steps: update tunnel “MacBook-Pro”, add a DNS record

teitunnel · apply_plan⎿ Applied 2 steps · in Activity as Claude Code

Done: https://api.yourhost.com works.

Claude Code wants to change your routes in Cloudflare (2 steps):

  • Update tunnel “MacBook-Pro” to serve 6 routes
  • Add DNS record api.yourhost.com → tunnel “MacBook-Pro”

Your answer, not the agent's

Works with your tools

Share from your editor. Preview from CI.

Extensions and launchers talk to the running app over a local connection. Nothing listens on the network, and nothing changes without your approval.

shop — vite.config.ts
> Teitunnel: shareTeitunnel: Share This Workspace's Dev ServerTeitunnel: Share Port…
Sharing localhost:5173 atquiet-river-lamp-orbit.trycloudflare.comCopy Address
Editor extensions

A global shortcut shares your dev server from anywhere, and teitunnel:// links open a route or a share. Every program is approved once, in the app. Links and integrations

A native app

Made to feel at home on your computer.

Not a website in a box: the same app on macOS, Windows and Linux, drawn the way each one draws its own.

  • Looks like its systemSystem font and accent color, light and dark, native menus, windows and notifications.
  • Keyboard first⌘ K for any command, ⌘ 1–9 to move around, and a global shortcut that shares your dev server.
  • In the menu barShares, routes and problems one click away, and a note when a route goes down.
  • Small and quickOpens in about half a second and stays light while it serves your routes.

  • Credentials in your keychain

    API and OAuth tokens live in the system keychain and are only sent to Cloudflare. Tunnel tokens never appear in a command line.

  • No telemetry

    No analytics, no crash reporting and no account with us. Captured requests stay on your computer.

  • Reviewed, then undoable

    Every change to Cloudflare is a plan you read first. A step that fails undoes the ones before it.

Security and privacy

Your account, your keys, your computer.

Teitunnel asks only for the permissions a feature needs, shows what each one is for, and checks again when you come back.

Security model · Privacy

  • Nothing of yours is overwritten

    DNS records and apps Teitunnel didn't create are only replaced when you say so, and never deleted by it.

  • Secrets masked

    Authorization headers, cookies, API keys and webhook signatures are masked in the inspector and exports.

  • No shells, verified binaries

    cloudflared is downloaded from Cloudflare and verified, and every process starts without a shell. macOS builds are signed and notarized.

How it works

Three steps, a few minutes.

3:10from download to a live address

  1. Install

    Download the app for macOS, Windows or Linux. It fetches and verifies cloudflared for you.

    Teitunnel.dmg24.9 / 24.9 MB
    cloudflared verified

  2. Share or connect

    Share a port right away with no account, or sign in to Cloudflare and grant only the permissions you need.

    Sign in with Cloudflare Tunnels DNS AccessOr share right away, with no account.

  3. Review and apply

    Add a route, read exactly what will change, and apply. Teitunnel checks the URL works when it's done.

    Create tunnel “web-01”Route app.yourhost.com → :3000Add its DNS recordapp.yourhost.comLive

Use cases

What people put on the internet with it.

Pick one to see the way its requests travel. Each has a step-by-step guide, from a five-minute demo to a home lab.

localhost:3000
Share localhost:3000quiet-river-lamp-orbit.trycloudflare.com
quiet-river-lamp-orbit…
  • No port forwarding
  • HTTPS for free
  • Stops when you stop it
Read the guide

Questions

Good to know.

More in the FAQ and troubleshooting, or ask on GitHub.

01What is Teitunnel?

A free, open-source app for Cloudflare Tunnel. It shares anything running on your computer at a public URL, publishes your apps on your own domains, shows every request that reaches them, and protects them with logins and edge rules, without port forwarding or editing cloudflared config files.

02Is it free?

Yes. Teitunnel is free and open source (MIT). Cloudflare Tunnel is free on Cloudflare's free plan too; a few features, such as load balancing or per-hostname rate limits, need a paid Cloudflare plan or add-on, and Teitunnel says so where it matters.

03Do I need a Cloudflare account?

Not for Quick Share, which gives you a temporary trycloudflare.com address, or for local domains. Routes, Snapshots and logins need a free Cloudflare account with your domain added.

04Does anything run on Teitunnel's servers?

No. There are none. Tunnels, Snapshots, offline pages and webhook inboxes live on your own Cloudflare account, and captured requests stay on your computer.

05Does it replace cloudflared?

No, it runs it. Teitunnel downloads and verifies Cloudflare's cloudflared, or uses the one you have, imports existing config.yml setups, and exports its routes back to config.yml, Docker Compose or Terraform.

06What can an AI agent do, and what does it see?

Through Teitunnel's MCP server an agent can share a dev server, add routes, read logs and replay webhooks. Every change waits for your approval unless you say otherwise, and API, OAuth and tunnel tokens never reach it.

07What happens if a change fails halfway?

Everything done before the failure is undone, in reverse order. Activity shows what happened, step by step, and lets you undo changes that went through.

Put it online. Keep it yours.

A public URL in one click, your own domains when you're ready, all on your own Cloudflare account.

DownloadRead the docs

Free and open source · macOS, Windows and Linux · No account with us