A free, open-source app for Cloudflare Tunnel. It shares anything running on your computer at a public URL, publishes your apps on your own domains with DNS handled for you, and keeps them running, without port forwarding or editing cloudflared config files. It also inspects traffic, publishes static Snapshots, protects hostnames at Cloudflare's edge and serves local HTTPS domains. There's a desktop app for macOS, Windows and Linux, and the teitunnel command and a Docker image for servers.

Is Teitunnel made by Cloudflare?

No. It's an independent open-source project (MIT) by Teispace that uses Cloudflare's public API and runs Cloudflare's open-source cloudflared connector.

Which systems does it run on?

macOS 14 or later (Apple silicon and Intel), Windows 10 and 11 (x64 and Arm), and Linux with WebKitGTK 4.1 (Ubuntu 22.04, Debian 12, Fedora 40 or later; x64 and Arm64). The teitunnel command runs on the same systems plus any Linux server, and in Docker. See Install.

0.5.0 adds an AI & Integrations section for AI apps, agents, shared MCP servers and the browser extension, private hostnames for WARP users, and approvals for AI agents that need a person. See What's new for this release and the ones before it. If you're on 0.1.x, update before 5 October 2026, when Cloudflare changes how it reports tunnel connections.

Does Teitunnel cost anything?

No. Teitunnel is free and open source, with no paid tier, no Teispace account and no usage limits of its own.

Do I need a paid Cloudflare plan?

Usually not. Cloudflare Tunnel, DNS, Quick Shares, Workers (Snapshots, the offline page, the webhook inbox), D1 (comments) and Zero Trust logins (up to 50 users) are all on Cloudflare's free plans, within their limits. A few things need a paid plan: Load Balancing is a paid add-on, and rate limiting one hostname needs the Pro plan or higher. See Limits and costs.

Can Teitunnel run up a bill on my Cloudflare account?

Teitunnel only adds things you asked for, and the plan says when a change uses a metered product. The Workers it creates for the offline page and webhook inbox fail open: past the free daily requests, traffic goes straight to your tunnel instead of failing or being billed. Paid products (Load Balancing, a paid Workers plan) only cost money if you turned them on in Cloudflare.

Do I need a Cloudflare account or a domain?

Not for Quick Share or local domains. For routes on your own hostnames you need a free Cloudflare account and a domain whose nameservers point to Cloudflare.

Sign in with Cloudflare or an API token?

On a desktop, Sign in with Cloudflare is quickest: one consent screen, nothing to paste. Use an API token to limit Teitunnel to some accounts or domains, and on servers and in CI. See Accounts and permissions.

Why does Teitunnel ask for so many permissions?

So each feature works when you first use it. Only four are needed for routes (tunnels, DNS, listing domains, the account's name); the rest belong to optional features such as logins, Snapshots or edge protection. You can decline them on the consent screen or leave them out of the token, and add them later from the feature that needs them. The full list is in Accounts and permissions.

Can I use several Cloudflare accounts?

Yes. Connect as many as you like; views that work on one account get an Account menu, and the command line takes --account.

Can a team share one Cloudflare account?

Yes. Each computer gets its own tunnel, DNS records say which machine and person they belong to, and hostnames can be reserved so teammates see who holds a name.

What happens to my routes when I quit?

They stop, unless you've turned on Always-on. Quitting with routes running asks first and offers to switch them. Closing the window doesn't quit: Teitunnel keeps running in the menu bar or tray. To show visitors your own page while your computer is off, add an offline page.

Can I still use cloudflared from the command line?

Yes. Teitunnel works with the Cloudflare API and its own connector, and lists other cloudflared processes on the machine under Tunnels ▸ Also on this machine so they don't conflict unnoticed. Routes you change elsewhere are detected and never overwritten without asking.

I already have tunnels. Will Teitunnel change them?

No. Teitunnel creates its own tunnel for this machine and only changes that one. Other tunnels are listed, and you can import routes from a config.yml setup, or run an existing tunnel here too, when you're ready.

Why does a route say “Nothing is listening”?

The route points at a port where no app is running. Start your app (or fix the port in the route) and it goes live; nothing else needs to change.

Can I share a dev server like Vite or Next.js?

Yes, and Teitunnel finds them for you. Dev servers may block unknown hostnames; Teitunnel recognises that and offers the fix in place. See dev servers.

Why does streaming or my MCP server not work on a Quick Share?

Cloudflare's Quick Tunnels don't carry Server-Sent Events. Share on your own domain instead (teitunnel share 3000 --on demo.yourhost.com). See Limits and costs.

Does it work behind CGNAT, a corporate firewall or on mobile data?

Usually yes: cloudflared only makes outbound connections to Cloudflare (port 7844, UDP or TCP), so no inbound port or public IP is needed. Very strict firewalls that block port 7844 need it allowed.

Where's the teitunnel command?

It comes with the app. The Windows installer and the Linux packages put it on your PATH; on macOS and with the AppImage, Teitunnel offers it once, and Settings ▸ General ▸ Command line adds it any time. It was called teitunnel-cli before 0.2.0. See the teitunnel command.

Can AI coding agents use Teitunnel?

Yes. Teitunnel has an MCP server that agents such as Claude Code, Cursor, VS Code and Codex use to share services, add routes, run the Doctor and read captured traffic. Connect a tool in AI & Integrations ▸ AI Apps or with teitunnel mcp install. See AI agents.

Can an agent change my account without asking?

Not by default. Every change is a plan, and in the default ask mode you approve it, in a native dialog when the app runs. read-only mode lets an agent look but not change anything. Replacing or deleting DNS records Teitunnel didn't create needs your confirmation in every mode, and every agent change is recorded in Activity with the agent's name.

Does the agent see my Cloudflare token or my traffic's secrets?

No. Agents never get account credentials, and captured cookies, Authorization and API-key headers are masked in what they read, unless you start the server with --allow-secrets. Teitunnel doesn't run a model of its own and sends nothing to any AI service; your agent talks to Teitunnel on your computer.

Where are my credentials kept?

In your system's keychain (Keychain on macOS, Credential Manager on Windows, the Secret Service on Linux), and only ever sent to Cloudflare. On a server, the API token can come from the environment for each command and is never written to disk. See Security.

Does Teitunnel collect data about me?

No. There's no telemetry, analytics or crash reporting, and no Teispace account. It talks to Cloudflare to do what you ask, and to GitHub to fetch cloudflared and check for updates; an update check sends nothing about you. See privacy.

Where does captured traffic go?

Nowhere. The inspector keeps requests on your computer, masked, for a day by default. They leave it only when you export or copy them, or read them with teitunnel traffic or an agent's traffic tools.

Can Teitunnel delete my DNS records?

Only records it created, which it marks. Replacing or deleting any other record is shown in the plan and needs your explicit confirmation. See DNS ownership.

Windows says it protected my PC. Is Teitunnel safe to run?

Windows Defender SmartScreen warns about apps that aren't code-signed or that it hasn't seen often yet. Choose More info ▸ Run anyway. Every download is built from the public repository by GitHub Actions and can be verified against its checksum and build provenance.

Is a Quick Share private?

No. Anyone with the URL can open it. Use a timer, or put the service on your own domain with a login for anything private.

Teitunnel

Features Use cases Docs Download Introduction

Getting started

Install Teitunnel What's new in 0.6.0 Share a local service Put a service on your domain Find your way around

Use cases

Expose localhost to the internet Share a Vite, Next.js, Django or Rails dev server

Test webhooks on localhost

Put an MCP server online Home Assistant remote access with Cloudflare Tunnel Self-host from home without port forwarding SSH, RDP and databases through Cloudflare Tunnel Cloudflare Tunnel for Docker Compose

Concepts

What is Cloudflare Tunnel?Choose how to share Routes and tunnels How changes are made Run modes DNS ownership Teitunnel and Cloudflare's own tools

Account and setup

Accounts and permissions Import an existing setup Export your setup Move to a new computer The menu bar and tray

Share, pause, schedule and name Local domains Exposure check

Inspect and debug

Inspector OpenAPI from traffic Traffic, logs and notifications Analytics, uptime and alerts

Publish

Snapshots Comments Offline page Webhook inbox

Protect

Require a login Edge protection

Automate

Project files Previews in CI and teams Links and integrations Browser extension AI agents (MCP)

Servers and networks

Servers and containers Several tunnels Load balancing Private networks and SSH

Compare

Teitunnel and other tunnels Teitunnel vs ngrok Teitunnel vs Tailscale Funnel Teitunnel vs Microsoft Dev Tunnels Teitunnel vs Pinggy Teitunnel vs LocalCan

Reference

Command line Permissions and scopes Server API Doctor checks Troubleshooting Cloudflare Tunnel Security Verify your download Limits and costs Glossary FAQ

Reference

FAQ

Common questions about Teitunnel and Cloudflare Tunnel — price, Cloudflare accounts and permissions, platforms, privacy, security, AI agents, cloudflared, and what happens when you quit.

The basics

Cost

Accounts

Using it

AI agents

Security and privacy

Edit on GitHub

Last updated on

Glossary

The words Teitunnel and Cloudflare Tunnel use — tunnel, connector, route, Quick Share, Snapshot, inspector, plan and apply, ownership, Access, Zero Trust, WARP, MCP and more — each with a link to its page.

FAQ

The basicsCopy Anchor Link

What is Teitunnel?