OpenAI has officially launched Secure MCP Tunnel, allowing enterprises to connect their private MCP servers to products like ChatGPT, Codex, Responses API, and AgentKit—without opening any inbound firewall ports. The feature targets a core pain point for enterprise AI adoption: giving AI access to internal systems while keeping those systems hidden from the public internet.
How the MCP Tunnel Works: Read Data, Door Stays Shut
MCP (Model Context Protocol) is a standard protocol that lets AI models call external tools and data sources. Think of it as a universal socket for AI—through MCP, models can pull data from external databases, trigger internal tools, and execute cross-system operations. The traditional approach required opening inbound ports on the corporate firewall, effectively punching a hole that security teams hate.
Consider a bank wanting ChatGPT to query an internal customer account database: a teller asks "What were this customer's transfers over the past six months?" and the AI answers in real time. Or a hospital letting Codex read medical records to help doctors summarize medication history. These data sets cannot go public—banks face regulatory constraints, hospitals are bound by privacy laws. Previously, only two options existed: open the internal network to the outside so AI can connect directly (security says no), or build a heavy middleware layer to shuttle data (high development and maintenance costs). OpenAI's MCP Tunnel offers a third route: the AI can fetch data, but the internal network never opens its door.
The architecture follows zero-trust principles: no implicit trust, every connection must authenticate. For heavily regulated industries like finance and healthcare, keeping the firewall solid is not just convenient—it is a compliance prerequisite.
Technical Details: Outbound-Only Tunnels and Mutual TLS
OpenAI's solution is a tool called tunnel-client, deployed inside the enterprise network and connected directly to the private MCP server. It does one thing: establish an outbound-only HTTPS tunnel to OpenAI, then use long-polling to pull queued MCP work requests, forward them locally to the private server, and send responses back through the same tunnel.
Throughout the process, the private MCP server's address never leaves the enterprise network boundary. Even for streaming intermediate results, the tunnel can forward server-sent events. The security model is outer-only, backed by runtime API key authentication and support for mTLS (mutual TLS where both parties present certificates). Enterprise environments needing outbound proxies, custom CA bundles, and client certificates are all supported.
Developers simply obtain a tunnel_id from the Platform Tunnel settings, pair it with a runtime API key that has the right permissions, and use the open-source tunnel-client to connect any private MCP server via stdio or HTTP to the OpenAI product ecosystem.
Anthropic and Cloudflare Target the Same Problem
Anthropic previously launched its own MCP tunnels with self-hosted sandboxes, aiming to secure AI agent infrastructure. Earlier, Cloudflare introduced Mesh to replace VPNs and let AI agents securely access enterprise networks. From infrastructure vendors to model providers, the whole industry is tackling one question: how to safely connect AI to a company's core systems.
The business logic is straightforward. Enterprises do not treat AI as a search engine; they need AI that reads internal CRM, queries private databases, and triggers approval workflows. But once AI needs to plug into the internal network, security becomes the first veto. Whoever can get the security chief's nod wins the enterprise contract. The MCP Tunnel eliminates that veto.