Holepunch

An agent opens one outbound tunnel from a private network. A person signs in once with GitHub. The same tunnel becomes a claude.ai connector, an inbound webhook, and an owner-only URL for a local web server.

Sign in to see your devices, connectors, usage, and audit log.

What it does

• No inbound ports. The client dials the relay over one WebSocket. claude.ai and webhook senders reach only the relay.
• One connector per account. Every machine signs in as a device of your account. One URL with OAuth in front reaches the approved MCP servers on all of them, so knowing the URL is not enough to use it.
• Webhooks with checked signatures. GitHub, Stripe, and generic HMAC presets. Events arrive marked untrusted.
• Teams. Invite members by email. Each one consents with their own GitHub login and gets their own tool allowlist.
• Notifications. The agent can reach a person over push, email, Slack, or Discord.

Start

Holepunch is in private preview, for macOS and Linux. Install it and sign in with GitHub:

curl -fsSL https://holepunch.dev/install.sh | sh

Publish a folder through a read-only MCP server:

holepunch mcp files --tools-allow read_text_file,list_directory \
  -- npx -y @modelcontextprotocol/server-filesystem@2.0.0 ~/shared

It prints the account connector URL. In claude.ai on desktop, open Settings, Connectors, Add custom connector, paste the URL, and sign in with the same GitHub account. That one connector serves every machine on the account, so it is added once. Or ask your agent: "Publish my ~/shared folder to claude.ai with Holepunch, read-only."

Trust

The relay reads what it forwards in order to deliver it, and stores none of it. The audit log keeps metadata only, for 90 days.