Cloudflare Tunnel

A remote MCP client needs a public HTTPS endpoint. Cloudflare Tunnel can forward a public hostname to the local local-shell-mcp service while the server's own OAuth flow protects /mcp.

Create the tunnel and obtain its token

Follow Cloudflare's Create a tunnel in the dashboard guide:

1. sign in to Cloudflare and open Networking → Tunnels;
2. create a remotely managed tunnel and give it a recognizable name;
3. copy the installation command shown for the connector; the long eyJ... value after --token is the tunnel token; and
4. add a Published application route for a hostname such as mcp.example.com.

The token authorizes a connector to run this tunnel, so keep it private. Cloudflare also documents how to retrieve a tunnel token later.

Choose the service target

For the local source setup, set the published application's service URL to:

http://127.0.0.1:8765

For the repository's Docker Compose setup, set it to:

http://local-shell-mcp:8765

Add the public origin and copied token to .env:

CLOUDFLARE_TUNNEL_TOKEN=eyJ...
LOCAL_SHELL_MCP_BASE_URL=https://mcp.example.com

LOCAL_SHELL_MCP_BASE_URL is the origin only. Do not append /mcp. Return to Quickstart or Docker Compose to start the selected deployment.

Verify

From another network, check:

curl -i https://mcp.example.com/healthz

Use this URL in the MCP client:

https://mcp.example.com/mcp

Common mistakes

• The connector URL does not end in /mcp.
• LOCAL_SHELL_MCP_BASE_URL incorrectly includes /mcp.
• The tunnel target uses the wrong hostname for local versus Compose deployment.
• The public hostname changed but .env still contains the old origin.
• OAuth is disabled on a public hostname.

Continue with ChatGPT connector or see Troubleshooting.