Cloudflare Tunnel

Expose local development ports, containers, and multi-service architectures to the public internet securely using Cloudflare Tunnel without opening firewall ports.

Purpose & Mental Model

AI agents often develop applications inside isolated environments (Docker containers, cloud VMs, WSL, local dev servers) that cannot be directly reached by external services, physical mobile devices, or remote browser controllers like ego-browser.

Cloudflare Tunnel establishes an outbound encrypted connection (QUIC or HTTP/2 over port 7844) from your local environment to Cloudflare's global edge network:

1. Quick Tunnels (try.cloudflare.com): Zero-configuration, ephemeral public HTTPS URLs. No Cloudflare account, API tokens, or DNS required. Features native agent support via --output json. Best for ad-hoc agent testing, webhooks, and remote browser validation.
   • Agent Trade-offs: Zero secret leakage risk and instant one-command setup, but subdomains rotate on restart (*.trycloudflare.com) and lack Cloudflare Access Zero Trust policies.
2. Named Tunnels (Production): Persistent, authenticated tunnels tied to custom domains and Cloudflare Zero Trust Access policies.
3. Same-Origin Unified Proxy Pattern: When testing Single Page Applications (React, Expo Web, Vite) that consume local APIs (Supabase, Express, FastAPI), running a lightweight unified reverse proxy on one port eliminates browser Mixed Content (https -> http) and CORS blocks.

The Mandatory 3-Gate Verification Rule

Never report a tunnel URL to a user or open a browser on a remote machine until all 3 gates pass: