tunr

Connect AI agents to your customers' on-prem data. Read-only, time-boxed, approved by the customer, and on the record — through one outbound-only connector.

tunr.sh · Live demo · Docs · Dashboard · Discussions · Contributing

# Customer IT, once — inside their network, outbound HTTPS only:
$ tunr connect --relay https://bridge.tunr.sh --site istanbul-office --relay-key ed25519:… --token-stdin --setup-only   # paste the site token
$ tunr connect resource add erp-db --kind postgres --target 10.0.0.5:5432 --database logo
$ tunr connect pg-role --database logo --tables invoices,stock --resource erp-db > pg-role.sql   # for the DBA

# The vendor's agent — anywhere:
$ tunr access request acme/erp-db --ttl 2h --reason "Reconcile October invoices"
  pending  grt_…  acme/erp-db (ro, 2h0m0s)            # the customer approves in the portal
$ tunr access acme/erp-db --port 15432
postgresql://agent:…@127.0.0.1:15432/db?sslmode=disable
$ psql "$DSN" -c "update invoices set amount = 0"
ERROR:  tunr bridge: UPDATE is not allowed on a read-only bridge

Or let the agent do it: tunr_list_resources, tunr_request_access, tunr_open_access are MCP tools.

Why

AI vendors increasingly sell agents that need data living inside their customers' networks — on-prem ERPs, ledgers, file servers. Today each vendor writes its own on-prem agent or asks for a VPN, and every deal waits weeks in a security review, because the customer can't see or limit what the agent touches.

tunr Bridge is the standard way across. The customer installs one connector that only connects out, exposes named resources, and approves each agent, resource and time window — with a reason they can read. The agent never sees a database password; databases are read-only in three layers; the stream is end-to-end encrypted to the customer's connector; every query lands in the customer's audit log; one click cuts everything. Once a customer has the connector for one vendor, the next vendor is a link and an approval away.

tunr also hosts the agents themselves (private, woken by cron or signed webhooks, with their identity issued automatically), still deploys the small apps agents build, and still has the free 3-second tunnel it started as.

Install

# macOS / Linux — Homebrew
brew install tunr-dev/tap/tunr

# macOS / Linux — install script
curl -fsSL https://raw.githubusercontent.com/tunr-dev/tunr/main/install.sh | sh

# Go
go install github.com/tunr-dev/tunr/cmd/tunr@latest

# From source
git clone https://github.com/tunr-dev/tunr.git && cd tunr && make build

A single static binary. macOS, Linux and Windows, amd64 and arm64, no runtime dependencies. Verify it with tunr doctor.

SDKs — for driving tunnels from code rather than the shell:

pip install tunr          # Python
npm install @tunr/cli     # Node.js

Agent Bridge

 vendor's agent ──► tunr access ──(TLS 1.3, pinned)──────────────► connector ──► customer's database
 (anywhere)        127.0.0.1:port      ▲ relay sees ciphertext ▲     (outbound only)    (read-only role)

What it guarantees, how, and what it doesn't: docs/bridge/security.md. Getting started: customer · vendor · protocol: docs/protocol/bridge.md.

Status: preview. Live on tunr.sh and end-to-end tested (two docker suites in CI); expect sharp edges. Postgres and raw TCP resources today; MySQL/MSSQL later.

Cloud — deploy & host

tunr login                        # magic-link, token goes to your OS keychain
tunr deploy --name my-app         # build + run; prints the live URL
tunr apps                         # list your apps
tunr apps logs my-app --follow    # stream build + runtime logs
tunr apps delete my-app           # remove it, free the subdomain

tunr deploy --name sprint --port 3000 --env DATABASE_URL=postgres://…

Status: preview. Deploy works end to end and is what the MCP tools drive. Role-based sharing, per-app SQLite and tunr rollback are not built yet — see Roadmap for what's real and what isn't.

Agent-native (MCP)

The CLI and the MCP server are two faces of the same control plane. Anything you can do in a terminal, your agent can do in a tool call.

Claude Code:

claude mcp add tunr -- tunr mcp

Claude Desktop (~/.claude/claude_desktop_config.json) / Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "tunr": { "command": "tunr", "args": ["mcp"] }
  }
}

Tools

tunr_deploy and tunr_share are deliberately distinct, and the tool descriptions say so: deploy means "host this, it should outlive my laptop", share means "expose what's running on :3000 right now". Cloud tools need tunr login first.

Client demos — for freelancers and vibecoders

Showing a client something that still runs on your laptop? Three flags make the free tunnel safe to hand to someone who isn't a developer.

tunr share -p 3000 --demo --freeze --inject-widget --qr