Client compatibility
mcppipe is vendor-neutral by design: the same public host answers every
MCP-capable client at once. There is no per-vendor build, no allowlist of
“supported agents”, and nothing to switch on. The single-vendor tunnels shipped
by the model providers in May 2026 cannot do this — Anthropic’s MCP Tunnel only
serves Managed Agents and the Messages API, and OpenAI’s Secure MCP Tunnel only
serves ChatGPT / Codex / Responses / AgentKit. mcppipe answers all of these
clients on a single host.
How a client reaches your tunnel
Section titled “How a client reaches your tunnel”Every client connects to your tunnel the same way: over Streamable HTTP at
your tunnel’s public URL. Each account gets its own namespace, so a tunnel’s
public host is https://<subdomain>--<account-slug>.<zone>/mcp — for example
https://notes--acme.mcppipe.dev/mcp. (Bringing your own FQDN instead is
covered in Custom domains & TLS.)
There is no special header to set and no interstitial / browser-warning page
in the way — mcppipe relays the upstream response verbatim, so a client (or a
plain curl) gets your MCP server’s bytes directly, on every tier. (Generic free
tiers like ngrok’s inject an anti-phishing HTML page that breaks demos until you
click through or send ngrok-skip-browser-warning; mcppipe never does.)
The up command prints a ready-to-paste config snippet for whichever client you
name. Below is the matrix of what we test and recommend.
Compatibility matrix
Section titled “Compatibility matrix”| Client | Transport | Config | IP preset | Tested |
|---|---|---|---|---|
| Claude Desktop | Streamable HTTP | mcpServers entry pointing at the tunnel URL | Anthropic (or Multi-LLM) | ✅ |
| Claude web / Managed Agents | Streamable HTTP | Add as a remote MCP server in the workspace | Anthropic (or Multi-LLM) | ✅ |
| ChatGPT (connectors) | Streamable HTTP | Add as a custom connector / remote MCP server | OpenAI (or Multi-LLM) | ✅ |
| Cursor | Streamable HTTP | ~/.cursor/mcp.json server entry | Custom — see note below | ✅ |
| Windsurf | Streamable HTTP | MCP server entry in settings | Custom | ✅ |
| VS Code (Copilot / MCP) | Streamable HTTP | mcp.json server entry | Custom | ✅ |
| Cline | Streamable HTTP | MCP server entry | Custom | ✅ |
| Continue.dev | Streamable HTTP | MCP server entry in config.json | Custom | ✅ |
| Zed | Streamable HTTP | context_servers entry | Custom | ✅ |
These are also the clients the CLI auto-detects when you run mcppipe up
without an explicit --upstream — see the CLI reference for
how detection picks up each client’s local config file.
IP presets and the “Multi-LLM” one-click
Section titled “IP presets and the “Multi-LLM” one-click”If you lock a tunnel down with an IP allowlist, the dashboard offers one-click presets for the major vendors’ published egress ranges. The presets are, in display order:
- Multi-LLM (Anthropic + OpenAI) — the recommended vendor-neutral default.
- Anthropic Claude — Anthropic’s published Claude API egress range.
- OpenAI (ChatGPT / API egress) — OpenAI’s published egress (ChatGPT, Codex, Responses).
- Google AI (Vertex) — Google Vertex AI egress (snapshot).
The Multi-LLM preset expands to the union of the Anthropic and OpenAI egress ranges, so a single click makes the tunnel reachable by both vendors’ agents at once. Picking a preset expands into its CIDRs at the moment you click; the ranges are maintained snapshots, not auto-refreshed — re-check the box if a vendor rotates its range. Use the Custom free-form CIDR field for anything not covered by a preset.
A note on Cursor
Section titled “A note on Cursor”Cursor is not offered as a one-click preset, and is deliberately left out of the Multi-LLM union. Cursor’s only MCP-relevant egress is its Cloud Agent range, which Cursor documents as not stable (“we make changes to our IP addresses from time to time”, served per-cluster via a JSON API); the only ranges Cursor calls stable are its git egress proxy, which never reaches your MCP server. Pinning an unstable third-party range as a preset would make a promise we can’t keep. To restrict a tunnel to Cursor, use the Custom CIDR field with the current values from Cursor’s JSON API — the dashboard accepts any CIDR there, and you re-check it when Cursor rotates its range.
Most clients (Claude Desktop, Cursor, Windsurf, VS Code, Cline, Continue.dev, Zed) connect from your own machine or network, so the relevant allowlist entry is your own egress IP — not a vendor’s. Vendor presets matter for cloud-hosted agents (Claude Managed Agents, ChatGPT connectors) that reach your tunnel from the provider’s infrastructure.
Authenticating clients
Section titled “Authenticating clients”The matrix above covers transport reachability. If a tunnel has authentication enabled, the client must also present a credential: a per-tunnel API key, an OAuth 2.1 Bearer token, or a Service Token for headless agents. See Authentication: OAuth & Service Tokens for how each client attaches a token and how mcppipe validates it.