Takelan Tunnels (Omnigate): put a local service on a public URL in one command
Publish localhost safely. One command, a real HTTPS address, your rules.
Run tlomnigate tunnel 3000 and your local app gets a public name with TLS. Add access rules, visitor passwords, a custom domain or your own private relay when you need them. Start free*.
Takelan Tunnels at tnl.tkln.dev
Why teams choose it
Online in one command
Install the single client, run one line, share the URL. No Python, OpenSSH or Docker needed on the machine that runs the tunnel.
Not open to the whole world
Allow or deny networks, set visitor passwords, limit rates and connections, block blocked-by-policy ports, and let tunnels expire on their own.
Your name, your relay
Use a Takelan address, bring a custom domain with automatic TLS, or run a private relay in your own network so traffic takes your path.
Built for scripts and agents
API keys, a Python client, a full OpenAPI reference, and an MCP endpoint that is read-only until you switch writes on.
See what happens
Per-tunnel logs, an opt-in request inspector with replay, traffic alerts by email, Slack, Discord or signed webhook, and an audit trail.
Affordable by design
Start free* with one active tunnel. When you outgrow it, the platform is built to stay affordable. Contact us about paid plans.
What you can do
Tunnels and protocols
- HTTP tunnels. Public HTTPS for web apps and APIs over HTTP/1.1, HTTP/2 and HTTP/3, with WebSocket support.
- TCP tunnels. Reach SSH, databases or game servers through a relay, with an optional PROXY protocol header for your app.
- UDP tunnels. Forward UDP services through a relay. Visitor IPs are not passed to UDP apps.
- Share a folder. tlomnigate tunnel --fileshare <dir> serves a read-only site behind a secret link. The fetch command downloads in parallel, resumes, and can verify or mirror.
- Expiring tunnels. Give a tunnel a time limit so a demo link does not stay open for ever.
- Profiles in a file. Describe tunnels in tlomnigate.yml, then bring them up and down with one command. Config check included.
- Agent mode. Run as a background daemon that retries and re-registers, with a local web GUI for status.
Custom domains and TLS
- Custom domains. Point your own hostname at an HTTP tunnel after DNS validation. Wildcards are refused to keep ownership clear.
- Automatic certificates. TLS certificates are issued through ACME for the platform host, and for direct hosts and private relays.
- Reserved subdomains. Keep the same Takelan name between sessions.
- Forward domains. Forward a name to an external HTTPS host once you prove you own the domain.
- Host header control. Rewrite the Host header, or add request and response headers. This fixes the common "invalid host header" error in dev servers.
Public and private relays
- Public relays. Use Takelan hosted relays and pick a region from the regions map.
- Private relays (satellites). Run a relay in your own network. Enroll it with a one-time token that expires in 24 hours.
- Fallback choice. Choose what happens if your private relay is down: nothing, or fall back to the shared relay.
- Relay failover and health. Failover and anomaly detection watch relays, with DNS TTL handled per relay.
Access and protection
- Network allow and deny lists. Allow or deny CIDR ranges, plus country allow and deny.
- Rate and connection limits. Cap requests and open connections per visitor.
- Visitor passwords. Passwords stored hashed, with schedules and validity windows, kept in a signed cookie.
- Port knocking. A signed UDP packet admits your IP for one hour on TCP or UDP tunnels.
- Claim links. A security mode where a visitor claims access with a one-time link.
- Real visitor IP. Forwarded headers are overwritten so your app sees the true client address.
- Webhook signature checks. Verify signed webhooks at the edge before they reach your laptop.
- Abuse guards. Blocked-port policy, abuse guards and risk scoring protect the platform and you.
Traffic rules engine
- Rules by phase. Write rules for the early, request, upstream, response and log phases, in YAML or JSON.
- Many actions. Deny, respond, redirect, rewrite path or query, set headers, tag, rate limit, limit bandwidth, compress and cache.
- Conditions. Match on time, visitor, status, response header or a random share of traffic.
- Safe changes. Draft, validate, dry-run, publish, diff and roll back. Shared rulesets can be reused across an account or organization.
- Visual designer and CLI. Edit rules in the dashboard with a live YAML view and test panel, or with tlomnigate rules.
Debug, hours and caching
- Request inspector. Opt in to capture requests, replay them, or hold them before they reach your app.
- Opening hours. Open a tunnel on a schedule, or switch on maintenance mode.
- Session recording. Record sessions on tunnels where you turn it on.
- CDN cache. Optional transparent caching with purge and stats. It does not support range requests or ETag revalidation.
- Traffic alerts. Alert by email, signed webhook, Slack or Discord at tunnel, account or organization level.
Pages and branding
- Visitor pages. Customize offline, app-down, paused, expired, password, access-denied, rate-limited and more.
- Logo and colours. Add your logo and brand colours, a terms-once page and a robots.txt.
- Scope and lock. Set pages per tunnel, account or organization, and let an organization lock them.
- Pages from the CLI. Manage pages with tlomnigate pages.
Accounts, keys and teams
- API keys. Create a key on the Account page and use X-API-Key or Bearer auth.
- Browser sign-in for the CLI. tlomnigate login opens your browser. Use --no-browser on a headless box.
- Two-factor sign-in. TOTP codes and account lockout protect logins.
- Organizations. Child organizations, delegated management and audited, time-limited "view as".
- Audit log. See who changed what, with metrics and exports.
Agents, API and clients
- MCP endpoint. tnl.tkln.dev/mcp exposes dozens of tools. Read-only by default, writes behind an owner switch.
- Dev Help for agents. /ai.md, /ai/<section>.md and /llms.txt are generated from the same registry as the in-app help, with curl, Python and TypeScript recipes.
- OpenAPI reference. Public /docs and /openapi.json for the full API.
- Python client. pytlomnigate from pip, with Docker label auto-tunnels and knock support.
- Linux and macOS client. One Rust binary for Linux and macOS (Intel and ARM), the tested platforms.
- Safe updates. tlomnigate update downloads from the Takelan CDN and verifies a SHA-256 checksum.
How it works
Install and sign in
Install the tlomnigate client, then run tlomnigate login. Your browser opens and you sign in. Or set an API key for scripts.
Start a tunnel
Run tlomnigate tunnel 3000 for a web app, or choose TCP or UDP. You get a public name with TLS right away.
Add rules
Set who may visit, with networks, passwords, hours and limits. Add a custom domain, a branded page or a traffic rule when you are ready.
Watch and adjust
Check logs, replay a request in the inspector, set alerts. When you want more control, enroll a private relay in your own network.
See how it works
A public URL for your local app
Shared relays and your own private relay
Traffic rules, in phases
Who it is for
Test a webhook on your laptop
Point a payment or chat webhook at your tunnel URL. Verify the signature at the edge, inspect the request, then replay it after a code change.
Reach a service inside a client site
Run a private relay at the client, then publish a TCP service through it. Keep the path on their network and turn the tunnel off when the job is done.
Demo an internal tool safely
Share a staging app with a branded page, a visitor password and an expiry time. Access ends on schedule without a firewall change.
Send big files without a cloud drive
Share a folder from your own machine with one command. The other side downloads with a resumable, verified fetch.
Works with
For ShadowCradle customers
Takelan Tunnels is a Takelan platform product you can use for your own apps, labs and client work. ShadowCradle also integrates with it as a third way to manage an appliance remotely, even when the ShadowCradle cloud is unreachable. It adds a protection layer that is separate from the ShadowCradle cloud.
Connected ShadowCradle organizations can use Takelan SSO and the free* services with one switch. This is optional. An Airgap licence works without any Takelan connection.
Takelan SSO is included when you connect. The link is optional and switched on in one place. The Airgap licence tier works without it. How this stays safe.
See the ShadowCradle side*Free within platform limits. Usage beyond limits may be charged to maintain the platform.
API, MCP and AI
Endpoints
GET /api/plan-catalogPublic plan catalog (no sign-in).GET /openapi.jsonPublic OpenAPI description of the full API.PUT /api/account/mcpOwner switch: allow MCP clients to change things. Audited.POST /mcpMCP endpoint. Streamable HTTP, JSON-RPC, POST only.
Example
# Call the MCP endpoint with your API key (placeholder shown)
curl -s https://tnl.tkln.dev/mcp \
-H "X-API-Key: $OMNIGATE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'MCP
POST https://tnl.tkln.dev/mcp serves dozens of tools. Auth is an API key or a login token; cookies are refused. Each tool runs one REST operation as you, so plan limits and the audit log still apply. It is read-only by default. Write tools appear only after the account owner turns on "Allow MCP clients to change things". Destructive tools also need confirm:true. Secrets are masked, admin tools are not offered, and calls are limited to 60 a minute. Docs resources are served as omnigate://ai.md.
AI
- No built-in AI assistant. The agent surface is documentation plus an API.
- /ai.md, /ai/<section>.md, /llms.txt and /llms-full.txt are public, with curl, Python and TypeScript recipes that use $OMNIGATE_API_KEY.
- Rules can be read, validated and tested over MCP. They cannot be published over MCP.
- MCP uses API keys only today. OAuth for MCP clients is not available.
- The MCP endpoint does not stream and keeps no sessions.
Security and trust
- MCP is read-only until an account owner turns writes on. The change is audited.
- Destructive MCP tools need confirm:true as well as writes on.
- MCP calls use your own permissions, plan limits and audit trail. Secrets are masked and admin tools are not exposed.
- MCP checks the Origin header, limits calls to 60 a minute, 256 KB request bodies and 200 KB output.
- The updater downloads from the Takelan CDN and verifies a SHA-256 checksum. It does not check a code signature today.
- Visitor passwords are stored hashed. Forwarded IP headers are overwritten, not trusted.
- Platform-wide blocked-port rules apply to the API and the relay.
See it
The public home page. Sign up free* and start a tunnel in minutes.
Affordable by design
Start free* with one active tunnel on a Takelan address. Contact us about paid plans. The platform is built to stay affordable as you grow.
*Free within platform limits. Usage beyond limits may be charged to maintain the platform.
See pricingCommon questions
How do I expose localhost to the internet?
Install the tlomnigate client, run tlomnigate login, then run tlomnigate tunnel 3000 (use your own port). You get a public HTTPS address that forwards to your local app.
Can I tunnel more than web apps?
Yes. HTTP tunnels support HTTP/1.1, HTTP/2, HTTP/3 and WebSocket. TCP and UDP tunnels go through a relay. Visitor IPs are not passed to UDP apps, and relay byte counts for TCP and UDP are not reported yet.
Can I use my own domain with a tunnel?
Yes, for HTTP tunnels. You prove DNS ownership of a hostname and TLS is handled for you. Wildcard domains are refused. Custom domains follow your plan limits.
What is the difference between a public and a private relay?
A public relay is run by Takelan. A private relay (satellite) runs in your own network and enrolls with a one-time token that expires in 24 hours. TLS passes through using a certificate the relay holds. CDN caching and server-side inspection are not available for tunnels that use only a private relay.
Can I control who sees my tunnel?
Yes. Use IP and country allow or deny lists, rate and connection limits, visitor passwords, port knocking, claim links and opening hours. You can also let a tunnel expire.
Is there a WAF or scripting?
A managed WAF and sandboxed Starlark scripts exist, but they are paid-plan features that an admin grants today. Contact us about paid plans. The standard rules engine, with request and response phases, is available now.
Does Takelan Tunnels have an MCP server for AI agents?
Yes. Use https://tnl.tkln.dev/mcp with an API key. It exposes dozens of tools. It is read-only by default, writes need the owner to switch them on, and destructive tools also need confirm:true.
Where are the docs for coding agents?
At tnl.tkln.dev/ai.md, /ai/<section>.md and /llms.txt. They list the same recipes as the in-app Dev Help and need no sign-in.
Which systems does the client run on?
Linux and macOS are the supported platforms. A Python client, pytlomnigate, is on pip.
Does it cost anything, and are updates signed?
You can start free*, which includes one active tunnel. Free within platform limits; usage beyond limits may be charged to maintain the platform. Contact us about paid plans. The updater verifies a SHA-256 checksum, not a signature.
More from the platform
Share what is running on your machine, safely.
Open Takelan Tunnels, create a free* account and publish your first tunnel in minutes.