class

Anthropic::BetaTunnels

MCP Tunnels API resource (beta / research preview).

Requires the mcp-tunnels-2026-06-22 beta header and may change without a deprecation period. Supersedes Admin API endpoints at /v1/organizations/tunnels during a migration window.

Auth: tunnel management endpoints (create/list/archive/certificates/ reveal_token/rotate_token) require a bearer token with the workspace:manage_tunnels scope from Workload Identity Federation. Standard ANTHROPIC_API_KEY / admin API keys are not accepted and return 401. Using a tunnel URL from Messages (mcp_servers) still uses a normal workspace API key + the MCP client beta — that is separate.

Creation allocates a fresh hostname; the tunnel rejects MCP traffic until at least one CA certificate is added via certificates.

# Client must be configured with a WIF-exchanged bearer that has
# workspace:manage_tunnels (not a plain API key).
tunnel = client.beta.tunnels.create(display_name: "prod-gateway")
token = client.beta.tunnels.reveal_token(tunnel.id)
cert = client.beta.tunnels.certificates.create(
  tunnel.id,
  ca_certificate_pem: File.read("ca.pem"),
)

Constructors

new(client : Client)

Source

Instance methods

archive(tunnel_id : String, betas : Array(String) = [] of String) : BetaTunnel

Archive a tunnel irreversibly (certificates archived, hostname retired, token invalidated). Retrying an already-archived tunnel is a no-op.

Source

certificates

Source

create(display_name : String | Nil = nil, betas : Array(String) = [] of String) : BetaTunnel

Create a tunnel. Not idempotent; allocates a fresh hostname.

Source

list(include_archived : Bool | Nil = nil, limit : Int32 = 20, page : String | Nil = nil, betas : Array(String) = [] of String) : BetaTunnelListResponse

List tunnels (newest first). Archived tunnels excluded unless include_archived is set.

Source

retrieve(tunnel_id : String, betas : Array(String) = [] of String) : BetaTunnel

Retrieve a tunnel by ID.

Source

reveal_token(tunnel_id : String, betas : Array(String) = [] of String) : BetaTunnelToken

Reveal the tunnel's connector token (POST so it stays out of access logs). Repeated calls return the same value until rotated.

Source

rotate_token(tunnel_id : String, reason : String | Nil = nil, betas : Array(String) = [] of String) : BetaTunnelToken

Rotate the connector token. Invalidates the current value for new connections; established connections are not severed.

Source