MCP Tunnel Explainer: Private Network MCP Without Public Endpoints
A hands-on tutorial and code walkthrough showing how to wire a local Ollama MCP server behind an outbound-only encrypted tunnel — no public IP, no inbound firewall rules, yet agents still reach private enterprise tools.
- ▸guide.md — 10-section practitioner walkthrough (~5,200 words): compliance brief, architecture diagram, step-by-step setup, tunnel comparison, validation smoke test, hardening checklist, and troubleshooting table
- ▸server/main.go + Dockerfile — production-grade MCP server source with bearer-token auth, health endpoint, and two Ollama tools (ollama_generate, ollama_chat)
- ▸docker-compose.ollama-mcp.yml — full local stack with both services bound to 127.0.0.1 only
- ▸tunnel-start.sh — parameterized tunnel launcher for Cloudflare Tunnel, bore.pub, or Tailscale Funnel
- ▸mcp-server-config.json — annotated client config for Claude Desktop and the Python SDK
- ▸agent-test.py — Python smoke test that exits non-zero on failure (CI/CD ready)
- ▸hardening-checklist.md — standalone 10-item security checklist; shareable with your security team
- ▸ciso-explainer.md — compliance memo template covering HIPAA, NIST ZTA, and NSA MCP guidance
## goes-well-with
From the same shelf
Agentic Migration Playbook: API Endpoint Modernization
For DevOps and platform engineers with a real migration deadline — the complete Claude Code workflow you'd otherwise spend months reverse-engineering.
MAESTRO Security Framework for Claude Code Projects
Apply the MAESTRO 7-layer threat-modeling framework to any autonomous Claude Code / Agent SDK project — enumerate threats across the whole chain and fill in a reusable threat model for your own stack.
Prompt Injection Defense Toolkit for Claude Code Users
Detect injected instructions in fetched content, audit tool call chains, and run agentic workflows safely — the prompt injection defense guide Anthropic hasn't written yet.
## not-ready-to-buy
Take the field notes instead
One practical write-up a week from the same workbench these kits come from — plus reader pricing when new kits ship.