Public Access
By default the service listens on loopback only. Turn on the built-in tunnel and AI apps on your phone or agents anywhere on the internet can reach your computer through one HTTPS domain — no public IP, no port forwarding.
Enable
Flip the "FRP tunnel" switch on the panel. Every enabled workspace then gets a public endpoint (shown on its card):
https://<domain>/mcp/<uuid>Paste the public endpoint into any MCP client (mobile Claude, cloud agents, …) — usage is identical to the local address.
Route retention (LRU)
In public mode each workspace is an independent route. Routes idle for a long time are recycled (least-recently-used first), but never below the minimum retained count of your tier:
| Tier | Minimum retained routes |
|---|---|
| standard | 3 |
| mid | 5 |
| premium | 10 |
A recycled route restores itself the moment the workspace is used locally again or the tunnel restarts.
Security boundaries
The tunnel puts your workspace on the internet. Follow these rules:
- Expose only what is needed: not every project needs public reachability — disable the rest;
- The endpoint is the key: never post public URLs to chats, screenshots or public repos;
- Trust the other side: any connected AI service can read and modify the workspace and run commands;
- The control panel and local admin surface are never exposed through the tunnel (loopback only).
Throughput
The tunnel is built on frp (the official client embedded), with multiplexing and auto-reconnect built in; it rebuilds itself after network loss. It is well suited to code I/O, search and command output — text-dense work — not to streaming large files at high frequency.
Troubleshooting
Switch on but the public endpoint is dead? The panel shows the tunnel's startup error (license not activated, server unreachable, …); fix per the hint and toggle again.
Phone cannot connect? Make sure you use the public endpoint (the https domain), not 127.0.0.1, and that the workspace is enabled.