Skip to main content

​
Reachable by default

Your admin panel, your database GUI, your .env, the rest of your dev site — none of it is reachable through the tunnel unless you pass --all-paths.

​
Who can reach the URL

Anyone who has it. The slug is unguessable, but it is not a secret: it appears in your terminal, in the inspector, and in the config file of every client you paste it into. Treat the URL as unlisted, not private. If the data behind it matters, add --bearer.

​
What HeyMCP sees

The edge parses MCP frames as they pass, which is how the timeline exists. That means:
  • Request and response payloads are stored for the length of your retention window — 24 hours on Hobby, 7 days on Pro. That includes tool arguments and tool results.
  • Payloads over 256 KB are truncated in storage, but forwarded to the client whole.
  • Bearer tokens are not stored. The Authorization header is stripped at the edge before anything else happens, and only the fact that one was required is recorded.
If you’re pointing a tunnel at something with real customer data in it, that retention is the thing to think about. heymcp export gets you a copy; closing the session doesn’t delete history early.

​
What your local server sees

Requests arrive as ordinary local HTTP, with:
  • The Host header rewritten to your local target
  • X-Forwarded-Host set to the public hostname
  • X-Forwarded-Proto: https
  • Any Authorization header removed if you used --bearer
  • content-type, accept, mcp-session-id, user-agent and mcp-protocol-version preserved as sent
Hop-by-hop headers, content-length and transfer-encoding are dropped and regenerated, as any proxy must.

​
--all-paths

This forwards every path to your local server. That is your whole development environment, publicly, to anyone with the URL. It exists because some setups genuinely need it — an OAuth flow on a non-well-known path, a health check, MCP mounted somewhere unusual. Use it deliberately, and pair it with --bearer.

​
Reducing exposure

Close the tunnel

Ctrl-C. The URL immediately returns 503. Nothing is reachable while heymcp share isn’t running.

Use --bearer

One flag, works with every client but Claude.ai.

Point at a scratch server

If you’re debugging schemas rather than data, a fixture server is a better target than your real app.

Roll your CLI token

From your profile page, if the token was ever exposed.