> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heymcp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# What is exposed

> Exactly what a HeyMCP tunnel makes reachable, and what it doesn't.

## Reachable by default

| Path                                 | Reachable                                |
| ------------------------------------ | ---------------------------------------- |
| `/mcp`                               | Yes                                      |
| `/mcp/*`                             | Yes                                      |
| `/.well-known/*`                     | Yes                                      |
| Everything else on your local server | **No** — 404 with JSON-RPC code `-32003` |
| Anything containing `..`             | **Never**, whatever your settings        |

Your admin panel, your database GUI, your `.env`, the rest of your dev site —
none of it is reachable through the tunnel unless you pass `--all-paths`.

## Who can reach the URL

Anyone who has it. The slug is unguessable, but it is not a secret: it appears
in your terminal, in the inspector, and in the config file of every client you
paste it into.

Treat the URL as **unlisted, not private**. If the data behind it matters, add
[`--bearer`](/security/authentication).

## What HeyMCP sees

The edge parses MCP frames as they pass, which is how the timeline exists.
That means:

* **Request and response payloads are stored** for the length of your
  [retention window](/account/plans-and-limits) — 24 hours on Hobby, 7 days on
  Pro. That includes tool arguments and tool results.
* **Payloads over 256 KB are truncated in storage**, but forwarded to the client
  whole.
* **Bearer tokens are not stored.** The `Authorization` header is stripped at
  the edge before anything else happens, and only the fact that one was required
  is recorded.

If you're pointing a tunnel at something with real customer data in it, that
retention is the thing to think about. `heymcp export` gets you a copy; closing
the session doesn't delete history early.

## What your local server sees

Requests arrive as ordinary local HTTP, with:

* The `Host` header rewritten to your local target
* `X-Forwarded-Host` set to the public hostname
* `X-Forwarded-Proto: https`
* Any `Authorization` header **removed** if you used `--bearer`
* `content-type`, `accept`, `mcp-session-id`, `user-agent` and
  `mcp-protocol-version` preserved as sent

Hop-by-hop headers, `content-length` and `transfer-encoding` are dropped and
regenerated, as any proxy must.

<h2 id="all-paths">
  `--all-paths`
</h2>

```bash theme={null}
heymcp share 8000 --all-paths
```

This forwards **every** path to your local server. That is your whole
development environment, publicly, to anyone with the URL.

It exists because some setups genuinely need it — an OAuth flow on a
non-well-known path, a health check, MCP mounted somewhere unusual. Use it
deliberately, and pair it with `--bearer`.

## Reducing exposure

<CardGroup cols={2}>
  <Card title="Close the tunnel" icon="power-off">
    Ctrl-C. The URL immediately returns 503. Nothing is reachable while
    `heymcp share` isn't running.
  </Card>

  <Card title="Use --bearer" icon="key" href="/security/authentication">
    One flag, works with every client but Claude.ai.
  </Card>

  <Card title="Point at a scratch server" icon="flask">
    If you're debugging schemas rather than data, a fixture server is a better
    target than your real app.
  </Card>

  <Card title="Roll your CLI token" icon="rotate" href="/account/signing-in">
    From your profile page, if the token was ever exposed.
  </Card>
</CardGroup>