An MCP Gateway tunnel connects MCP clients and AI assistants to tools running on your device through a public gateway. The Localtonet client runs the gateway for you, and the tunnel gives it a public HTTPS address.
What it is #
The Model Context Protocol (MCP) lets an AI assistant call tools. An MCP gateway sits in front of the MCP servers you run and offers all their tools through one endpoint.
When you start an MCP Gateway tunnel, the Localtonet client starts a gateway on your device and Localtonet publishes it at the tunnel's address. You do not enter a local IP or port. The gateway has:
- a web dashboard at
https://<ADDRESS>/dashboard, where you register MCP servers and create client tokens; - the MCP endpoint at
https://<ADDRESS>/mcp, which your MCP clients connect to.
Not the same as the Localtonet MCP server. This page is about publishing your own tools. To let an AI assistant manage your Localtonet account (tunnels, tokens and so on), see MCP server.
Before you start #
- The Localtonet client is running on the device and is connected with an AuthToken. See Quick start.
- The client is new enough. Minimum Localtonet App versions required to use this feature:
Desktop v7.8,Mobile v10.1.
Create the gateway #
-
Open the MCP Gateway page #
Open My Tunnels › MCP Gateway and expand Create MCP Gateway Tunnel.
-
Fill in the form #
Field What to enter URL type Random subdomain, Custom subdomain or Custom domain. See the table below. Device token The token of the device that runs your tools. Server region The server your MCP clients connect to. Subdomain Shown for Custom subdomain: the name you want. Domain The domain of the address. Select Create tunnel.
-
Start the tunnel #
The gateway appears under Your tunnels. Select Start. The URL column shows the public address.
URL types #
| URL type | Address you get | Notes |
|---|---|---|
| Random subdomain | A generated name under the domain you select. | Good for a first test. |
| Custom subdomain | The Subdomain you enter under the Domain you select. | Needs Balance. |
| Custom domain | One of your own domains. | Needs Balance. The Domain list shows your domains; if it is empty, create a domain from DNS Manager first. See Custom domains. |
Gateway Token #
Every MCP Gateway tunnel gets its own Gateway Token when it is created. It is the gateway's admin token: the gateway dashboard and its management API accept changes only with it.
- Select the Settings icon of the tunnel.
- Next to Gateway Token, select Manage. The Gateway token window shows the token with the middle hidden.
- Select the copy button next to the token. It always copies the full token. The show button next to it reveals the token on screen.
Keep the Gateway Token private. It gives full control of the gateway: its servers, tools and client tokens. Do not put it into an MCP client; clients use their own token.
Connect an MCP client #
-
Open the gateway dashboard #
With the tunnel started, open
https://<ADDRESS>/dashboardin a browser. Paste the Gateway Token into the Admin token field at the bottom of the side menu. -
Register your MCP servers #
Open Servers and select Add Server. A server can be an MCP server reached by URL (Streamable HTTP or SSE), a local command (stdio) or an OpenAPI service. Catalog lists ready-made MCP servers you can install, and Tools shows the tools the gateway collected from all servers.
-
Create a client token #
Open Clients and select New Client. Enter a Name and select Create Client. The gateway shows the Client Token once: copy it now, it will not be shown again. In the client list, Allowed Servers and Allowed Groups show which servers and tool groups a client may use.
-
Point the MCP client at the gateway #
In your MCP client or AI assistant, add a remote MCP server with these two values:
MCP client settingsURL: https://<ADDRESS>/mcp Header: Authorization: Bearer <CLIENT_TOKEN>Where you enter them depends on the client; follow its own documentation for remote (HTTP) MCP servers.
The dashboard's Audit Log shows recent gateway requests, and Settings holds the gateway configuration with backup and restore.
The gateway stores its servers, groups, clients and audit log on your device, in a folder named mcp-data-<TUNNEL_ID> in the working directory of the Localtonet client (on Android, inside the app's own storage). <TUNNEL_ID> is the number in the ID column, so each MCP Gateway tunnel has its own folder.
Settings #
Select the Settings icon of the tunnel to open Tunnel settings.
| Setting | What it does | More |
|---|---|---|
| Load Balance | Distribute traffic across devices or use a backup when a target is unavailable. | Load balancing |
| Is Only Https? | Use HTTPS only for the public tunnel endpoint. | Settings reference |
| Basic Authentication? | Require a username and password to access this tunnel. | Access control |
| Is HTTP/3 Active? | Allow clients to connect to the public endpoint using HTTP/3. | Settings reference |
| Legacy Connect? | Try this if the tunnel cannot connect using the normal connection method. | Settings reference |
| Gateway Token | Manage the access token for this MCP Gateway. | See above |
| HTTP Timeout | How long the server waits for a response from your local application before aborting the request, from 1 to 600 seconds. Leave it empty to use the server default. | Settings reference |
| Tunnel Note | Save a private note to help you identify or document this tunnel. | Settings reference |
| IP Restriction | Control which client IP addresses can access this tunnel. | Access control |
| Expiration Date, Speed Limits, Bandwidth Limit, Bandwidth Usage | Expiry date, upload and download speed limits, a data transfer limit, and Clear to reset the recorded usage. | Limits and expiration |
| Outbound Port | Choose a fixed outbound port for the Localtonet app's server connection. | Ports |
| Bandwidth Traffic, Request Log, Activity Log, Tunnel Health | Traffic over time, recorded requests, starts, stops and setting changes, and recent health check results. | Logs and inspection |
In the tunnel list, the Webhooks column has a View request & response logs button that opens the request inspector for a started tunnel. See Logs and inspection.
Troubleshooting #
The gateway does not start or the address does not answer
Check the Localtonet app version on the device: MCP Gateway needs Desktop v7.8 or Mobile v10.1 at least. Then check that the tunnel is started and the Connection column shows the device as connected.
The gateway dashboard does not load its data
The dashboard's management requests need the admin token. The Admin token field is empty or wrong. Copy the Gateway Token again from the tunnel's Settings and paste it into the field.
The MCP client is rejected
The MCP endpoint needs a client token in the Authorization: Bearer header. Create one under Clients in the gateway dashboard and use it here, not the Gateway Token.
"Please start your tunnel first."
The request inspector is only available while the tunnel is started.
"You must create a Domain from DNS Manager!" or "WARNING! You do not have any Domain!"
Custom domain needs one of your own domains. Add it in DNS Manager, or choose another URL type.
"You need to purchase balance to use this feature."
Custom subdomain and Custom domain need Balance. Use Random subdomain or add Balance. See Plans and Balance.
