Client compatibility

mcppipe is vendor-neutral by design: the same public host answers every MCP-capable client at once. There is no per-vendor build, no allowlist of “supported agents”, and nothing to switch on. The single-vendor tunnels shipped by the model providers in May 2026 cannot do this — Anthropic’s MCP Tunnel only serves Managed Agents and the Messages API, and OpenAI’s Secure MCP Tunnel only serves ChatGPT / Codex / Responses / AgentKit. mcppipe answers all of these clients on a single host.

How a client reaches your tunnel

Every client connects to your tunnel the same way: over Streamable HTTP at your tunnel’s public URL. Each account gets its own namespace, so a tunnel’s public host is https://<subdomain>--<account-slug>.<zone>/mcp — for example https://notes--acme.mcppipe.dev/mcp. (Bringing your own FQDN instead is covered in Custom domains & TLS.)

There is no special header to set and no interstitial / browser-warning page in the way — mcppipe relays the upstream response verbatim, so a client (or a plain curl) gets your MCP server’s bytes directly, on every tier. (Generic free tiers like ngrok’s inject an anti-phishing HTML page that breaks demos until you click through or send ngrok-skip-browser-warning; mcppipe never does.)

The up command prints a ready-to-paste config snippet for whichever client you name. Below is the matrix of what we test and recommend.

Compatibility matrix

Every client below speaks Streamable HTTP. What differs is the config key each one uses and — for the two cloud clients — whose IP the request arrives from. Each has a setup page with the exact entry and file path.

Client	Config key	Where the request comes from	IP preset
Claude Desktop	mcpServers	Your machine	Your own IP
Claude web / Managed Agents	Added in the workspace UI	Anthropic	Anthropic (or Multi-LLM)
ChatGPT (connectors)	Added in the connector UI	OpenAI	OpenAI (or Multi-LLM)
Cursor	mcpServers (url or endpoint)	Your machine	Your own IP — see the note below
Windsurf	mcpServers	Your machine	Your own IP
VS Code (Copilot / MCP)	mcp.servers — not mcpServers	Your machine	Your own IP
Cline	mcpServers	Your machine	Your own IP
Continue.dev	experimental.modelContextProtocolServers	Your machine	Your own IP
Zed	context_servers	Your machine	Your own IP

The “where the request comes from” column is the one that decides your IP allowlist entry, and it is the most common source of a 403 ip_forbidden — a desktop client needs your own egress IP, a cloud agent needs the vendor’s range.

Note

mcpServers is what mcppipe up prints, and most clients take it verbatim. Three do not: VS Code nests it under mcp, Zed calls it context_servers, and Continue.dev buries it under experimental. Auto-detect reads all of these shapes; only the block you paste by hand needs adjusting.

These are also the clients the CLI auto-detects when you run mcppipe up without an explicit --upstream — see the CLI reference for how detection picks up each client’s local config file.

Note

“Tested” means the transport (Streamable HTTP, including SSE responses and Mcp-Session-Id resume) is exercised end-to-end against a real tunnel using the official MCP SDK client. Per-client UI wiring (where you paste the snippet) follows each client’s own docs.

IP presets and the “Multi-LLM” one-click

If you lock a tunnel down with an IP allowlist, the dashboard offers one-click presets for the major vendors’ published egress ranges. The presets are, in display order:

• Multi-LLM (Anthropic + OpenAI) — the recommended vendor-neutral default.
• Anthropic Claude — Anthropic’s published Claude API egress range.
• OpenAI (ChatGPT / API egress) — OpenAI’s published egress (ChatGPT, Codex, Responses).
• Google AI (Vertex) — Google Vertex AI egress (snapshot).

The Multi-LLM preset expands to the union of the Anthropic and OpenAI egress ranges, so a single click makes the tunnel reachable by both vendors’ agents at once. Picking a preset expands into its CIDRs at the moment you click; the ranges are maintained snapshots, not auto-refreshed — re-check the box if a vendor rotates its range. Use the Custom free-form CIDR field for anything not covered by a preset.

A note on Cursor

Cursor is not offered as a one-click preset, and is deliberately left out of the Multi-LLM union. Cursor’s only MCP-relevant egress is its Cloud Agent range, which Cursor documents as not stable (“we make changes to our IP addresses from time to time”, served per-cluster via a JSON API); the only ranges Cursor calls stable are its git egress proxy, which never reaches your MCP server. Pinning an unstable third-party range as a preset would make a promise we can’t keep. To restrict a tunnel to Cursor, use the Custom CIDR field with the current values from Cursor’s JSON API — the dashboard accepts any CIDR there, and you re-check it when Cursor rotates its range.

Most clients (Claude Desktop, Cursor, Windsurf, VS Code, Cline, Continue.dev, Zed) connect from your own machine or network, so the relevant allowlist entry is your own egress IP — not a vendor’s. Vendor presets matter for cloud-hosted agents (Claude Managed Agents, ChatGPT connectors) that reach your tunnel from the provider’s infrastructure.

Authenticating clients

The matrix above covers transport reachability. If a tunnel has authentication enabled, the client must also present a credential: a per-tunnel API key, an OAuth 2.1 Bearer token, or a Service Token for headless agents. See Authentication: OAuth & Service Tokens for how each client attaches a token and how mcppipe validates it.