Tunnels — expose a local port on a public tunnel-{name}.maxoperf.com URL
A tunnel exposes a port on your machine — or anywhere else something is listening — on a public, TLS-terminated URL: https://tunnel-<name>.maxoperf.com. It’s MaxoPerf’s reverse-tunnel service, in the same family as ngrok, but completely free on every plan: tunnels are never billed, on any tier.
npx @maxoperf/tunnel http 3000✔ guest tunnel online https://tunnel-swift-otter-7f3.maxoperf.com → http://127.0.0.1:3000That’s the entire zero-signup path — no account, no API key, no config file. See Create a tunnel for the full CLI, console, and API flows.
Why you’d use one
Section titled “Why you’d use one”- Show someone a local build. Point a teammate, a client, or a webhook provider at a URL that reaches your laptop.
- Test webhooks against a local server. Stripe, GitHub, or any provider that needs a public callback URL can hit your tunnel and forward straight to your local dev server.
- Expose a MaxoPerf virtual service or run for external access without deploying it anywhere else first.
- Quick demos. A tunnel URL is live the moment the CLI connects — no deploy pipeline.
Guest mode vs. an account tunnel
Section titled “Guest mode vs. an account tunnel”| Guest mode | Account tunnel | |
|---|---|---|
| Setup | npx @maxoperf/tunnel http <port> — nothing else | Create via console/API/MCP first, then run the CLI with its token |
| Subdomain | Auto-generated (e.g. swift-otter-7f3), stable across runs on the same machine | You choose the name |
| Concurrent tunnels | 1 | 10 on the free tier, up to 200 on Pro, unlimited on Enterprise |
| Access controls (IP allow/deny, basic/bearer auth, rate limit) | Fixed, safe defaults; not configurable | Fully configurable |
| Request capture (headers/body, for the inspector + replay) | Off | Configurable (headers or headers+body) |
| Idle timeout | Fixed at 1 hour | Configurable (default 1 hour) |
The guest identity is a durable token the CLI saves locally (~/.maxoperf/tunnel.json, file mode 0600), so re-running the CLI on the same machine reuses the same URL every time — until you claim it into an account or it expires. Claiming keeps the URL and unlocks the account-tunnel feature set above, with no downtime.
What every tunnel gets
Section titled “What every tunnel gets”- Real TLS, terminated at the edge — no interstitial page, no “click through” warning.
- WebSocket and SSE pass straight through — nothing about the tunnel breaks a websocket-based dev server or a streaming endpoint.
- Automatic reconnect. If your local network drops, the CLI reconnects with backoff and the tunnel comes back online on the same URL.
- Full traffic statistics — request counts, error rates, latency percentiles, and bytes in/out, on a live timeline (account tunnels; see Create a tunnel).