Runlayer and Anthropic MCP Tunnels: connecting Claude to systems behind your firewall
Today, Anthropic shipped MCP Tunnels. Runlayer and Anthropic collaborated on this product, and the Runlayer platform supports MCP Tunnels today.
If you use Claude Code, Claude Cowork, or Claude Design, then you’ve already hit a security wall. Claude lives and executes within Anthropic servers. Meanwhile, your Jira, telemetry, internal APIs, and databases exist within your private network. This topology mismatch is an issue: connecting to Claude means exposing your internal systems to the public Internet.
Until recently, the only solution was poking exceptions in your firewall restrictions for Claude or compromising on Claude’s access. Anthropic has shipped a fix: MCP tunnels. Runlayer serves as the customer-side layer to deploy these tunnels to production.
The constraint
Every Claude rollout hits the same wall: the model is outside your network. The tooling that makes it useful is inside, and the default path to connect them is opening inbound ports for MCP servers. That's a non-starter in financial services, healthcare, and anywhere with a real compliance posture. Teams either give Claude a stripped-down slice of context and throw away most of the value, or they break their security posture and hope nobody notices.
How MCP Tunnels flip the direction
Anthropic's design inverts the connection, using a reverse tunnel so traffic is always outbound-initiated. Your network reaches out to Anthropic instead of Anthropic reaching in.
Here's how it works:
- You deploy a tunnel endpoint inside your network using Docker Compose or a Helm chart, pointed at Runlayer and your MCP servers. This serves as the inbound access point.
- On Anthropic's side, an internal service called Toolbox acts as the MCP client. Toolbox brokers MCP calls across every Anthropic surface: Claude Code, Claude Enterprise, and agentic products.
- The tunnel uses end-to-end mTLS, with Anthropic layering its own encryption on top of that, independent of the underlying channel. The keys stay with you. A transport-layer exposes no customer data with no cross-customer commingling.
- OAuth handles MCP-level auth on top of the secured channel.
The architecture was designed for companies where the answer to "can we open an inbound port" is always no.
What Runlayer handles on the customer side
The tunnel handles the connection. But it doesn't dictate what MCP servers are available, what groups reach which tools, or what policies apply. That's Runlayer's job.
One endpoint, many MCP servers. Runlayer's gateway aggregates your MCP servers behind a single endpoint, with access scoped by group. Engineering gets one toolset, marketing gets another, but everyone gets a shared baseline. The same identity policies you already enforce apply here. Runlayer integrates with Okta and Entra out-of-the-box.
One-click install, every Claude surface. Before the tunnel, every Anthropic client (Claude Code, Claude.ai, Claude Desktop) was its own configuration silo. With Runlayer behind the tunnel, every surface picks up your MCP servers automatically. That means no per-client setup, no drift between them.
Real-time scanning. Runlayer scans your MCP traffic for prompt injection, tool poisoning, and data exfiltration attempts, powered by internal models trained on emerging exploits.
SIEM-ready events. Runlayer provides audit events that are OTel exportable, so you can integrate Claude tool telemetry with your existing observability stack.
As Claude work moves to async, cloud-side execution, the access pattern shifts from developers to cloud processes reaching MCP servers. Per-laptop installations don't scale to that. Runlayer does.
We worked with Anthropic on this
We worked with Anthropic through the MCP Tunnels development process. We've seen firsthand where enterprise teams hit friction: identity policy gaps, per-client config drift, and poor observability of Claude’s tool calls. We've shaped Runlayer's integration around those specific failure points, and we run this architecture internally ourselves.
What changes for enterprise rollouts
MCP Tunnels removes the two blockers that made MCP impractical for regulated environments: inbound network exposure and per-developer credential sprawl. With Runlayer behind MCP Tunnels, you get:
- Claude with real access to internal systems, without opening your network
- Centralized auth and policy through your existing IdP
- Consistent tool access across every Anthropic surface
- A deployment shape that scales from one team's pilot to org-wide production
Book a demo. We'll show you exactly how it fits your environment.
