Anthropic Knowledge Hub

Workflow: MCP Tunnels Architecture ​

Updated: 2026-05-26

How MCP tunnels route requests between Claude and external tool servers.

flowchart LR
    A[Claude Model] -->|tool_use request| B[Your Application]
    B -->|HTTP over TLS| C[MCP Tunnel]
    C -->|Forward| D[External Tool Server]
    D -->|Response| C
    C -->|Relay| B
    B -->|tool_result| A

    subgraph Your Infrastructure
        C
        D
    end

    subgraph Client
        B
    end

    subgraph Anthropic Servers
        A
    end

Phases ​

Phase 1: Tunnel Setup ​

Configure a tunnel in the Admin console with your server endpoint and authentication. The tunnel creates a secure TLS connection between Anthropic infrastructure and your tool server.

Phase 2: Request Routing ​

When Claude decides to use a tunneled tool, your application sends the tool_use request through the tunnel. The tunnel forwards the request to your external server without exposing internal network details.

Phase 3: Tool Execution ​

Your external server processes the request and returns the result. The tunnel relays it back to your application, which formats it as a tool_result and sends it to Claude.

Phase 4: Security Controls ​

Tunnels enforce least-privilege access. Only explicitly configured tools are accessible. Credentials are managed through the tunnel, not shared with the application.

See Also ​