Why we built Cruma
Why Cruma exists: a tunnel with a desktop app, a local web server and reverse proxy, end-to-end TLS on your own domain, and MCP for coding agents.
If you write software, you've hit this. Something runs fine on localhost:3000, and now someone else needs to reach it: a client clicking through a preview, a webhook from a payment provider, your own phone. Or your homelab sits behind a router you don't control, with no public IP at all.
A tunnel fixes that. A small agent on your machine makes an outgoing connection to a relay, and the relay gives you a public HTTPS address that leads back to it. There's nothing to open on the router, and it works behind CGNAT and strict firewalls.
There are good tunnels out there already. I built Cruma because I wanted one that does more of its work on my own machine and shows me what's going on. Here's what that means in practice.
One command to start
cruma proxy http localhost:3000
You get an address like random-id.tun.cruma.io that you can send to anyone. No account, no config file. To share a folder instead, run cruma serve ./www: the agent serves the files itself, so there's no separate web server to set up.
A desktop app that shows every request
Most of my tunnel debugging used to be guessing. Did the webhook arrive? Where did that 502 come from?
Cruma comes with a desktop app for Windows, macOS and Linux, plus a terminal UI for SSH sessions and servers. Turn on recording and every request through the agent shows up with its headers, body and timing. Copy one as a curl command to replay it, or hand it to the built-in assistant and ask what went wrong. Statistics, logs and a service map are there too.
The request logs stay on your machine. They aren't uploaded to a dashboard somewhere.
The agent is a real web server
The part I'm happiest with is that the agent isn't just a pipe. It's a full local web server and reverse proxy that speaks HTTP/1.1, HTTP/2 and HTTP/3, and the tunnel is one of the ways traffic gets into it. So from one agent you can:
- route several hostnames to different local services,
- let the agent start your app, restart it if it crashes, or start it only when the first request arrives,
- put a sign-in in front of any site (OAuth2/OIDC, a login form, JWT or API keys) without changing your app,
- allow or drop traffic by IP, hostname or port with a built-in firewall.
All of it runs locally, configured from one YAML file or the app.
End-to-end TLS on your own domain
When you put your own domain on a tunnel, TLS usually ends at the provider's edge. They hold the certificate, so your traffic is in plaintext there.
On Cruma's Basic and Pro plans you point a CNAME at your tunnel and the agent gets its own certificate from Let's Encrypt, automatically. TLS ends on your machine. Cruma forwards the encrypted stream and can't read it. Certificates and private keys stay on your machine.
On anonymous and free tunnels, TLS ends at Cruma's edge. I'd rather say that plainly than bury it. The Security chapter has the details.
Built for coding agents too
A lot of us now have Claude Code or Codex open next to the editor. Cruma has an MCP server (cruma mcp), a Claude Code plugin and a skill for other agents. Ask "expose my dev server on port 3000" and your coding agent installs Cruma if it's missing, asks you to confirm, and replies with the public URL. It always asks before it makes anything public. See Coding agents.
What's free
- Anonymous: no account at all. A tunnel runs for up to 3 hours per session, with up to 1 GiB of traffic per session. Browser visitors see a warning page first;
curland webhooks pass straight through. - Free account: no time limit and up to 3 GiB of traffic a day, for personal, non-commercial use.
- Basic ($5/month) adds custom domains, end-to-end encryption and TCP ports, and drops the browser warning. Pro ($10/month) removes the speed cap per channel, gets priority under load and runs up to three load-balanced agents.
Basic and Pro have no monthly cap. A full-speed allowance refills continuously, and sustained heavy use beyond it slows down instead of being cut off. Rate limits has the exact numbers. We're a small team, and those limits keep shared capacity fair.
Where it's going
This is what we're building next:
- Agent web UI: your agent's dashboard in a browser, for servers, NAS boxes and Raspberry Pis with no desktop.
- Domain registration: buy and renew domains in the Cruma dashboard, set up on Cruma DNS and ready for your tunnel.
- UDP port forwarding, the way TCP ports work today.
- Container hosting: the agent runs your Docker or Podman containers and routes traffic to them.
- Kubernetes ingress: a Cruma Ingress/Gateway controller for cluster services.
Try it
Download the agent, run cruma proxy http 3000 against whatever you're working on, and send the link to someone. If something breaks or feels wrong, tell me at [email protected].