Tunneling

DevOps & Security

tunneling

Tunneling is an Agent Skill for devops & security published in the tinyfish-io/tinyfish-cookbook repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Expose local ports to the internet as public HTTPS URLs using tinyfi.sh SSH tunnels. Use when you need to expose a locally running app, test webhooks, or give TinyFish access to a site that is only hosted locally — tunnel it first, then point TinyFish to the tunneled URL. No signup, no API key, no installation beyond SSH.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/tinyfish-io/tinyfish-cookbook/blob/HEAD/plugins/tinyfish/skills/tunneling/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/tunneling, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

TinyFish Tunneling (tinyfi.sh)

Create instant public HTTPS URLs for locally running apps via SSH tunneling. Free, no account, no installation beyond SSH.

Pre-flight Check (REQUIRED)

which ssh && echo "SSH available" || echo "SSH not found — install OpenSSH first"

If SSH is not available, stop and tell the user to install OpenSSH.

Quick Start

Warning: This exposes your local service to the public internet. Do not tunnel admin panels, debug endpoints, or services that expose secrets or credentials.

ssh -o StrictHostKeyChecking=accept-new -R 80:localhost:<PORT> tinyfi.sh

Replace <PORT> with the port your app is running on. The command prints a public https://<random>.tinyfi.sh URL.

Note: StrictHostKeyChecking=accept-new automatically trusts the tinyfi.sh host key on first connection and rejects changes on subsequent connections. If you require stricter verification, manually confirm the server fingerprint before first use.

Custom Subdomain

Request a specific subdomain instead of a random one:

ssh -o StrictHostKeyChecking=accept-new -R myname:80:localhost:<PORT> tinyfi.sh

This gives you https://myname.tinyfi.sh.

Keep-Alive (Stable Connections)

For long-running tunnels, add a keep-alive interval to prevent disconnection:

ssh -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=60 -R 80:localhost:<PORT> tinyfi.sh

Usage Guidelines

When starting a tunnel for the user:

Ask which port to expose if not already specified
Run the SSH command in the background so the agent can continue working
Report the public URL back to the user once the tunnel is established
The tunnel stays open as long as the SSH connection is alive

Common Ports

Framework / Tool	Default Port
Next.js / React / Express	3000
Vite	5173
Django	8000
Flask	5000
Go (net/http)	8080
Ruby on Rails	3000
PHP (built-in)	8000

Rate Limits

5 SSH connections per minute per IP
100 HTTP requests per minute per IP
50 concurrent connections max
48-hour idle timeout

$ARGUMENTS