Teleport your local MCP tools to any agent, anywhere.
Share the capability, never the credentials.
mcpwire exposes a local MCP server (Postgres, GitHub, Docker, your filesystem…) to a teammate's Claude or Cursor through an encrypted peer-to-peer tunnel — with a layer-7 tool firewall, secret redaction, human approval and a self-destruct timer. No cloud. No relay. $0 infra, forever.
L7 JSON-RPC Firewall
Whitelist 3 tools out of 25. The peer's LLM never even learns the destructive ones exist — tools/list is filtered at your edge.
Real-time DLP
API keys, JWTs, emails and card numbers in tool output are redacted to [REDACTED_BY_MCPWIRE] before crossing the tunnel.
Human-in-the-Loop
--confirm freezes each tool call on the wire until you press y/n in the host terminal. Agents ask. You decide.
Ephemeral by math
--ttl 15m --max-calls 20 and the tunnel self-destructs. No dashboard to remember, no dangling access.
Compose your teleport. Copy. Paste. Done.
Pick a server, uncheck the dangerous tools, flip on DLP and the kill-switch — the exact
mcpwire share command is generated below. Everything runs in your browser; this
page talks to zero servers.
The wire:// ticket is minted by the host command at runtime (256-bit key, printed in its banner). This snippet shows exactly where your peer pastes it.
The ticket is the database.
1 · Host mints a ticket
mcpwire share spawns your MCP server as an isolated child process, generates a 256-bit topic key in RAM, and announces it on the Hyperswarm DHT — the same battle-tested P2P network behind Holepunch. It prints wire://… plus a ready-to-paste mcpServers snippet for your peer.
2 · Guest joins, hole punches
Your peer adds npx -y mcpwire join wire://… to their Claude Desktop or Cursor config. UDP hole punching opens a direct socket between the two machines; every byte is end-to-end encrypted with the Noise protocol (Ed25519). Credentials never move in either direction.
3 · Firewall, DLP, audit
All JSON-RPC flows through your policy: tool whitelist, schema filtering, secret scrubbing, per-call approval, TTL/max-calls kill-switch, and an optional .wirelog flight recorder you can replay in this browser at /replay.
Even if 50,000 developers teleport a database tomorrow because this hit Hacker News, the traffic rides their own laptops and the public DHT — this site stays a static file on a CDN at $0.00.
Per-server teleport playbooks
Which tools are safe to expose, which are landmines, and the exact read-only command for each popular MCP server.
PostgreSQL
Share a local Postgres replica with remote agents without handing over the keys to prod.
1 tools mapped
SQLite
Read-only SQL access to a local SQLite file, P2P encrypted, auto-expiring.
6 tools mapped
Filesystem
Let a remote agent read your codebase — without write_file, edit_file or move_file.
11 tools mapped
GitHub
Share repo research and issue triage — never push_files or fork_repository.
12 tools mapped
Git
Remote code review over P2P: git_log and git_diff in, git_commit and git_reset out.
11 tools mapped
Brave Search
Lend your Brave API quota to a teammate's agent — key never leaves your machine.
2 tools mapped
Fetch
Give an agent URL fetching from your network position — rate-limited by your kill-switch.
1 tools mapped
Puppeteer
Drive a headless Chrome on your machine from a remote agent, safely sandboxed.
9 tools mapped
Need persistent wire://your-company/db namespaces, SSO / GitHub identity
verification before the P2P handshake, and centralized audit logs for compliance (SOC2 / ISO)?
Questions agents ask us
How is this different from sharing an ngrok URL to my MCP server?
A raw tunnel hands a foreign LLM unrestricted access to your machine — one prompt injection away from DROP TABLE. MCPWire is a policy layer in front of the tunnel: tool filtering at the schema level, call-level blocking, secret redaction, approval prompts and mathematical expiry. And unlike ngrok, there is no relay server: the connection is direct P2P, E2EE with Noise.
Does any of my data touch your servers?
No. mcpwire.co is a static site; the CLI only talks to the public Hyperswarm DHT (for peer discovery) and directly to your peer's machine. There is no MCPWire backend to send data to — the repo has zero server code.
What exactly is in a wire:// ticket?
A 256-bit random topic key, in plain hex. It's a capability token: whoever holds it can connect to your tunnel until the TTL or call budget expires. Treat it like a password — send it over an already-trusted channel (Signal, company chat). If it leaks, the host hits Ctrl+C and the capability ceases to exist.
Which MCP clients work as guests?
Anything that speaks MCP over stdio: Claude Desktop, Cursor, Windsurf, Cline, codex CLI, or a bare npx @modelcontextprotocol/inspector. The join process is a drop-in mcpServers entry.
Can several peers connect at once?
Yes — each connection gets its own isolated child process of your MCP server on the host, all through the same ticket and policy.