Portal CLI
A tunnel for localhost with self-hostable relays: a public HTTPS address for a local service, no account, plus skills for agents
- 292 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- A local service becomes reachable from the internet at a public address: publish only what you are ready to show
- Traffic goes through someone else's relay, and a relay holding the certificate key could in theory impersonate your endpoint
- Installing with a script piped from the internet through curl and bash runs downloaded code
Install
- Works in
Manual install
curl -fsSL https://github.com/gosuda/portal-tunnel/releases/latest/download/install.sh | bashFor macOS and Linux. On Windows use install.ps1 from the same release. Read the script before running it.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- A local service becomes reachable from the internet at a public address: publish only what you are ready to show
- Traffic goes through someone else's relay, and a relay holding the certificate key could in theory impersonate your endpoint
- Installing with a script piped from the internet through curl and bash runs downloaded code
This is third-party code. Review the repository files before installing.
What it does
Portal publishes a local service through a relay you can host yourself or take from the public set. `portal expose 3000` gives a public HTTPS address for the app on port 3000; no port forwarding, firewall rules or manual DNS are needed. No account is needed either: sign-in rests on a local secp256k1 cryptographic identity in identity.json with SIWE challenge signing. For ordinary HTTPS streams TLS terminates in your local process and the relay forwards ciphertext. A built-in self-probe compares TLS key material on a sampled connection, and the --ban-mitm flag blocks the relay on a mismatch. Several relays can form a pool with failover. The --http-route flag publishes several local services under one domain, and --tcp mode gives a dedicated TCP port for SSH or databases. Routes can be gated with x402 micropayments. The repository ships a portal-deploy plugin for Codex, Claude Code and Cursor with three skills: portal-expose, portal-connect and portal-relay. For always-on use there is portal agent with a config.toml file and a dashboard.
Who it is for. For developers who show local apps, APIs and tools to clients or agents through a public address and want to control the relay.
Good fit when
- You need to show a localhost app to a client over a public link
- You want several local services under one domain: /api on port 3001, the rest on 5173
- You need a persistent tunnel that runs as an operating system service
- An agent in Codex, Claude Code or Cursor should publish the app and verify the address on its own
Not a fit when
- The service must not be shown externally: Portal makes a local app reachable at a public address
- You need full protection from an untrusted relay: Portal reduces trust in the relay without removing it
- You need dedicated bandwidth and contract support: the project is open source with no paid tiers
- You need hosting: the service keeps running on your computer and drops off the network with it
Example request
Expose my app on port 3000 with Portal and verify the public URLLimitations
Route payments through x402 use gasless Sui USDC or Casper wCSPR, and ordinary payment processors are not connected. For relay-hosted domains the relay signs the handshake through /v1/sign. Your own relay starts with `docker compose up`, but automatic certificates and TCP and UDP port ranges need DNS setup from the docs. The public relay registry lives in registry.json in the repository. The service is reachable from outside only while portal expose or the portal agent service runs on your machine.
How to disable. Stop portal expose with Ctrl+C and the public address stops working. Stop a persistent tunnel together with the portal agent service, and remove the plugin with your agent's tools.
FAQ
How do I put localhost on a public address with Portal?
Install portal from the latest release and run `portal expose 3000`. It prints a public HTTPS address.
How do I install the Portal skills in Claude Code?
Run `claude plugin marketplace add gosuda/portal-tunnel` and `claude plugin install portal-deploy@portal-tunnel`. The skills are invoked as /portal-deploy:portal-expose, /portal-deploy:portal-connect and /portal-deploy:portal-relay. A single skill installs with `npx skills add gosuda/portal-tunnel --skill portal-expose`.
How is Portal different from ngrok?
You can run the relay yourself, the code is open under MIT, and TLS for ordinary HTTPS streams terminates on your side.
Can the relay see my traffic?
For ordinary HTTPS streams the relay forwards ciphertext. A relay holding the certificate private key could impersonate your endpoint. The self-probe and the --ban-mitm flag catch such substitution on sampled connections.
How do I keep a tunnel running continuously?
Use portal agent: `portal agent run --config config.toml` starts tunnels from the config and `portal agent dashboard --config config.toml` opens the dashboard. To run it as an operating system service, follow the Portal Agent Guide.
Discussion
No questions or reviews yet.
Related
CLI toolsAn MCP server for rustunnel tunnels: the agent opens a local port at a public HTTPS, TCP or UDP address
A Vercel Labs CLI: instead of localhost:3000 the dev server opens at a stable address like https://myapp.localhost, with its own for each git branch
3X-UI on your VPS
3x-ui-vps
Skill that deploys the 3X-UI panel and Xray VLESS behind nginx on an Ubuntu server and maintains it through bundled scripts
A self-hosted gateway for multiple LLM keys and providers: rotation, failover, request logs and usage accounting
A self-hosted control center for coding agents: Claude Code, Codex, Copilot, OpenCode and Pi from your phone, desktop and terminal
The official Railway plugin: the use-railway skill and a hosted MCP server for deploys, variables, domains, logs and tracing from your agent
README in short
The README calls Portal an open relay network for publishing services and compares it with ngrok, Cloudflare Tunnel and frp. A quick start, an end-to-end encryption diagram and doc links follow.