Connect an agent

The endpoint

https://tabtunnel.dev/v1/mcp

Two ways to authenticate

Which one you use is decided by the app, not by you.

Paste a token

Mint one on the dashboard's Tokens page and put it in an Authorization header. This is what Claude Code, Cursor, Windsurf, Cline and anything you write yourself use.

• A token is a (you, organization) pair, and reaches exactly the browsers you already reach — never more.
• Nobody else can list or revoke your tokens, including an owner of your organization. Membership is not an access path here.
• The secret is shown once. Lost is lost; revoke it and mint another.

Let the app sign in

Give it the endpoint above and nothing else. It reads the authorization server off our 401, sends you here to approve, and comes back holding a token it minted itself — which appears in your Tokens list like any other and is revoked from there the same way. Claude.ai, Claude Desktop and ChatGPT connectors take this path; see the page for them.

Nothing is copied, so there is no secret to paste into the wrong window or leave in a config file. Prefer this wherever the app offers it.

Pick a client

• Claude Code — one command.
• Claude.ai and Claude Desktop — paste a URL, approve in the browser.
• Cursor, Windsurf, Cline — one block of mcp.json.
• Anything else — it is JSON-RPC over one POST.

Then what

Ask the agent to list your browsers. Once one comes back, the tool reference is what it can do with it — and the four rules on that page are worth reading before you wonder why it cannot see the tab you are looking at.