Self-hostable zero-trust tunnels

Your localhost, live at a real URL.

Run one command next to your app and it's online over HTTPS — no inbound ports, no firewall changes, nothing to open.

free · no card · live in under a minute
Build with agents
Add tropa tunnels and temp mail to my app: tropa.doshka.me/SKILL.md
Paste that into Claude Code, Cursor, or your own agent. It reads /SKILL.md, installs the CLI, and wires up the MCP server.
~/code/myapp
$ tropa 3000  tropa: connecting to wss://tropa.doshka.me …  your services are live:    https://myapp-you.tropa.doshka.me  →  127.0.0.1:3000
tropa.doshka.me
tropa dashboard — live tunnels, traffic and health

Everything between localhost and the internet

The tunnel is the easy part. What's around it is why teams stay.

One paste to live

Install and connect in a single command from your dashboard. After that it's just tropa 3000 — routes auto-named from your project folder.

See every request

A live traffic inspector on every tunnel — headers, bodies, timings. Replay any request, or edit it and send it again.

Never miss a webhook

Agent asleep mid-deploy? Incoming webhooks are queued at the edge and delivered the moment it reconnects. Nobody else does this.

Locked at the edge

Password, IP allowlist, rate limits, and webhook signature checks enforced at the relay — a spoofed webhook or hostile request never reaches your machine.

Your own domain

Point a CNAME at any route and serve it as app.yourbrand.com, certificate included.

No inbound ports, ever

The agent only dials out, so there's nothing to port-forward, no firewall rule to open, and no NAT to configure. Your machine stays invisible to the internet — traffic reaches it only down the tunnel it opened. How it works →

Hot-reload over the tunnel

Add --dev and your Next.js or Vite dev server's live reload just works through the tunnel — no framework config, no origin errors. ngrok can't do this.

Throwaway inboxes

Short-lived addresses for signup and password-reset flows. Mail lands without a reload and the verification code is lifted out of the body for you.

Built for teams

Invite teammates with roles, keep an audit trail of every key and policy change, and drive it all from a REST API.

Your agent can drive all of it

An MCP server ships in the same binary. Claude Code, Cursor, or your own loop gets tunnels, inboxes, keys, domains and edge policy as tools.

The one that changes how you test

Ask for a signup flow and the agent creates a throwaway inbox, uses the address, then blocks on a single tool call until the mail arrives — no polling loop, no wasted turns. The verification code comes back already extracted.

  • Sixteen tools across tunnels, mail, keys, domains and policy
  • Zero configuration after tropa login
  • Message bodies treated as untrusted input, never as instructions
Read the agent skill →

Simple pricing

Start free. Upgrade when your traffic does.

Free

$0 /mo
  • 3 tunnels
  • 10 GB traffic / month
  • Inspector, replay & edge access control
  • Webhook capture & team roles
Start free

Pro popular

$12 /mo
  • 25 tunnels
  • 250 GB traffic / month
  • Custom domains with auto TLS
  • Everything in Free, plus priority support
Go Pro