I only wanted one URL for my agents. The tunnel came free.

I build software for other people and run a few things for myself: a Postgres with ten years of side projects in it, a Gitea mirror, and an Ollama box under the desk that does the boring summarisation so I don't pay per token for it. I use Claude for writing and thinking, Cursor for code, and ChatGPT because clients send me things there. Three agents, one me.

I did not want zero trust. I did not want a platform. I wanted one URL I could paste into all three so they'd have the same tools with the same rules, and I wanted to stop pasting tokens into config files at two in the morning.

What it looked like

before

Six MCP servers running locally, each with its own token to GitHub, Linear or Notion. Three copies of each, one per agent.
A port forward on my router so Cursor could reach the Postgres from a café. Port 5432, open to the world, with a password I'd chosen in 2019.
Ollama reachable the same way, because I wanted Claude to hand it long documents.
No idea what any agent had actually done last week. If Cursor dropped a table, I'd find out when something broke.

after

One MCP URL. Claude, Cursor and ChatGPT all connect to it with OAuth, as me.
GitHub, Linear and Notion added once, on the endpoint. The tokens live there, not in my dotfiles.
The desk box runs the connector. It dials out. Ports 5432 and 11434 are closed. Postgres and Ollama are tools on the same URL.
A log. Every tool call, every agent, one page. postgres.query is read only for agents. Writes are mine, in psql, like an adult.

The whole integration

This is the entire client-side setup. Same block in Claude, Cursor and ChatGPT.

{
  "mcpServers": {
    "flowplane": { "url": "https://mcp.flowplane.eu/victor" }
  }
}

First call opens a browser tab, I approve it with a passkey, and the agent gets a token that says it is Victor's Claude, valid for Victor's tools, until I say otherwise. There is no key to rotate because there is no key to paste.

The part I did not plan for

The tunnel. I thought of it as the thing that lets the endpoint see my Postgres, and it is. But the connector also means the box under my desk has no open ports for the first time since I bought it. Ollama is reachable from Claude, through the gate, as a tool called local.summarise, and from nowhere else. I closed two firewall rules that had been bothering me for years and felt nothing but relief.

I bought one URL. I got my router back.

What the log shows

This is the record from the first time Cursor tried to be helpful with a migration.

time2026-08-30 14:02:11 UTCprincipalcursor for victortargetpostgres.projectsactionalter tabledecisiondeniedpolicyvictor-02 agents read, Victor writesstored ineu-west, Belgium my vault

I do not use the memory vaults and I have not turned on the Watchtower. I am one person with three agents and a box; the log is enough watching for me. If that changes, it's a switch, not a project.

Setup, start to finish: one evening, most of it spent deleting old tokens.