Portal - Self-Hostable Relay Tunnel for Localhost

English | 简体中文

Expose local services through self-hosted or public relays.No port forwarding. No inbound firewall rules. No manual DNS setup. No accounts.

Why Portal?

Portal is an open-source tunnel runtime and relay network for publishing services to the agentic web. It exposes local apps, APIs, tools, and agents through self-hosted or public relays, keeps routing and security policy in the local tunnel process, and eliminates the need for hosted vendor accounts or credit cards.

• Self-Hostable & Open Source - Run your own relay with a single command. MIT-licensed with zero telemetry, no enterprise tiers, and no call-home.
• Anonymous Relay Network - Connect to public relays or combine self-hosted and community relays into resilient multi-relay failover pools.
• End-to-End Tenant TLS - For uncached HTTPS stream exposures, TLS terminates in your local tunnel process. Forwarding relays handle ciphertext; relay-held certificate keys remain part of the trust boundary.
• IVNP-backed Overlay Networking - Bridge reverse backhauls over an independent IVNP overlay network when enhanced routing privacy is desired.
• Built-in MITM Detection - The native self-probe compares TLS keying material on a sampled connection; --ban-mitm blocks a relay for that exposure when exporter values differ.
• No Accounts, No API Keys - Authentication uses local secp256k1 cryptographic identities (identity.json) with SIWE challenge signing.
• Native x402 Payments - Route-level micropayments using gasless Sui USDC or Casper wCSPR without traditional payment processors.

📖 Explore the Complete Product Capabilities: For the complete matrix of all 20+ supported capabilities across CLI, Agent, SDK, and Relay—including interface support and trust boundaries—see the Canonical Feature Inventory.

Comparison

	Portal	ngrok	Cloudflare Tunnel	frp
Public localhost URL	Yes	Yes	Yes	Yes
Self-hostable	Yes	Enterprise only	No	Yes
Open source	MIT	No	Client only	Apache 2.0
Custom domain	Yes	Paid plans	Yes	Yes
End-to-end tenant TLS	Yes (uncached exposures)	No	No	No
MITM self-probe	Yes (TLS keying material export)	No	No	No
Multi-relay failover	Yes	Managed	Built-in	No
Account required	No	Yes	Yes	No
Native x402 payments	Yes	No	No	No

Quick Start

1. Expose a local service

macOS / Linux:

curl -fsSL https://github.com/gosuda/portal-tunnel/releases/latest/download/install.sh | bash
portal expose 3000

Windows (PowerShell):

$ProgressPreference = 'SilentlyContinue'
irm https://github.com/gosuda/portal-tunnel/releases/latest/download/install.ps1 | iex
portal expose 3000

Portal prints an HTTPS URL immediately. Additional common usages:

# Custom name and explicit relay
portal expose 3000 --name myapp --relays https://portal.example.com --discovery=false

# Mount multiple local services behind one domain
portal expose --name myapp \
  --http-route /api=http://127.0.0.1:3001 \
  --http-route /=http://127.0.0.1:5173