Letting AI Drive: Exposing Localhost via MCP Servers

AI coding agents can now write a webhook handler, spin up a dev server, and expose that server to the public internet, all from one natural-language prompt, without the developer touching a second terminal window. The piece that made the last step possible is the Model Context Protocol (MCP): agents that used to stop at the edge of the local machine can now reach through it to tunneling services like Pinggy. This piece walks through how MCP got here, where the agentic IDE landscape actually stands in mid-2026, and exactly how Pinggy’s MCP server and skill work today.

What MCP Actually Standardizes

Anthropic open-sourced the Model Context Protocol on November 25, 2024, as a standard for connecting AI assistants to the systems where data and tools live. Before MCP, connecting a given model to a given tool meant a bespoke integration for every model-tool pair — what Anthropic called the “N×M” problem. MCP collapses that to one server per tool, usable by any MCP-compatible client. The protocol’s message-flow design borrows from the Language Server Protocol (LSP), and messages are exchanged as JSON-RPC 2.0.

The architecture has three parts:

1. Host — the user-facing application: an IDE, a desktop chat client, a custom agent.
2. Client — the piece inside the host that speaks MCP and routes calls to servers.
3. Server — the external process that exposes tools, resources, or prompts (in this case, tunnel management).

The transport layer has changed since MCP’s first release. The original 2024-11-05 spec shipped with stdio (for local, single-client processes) and an HTTP+SSE transport for remote servers. The March 2025 spec revision (2025-03-26) deprecated HTTP+SSE in favor of Streamable HTTP, which uses a single endpoint, supports stateless deployment behind load balancers, and allows resumable sessions — the old dual-endpoint SSE design didn’t hold up well behind serverless platforms and proxies. SSE transport is still supported for backward compatibility, but vendors are setting shutoff dates for it (Atlassian’s Rovo MCP server, for instance, drops SSE support on June 30, 2026). For anything built today, stdio for local tools and Streamable HTTP for remote ones is the current guidance.

MCP’s adoption outside Anthropic moved fast: OpenAI added native MCP support to its Agents SDK in March 2025, and Google DeepMind confirmed support for Gemini the following month. By the time Anthropic handed the protocol’s governance to the Linux Foundation’s newly formed Agentic AI Foundation on December 9, 2025, the ecosystem had grown to more than 97 million monthly SDK downloads and over 10,000 active public servers.

The Agentic IDE Landscape Has Shifted

The three tools most associated with agentic coding have all changed shape since they were first compared side by side.

• Cursor, built by Anysphere on a VS Code fork, is still built around Composer (multi-file agent edits) and per-task model switching between Claude, GPT, and Gemini. Anysphere shipped a proprietary model, Composer, alongside “Cursor 3” in April 2026 — a redesign centered on an Agents Window that manages parallel agent sessions across local machines, Git worktrees, cloud sandboxes, and remote SSH targets. Anysphere’s valuation climbed from a $29.3 billion Series D in November 2025 toward reported talks above $50 billion in 2026, and in mid-2026 SpaceX (by then merged with xAI) structured a deal giving it the right to acquire Anysphere for $60 billion — not yet exercised as of this writing.
• Windsurf started as Codeium’s agentic IDE with the Cascade planning system. After Google’s roughly $2.4 billion acquihire of Windsurf’s CEO and senior staff in mid-2025, Cognition AI — maker of the autonomous coding agent Devin — signed a deal to acquire the rest of the company, closing around December 2025 for roughly $250 million. Windsurf is no longer an independent product: it now runs Cognition’s own SWE-1.5 model, ships a codebase-visualization feature called Codemaps, and is being merged with Devin into a single agentic development stack.
• Claude Code, Anthropic’s coding agent, started terminal-only but no longer lives there exclusively. It now runs across six surfaces sharing one underlying engine: the original terminal CLI, a VS Code extension, a JetBrains plugin (IntelliJ IDEA, PyCharm, WebStorm, and others), a standalone desktop app, a web version at claude.ai/code, and a Slack integration. All surfaces share the same CLAUDE.md project configuration, permission modes, and MCP server connections — the terminal is one entry point among several rather than the whole product.

MCP is the connective layer across all of them: any of these clients can attach to the same MCP server, including one that manages tunnels.

The Localhost Bottleneck

Writing the code for a webhook integration was never the hard part. Testing it against a live third-party service — Stripe, Shopify, a mobile client on a different network — needs a public URL pointing at your local machine. The traditional flow breaks the agent’s autonomy at exactly that step: stop, open another terminal, authenticate with a tunneling service, copy a URL back into the agent’s context or a dashboard, resume. Multiply that across webhook testing, remote demos, and IoT/device work, and it’s a recurring source of context-switching that an agent can’t work around on its own — unless it has a tool call that does the tunneling for it.

Pinggy’s MCP Server and Skill

Pinggy, the SSH-based tunneling service, ships two separate pieces of agent tooling that can be installed together or independently: an Agent Skill and an MCP server.

The skill is packaged instructions and reference material — SSH commands, CLI flags, SDK usage — that an agent reads and then executes itself using ordinary terminal access. The MCP server is a running process that exposes tunnel operations as callable tools, so the agent doesn’t need to reconstruct a command from documentation; it calls a tool directly. Pinggy’s own guidance is to start with the skill and add the MCP server only once you want the agent operating tunnels on its own.

Installing the skill

npx skills add https://pinggy.io

This is published under the community Agent Skills standard, and the skills CLI detects the agent and installs into its skills directory — for Claude Code, that’s ~/.claude/skills/pinggy/. The only prerequisite is Node.js.

Installing the MCP server

The MCP server’s source lives at github.com/Pinggy-io/pinggy_mcp — Pinggy’s own documentation flags it as “early and experimental.” It requires Python 3.10+ and uv:

curl -LsSf https://astral.sh/uv/install.sh | sh

Nothing else installs globally; each client fetches and runs pinggy-mcp on demand through uvx. Configuration differs by client — notably, VS Code uses a servers key while Claude Desktop, Cursor, and Windsurf use mcpServers, and the exact file each one reads is different too.

Claude Code — registered directly through the CLI rather than a config file:

claude mcp add pinggy-mcp -- uvx --from git+https://github.com/Pinggy-io/pinggy_mcp.git pinggy-mcp

Confirm it registered with claude mcp list.

Claude Desktop — edit the config file for your OS: - macOS: ~/Library/Application Support/Claude/claude_desktop_config.json - Windows: %APPDATA%\Claude\claude_desktop_config.json - Linux: ~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "pinggy-mcp": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/Pinggy-io/pinggy_mcp.git",
        "pinggy-mcp"
      ]
    }
  }
}

Cursor — ~/.cursor/mcp.json for a global config, or .cursor/mcp.json in a project root:

{
  "mcpServers": {
    "pinggy-mcp": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/Pinggy-io/pinggy_mcp.git",
        "pinggy-mcp"
      ]
    }
  }
}

VS Code — ~/.vscode/mcp.json (global) or .vscode/mcp.json (project); note the top-level key is servers, not mcpServers:

{
  "servers": {
    "pinggy-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/Pinggy-io/pinggy_mcp.git",
        "pinggy-mcp"
      ]
    }
  }
}

Reload with Developer: Reload Window from the command palette afterward.

Windsurf — ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "pinggy-mcp": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/Pinggy-io/pinggy_mcp.git",
        "pinggy-mcp"
      ]
    }
  }
}

Restart Windsurf after saving.

What you can actually ask it to do

Once connected, Pinggy’s own documentation gives these as example prompts:

• “Expose my dev server on port 3000.”
• “Open a TCP tunnel to localhost:22.”
• “Share my ~/Downloads folder over the internet.”
• “Log in to Pinggy.”
• “List my active tunnels.”
• “Only allow traffic from 1.2.3.4 to my tunnel.”
• “Stop the tunnel.”

Worth noting: Pinggy’s docs don’t publish the technical details of what “log in” does under the hood, and given the project is explicitly labeled early and experimental, it’s worth reading the source before pointing it at anything sensitive. Every Pinggy doc page is also published as plain Markdown at the same URL with an index.md suffix, and the whole site is summarized at pinggy.io/llms.txt — a detail aimed squarely at letting agents read the docs directly rather than scraping rendered HTML.

Practical Use Cases

Webhook testing. Ask an agent building a Shopify integration to “set up the order-creation webhook,” and it can write the route handler, start the local dev server, call the Pinggy MCP tool to open an HTTP tunnel, and hand the resulting URL to whatever registers it with Shopify — collapsing a normally multi-step manual process into one exchange.

Device and sensor access. For a local IoT sensor or a Raspberry Pi that needs to reach a cloud endpoint, an agent can open a TCP tunnel and hand back the public address without the developer manually reconstructing an SSH command.

File and folder sharing. Pinggy’s CLI can serve a local directory directly (pinggy --serve /path/to/files), and that capability is exposed through the MCP server too — “share my ~/Downloads folder” is one of the documented example prompts. For a colleague reviewing a dataset or build output, that’s a public link without uploading anything to a third-party storage service first.

Security Considerations

None of this removes the need for judgment. VS Code’s own MCP documentation puts it plainly: local MCP servers can run arbitrary code on your machine, and you should only add servers from sources you trust and have reviewed. Pinggy’s MCP server is genuinely new — the company’s own docs call it experimental — so the usual due diligence applies: read what the server actually does before granting it network and filesystem access, and don’t assume “the agent asked politely” is the same thing as “this is safe to expose.” IP whitelisting and Pinggy’s own authentication options (basic auth, bearer tokens) remain available on any tunnel the agent opens, and they’re worth applying by default rather than only when something goes wrong.

Where This Is Heading

MCP didn’t just standardize file access and API calls — it gave agents a socket back out to the network tools developers already use. Tunnel management was a natural, if unglamorous, thing to put behind that interface: developers were manually running the same handful of commands anyway, and an agent that can already write the webhook handler can just as easily call the tool that exposes it. Whether it’s a sensor feed, a webhook, or a folder full of test data, the pattern is the same: describe what you want reachable, and let the tool call handle the mechanics.

---

Changelog

This piece was rewritten from an earlier draft. Corrections and additions, with sources:

1. MCP announcement date and framing — confirmed November 25, 2024 as the release date, and confirmed the “N×M” integration problem framing and the LSP-derived message-flow design, against Anthropic’s own announcement and multiple technical retrospectives. (Anthropic, “Introducing the Model Context Protocol,” anthropic.com/news/model-context-protocol; NeuralCoreTech, “Why MCP Became the Standard for Agentic AI,” May 2026)
2. Transport layer corrected — the original draft described SSE as a current remote transport. In fact, the MCP spec revision 2025-03-26 deprecated HTTP+SSE in favor of Streamable HTTP; SSE is retained only for backward compatibility and several vendors have announced 2026 shutoff dates. (modelcontextprotocol.io/specification/2025-11-25/basic/transports; GitHub modelcontextprotocol/python-sdk issue #2278; Atlassian Community, “HTTP+SSE Deprecation Notice for Atlassian Rovo MCP server”)
3. Added MCP adoption and governance update — OpenAI Agents SDK support (March 2025), Google DeepMind/Gemini support (April 2025), and Anthropic’s December 9, 2025 donation of MCP’s governance to the Linux Foundation’s Agentic AI Foundation, along with current scale figures (97M+ monthly SDK downloads, 10,000+ active public servers). This postdates the original draft. (NeuralCoreTech, May 2026; Cuttlesoft, “Anthropic’s Model Context Protocol,” Feb 2026)
4. Cursor, Windsurf, and Claude Code descriptions updated for 2026 — the original draft described Windsurf as an independent product; it was acquired by Cognition AI (announced mid-2025, deal closing around December 2025 for roughly $250 million) after Google’s acquihire of Windsurf’s CEO and senior staff, and now runs Cognition’s SWE-1.5 model. Cursor’s parent Anysphere reached a $29.3B valuation in its November 2025 Series D, and in mid-2026 a SpaceX/xAI deal structured an option to acquire Anysphere for $60B. Claude Code was described as terminal-only; it now ships across six surfaces (terminal, VS Code extension, JetBrains plugin, desktop app, web, Slack). (Wikipedia, “Cognition AI”; Taskade, “Windsurf Review 2026”; ValueAddVC, “Cursor (Anysphere) Valuation 2026”; Fastio, “Claude Code IDE Setup for VS Code and JetBrains (2026)”)
5. Corrected the Pinggy MCP server’s GitHub source — the original draft cited github.com/abhimp/pinggy_mcp, which could not be verified. The actual, official repository is github.com/Pinggy-io/pinggy_mcp, confirmed directly against Pinggy’s own documentation. (pinggy.io/docs/ai_agents/)
6. Replaced unverified OAuth 2.0 Device Authorization Grant claim — the original draft asserted Pinggy’s MCP server uses the OAuth 2.0 Device Authorization Grant (RFC 8628). Pinggy’s own documentation does not describe the underlying authentication mechanism for its “log in” tool call, so this specific claim has been removed rather than repeated unverified. (pinggy.io/docs/ai_agents/ — no mention of OAuth or device flow found)
7. Replaced unverified WebDAV claim — the original draft described folder sharing as happening “over WebDAV.” Pinggy’s documented mechanism is its existing file-serving flag (pinggy --serve <path>), exposed through the MCP server as a natural-language capability; no WebDAV-specific implementation is documented. (pinggy.io/docs/ai_agents/; GitHub Pinggy-io/cli-js README)
8. Corrected and completed installation instructions — the original draft’s config example was largely accurate for VS Code (the servers key was actually correct) but conflated VS Code, Cursor, and Windsurf into one shared config format and path. These three use different top-level keys (servers vs. mcpServers) and different file paths, and Claude Code’s installation is a CLI command rather than a JSON file. All five configurations, plus prerequisites (Python 3.10+, uv), were pulled directly from Pinggy’s current documentation, which also explicitly labels the MCP server “early and experimental.” (pinggy.io/docs/ai_agents/)
9. Added verified example prompts — replaced illustrative but unsourced prompts with Pinggy’s own documented examples, including IP whitelisting and folder sharing. (pinggy.io/docs/ai_agents/)
10. Removed SEO-style bolded phrase repetition and generic AI-filler framing (“the workplace revolution,” “game-changer,” redundant restatements of the thesis) throughout, consistent with house style for this blog.
11. Added a security-considerations note grounded in VS Code’s own published MCP security guidance and Pinggy’s self-description of the server as experimental, rather than a general reassurance about “security remaining a priority.” (code.visualstudio.com/docs/agent-customization/mcp-servers; pinggy.io/docs/ai_agents/)