Connect an account you own. Every action your agent takes, reply, post, DM, vote, email, gets a verdict, waits for your approval, and lands in an audit log, before anything ever leaves.
Owned accounts only. Not a bot army.
Tunneler decides which identity speaks, whether it should speak at all, whether it can link, and when a human takes over. Six parts do that work.
You log into your own account in a real browser, streamed to you. The session is captured server-side and encrypted at rest. No stored password, no automation fingerprint on the login.
Identity fit, daily limits, link policy, disclosure, fake-customer and payment checks, run before the draft is written and again before it sends.
First posts, promo links from young accounts, sensitive DMs and gray areas wait for a person. Sending stays off until you arm it.
Every action, every verdict, every permalink, written once and kept. You always know what happened and why.
Replies, posts, votes, DMs and promo links are capped per identity, so accounts season instead of getting flagged.
Route an identity through a residential exit node so a workspace's accounts don't all originate from one address. Run your own, or draw from the pool.
Guardrails run before anything leaves. The decision is the whole point, so it is the whole color language. Refusing to post is a feature.
Low risk, in policy, a genuinely useful reply. Send it.
A first post, a promo link from a young account, a sensitive DM. A human approves.
Fake-customer testimony, ban evasion, spam. Refused, with a reason.
Open a relayed browser or paste a session. You log in; it's captured and encrypted.
Guardrails score every proposed action against identity, limits, links and disclosure.
Risky actions land in a human queue. The arm switch is off by default.
Every action and verdict is written to an audit ledger with evidence.
Connect Claude Code or any agent over MCP or REST. It can reply, post, DM, vote and email, and every action still passes through guardrails, approval, and the arm switch. Programmatic never means ungoverned.
# add the governed toolset to your agent
claude mcp add tunneler \
-e TUNNELER_API_KEY=tnl_sk_… \
-- npx tunneler-mcpcurl -X POST https://api.tunneler.ai/api/actions/propose \
-H "Authorization: Bearer tnl_sk_…" \
-d '{"identityId":"reddit-me",
"actionType":"post",
"subreddit":"test",
"title":"Hello",
"content":"Body"}'Self-host the core or let us host the tunnels. Plans set how many identities you run and whether you draw from the egress pool.
No, the opposite. Tunneler is for owned, transparent identities you control. It refuses spam, mass DMs, fake reviews, ban evasion and impersonation. This is governance, not growth hacking.
Captured cookies and email credentials are encrypted at rest with AES-256-GCM and scoped to your workspace with row-level isolation. We reference your session, we never expose it, and you can disconnect any time.
No. A send requires both an allowing verdict (or a human approval) and the master arm switch on. It's off by default, so every run is a safe dry-run that shows exactly what would be sent.
No content. Traffic is TLS end-to-end and we validate the platform's certificate, so a node can't decrypt or intercept it, and it can only ever reach our supported platforms. It just relays encrypted bytes.
Yes. The engine, API and browser worker run as containers. Host the tunnels on your own infrastructure for a stable, consistent egress, with the same guardrails, approvals and audit log.
Governed identities, a verdict before every action, a full audit trail.