openai/tunnel-client v0.0.10

on GitHub

Highlights

v0.0.10 includes 56 tunnel-client source changes since v0.0.9--context-conduit-topaz.

• Added an embeddable Go SDK for connecting caller-provided MCP transports, including in-memory transports, directly to the OpenAI Tunnel control plane without binding MCP ports or launching stdio subprocesses.
• Added a local MCP tunnel proxy with Python and TypeScript wrappers and runnable examples.
• Improved polling, readiness, shutdown, stdio recovery, OAuth handling, authorization-header handling, and local-proxy reliability.
• Published the Go module as github.com/openai/tunnel-client and simplified releases to plain semantic-version tags such as v0.0.10.

Go SDK and examples

• Tunnel-client can now be embedded as a Go library instead of only being run as a sidecar.
• Integrations can provide an MCP transport directly, including an in-memory transport, so an MCP server can connect to the control plane without opening an MCP port or spawning a stdio child process.
• Added a runnable in-memory MCP server example and end-to-end coverage that lists and calls the example tool through tunnel-service.

Local proxy and wrappers

• Added a local MCP tunnel proxy with selectable backends, queue support, Unix-socket ingress, health checks, and clean shutdown behavior.
• Added Python and TypeScript wrapper implementations and examples for integrating existing MCP servers.
• Improved local-proxy request lifecycle handling, stderr race handling, stdio request serialization, and recovery after stdio child exit.

Control-plane reliability

• Added poll batch limits and explicit poll wait timeouts.
• Readiness is now reported only after a successful control-plane poll.
• Moved client traffic to the canonical plural /v1/tunnels/... routes.
• Added redundant-poller coverage and made timeout-sensitive status and retry tests deterministic.
• Added process instance ID correlation for clearer client and control-plane diagnostics.

OAuth, authorization, and security

• Hardened OAuth resource-metadata discovery, Harpoon forwarding, and OAuth metadata transport.
• Added coverage for MCP authorization headers, connector header precedence and scoping, OAuth challenge propagation, scoped tunnel keys, and connector session termination.
• Protected unsafe admin-UI requests from CSRF.
• Hardened runtime log and health URL files and guarded plugin control-plane overrides.

Public contracts and documentation

• Added public OpenAPI and wire-protocol documentation.
• Documented tunnel-service error codes, replica queue behavior, runtime tunnel-key scopes, managed-runtime supervision, and max-inflight backpressure semantics.
• Expanded onboarding, configuration, deployment, troubleshooting, and end-user guidance.

Test coverage

• Added or stabilized coverage for the Go SDK integration path, admin UI behavior, local proxy behavior, OAuth flows, redundant pollers, wire contracts, Unix-socket fixtures, static headers, session termination, and timeout-sensitive polling.
• Moved integration fixtures to Unix sockets where applicable to reduce port contention and improve test reliability.

Release and packaging

• Public releases now use plain v<semver> tags.
• The release workflow validates exact source-version matching and runs release-tag regression tests.
• Release artifacts include six platform zip files, combined source-plus-binary archives, SHA256SUMS.txt, and PUBLIC_URLS.txt.

Install

go get github.com/openai/tunnel-client@v0.0.10

Validation

• Release workflow passed: tests, six platform builds, public artifact upload, URL verification, and GitHub Release creation.
• Clean unversioned go get github.com/openai/tunnel-client resolves to v0.0.10.

Full Changelog: v0.0.9--context-conduit-topaz...v0.0.10