Regional control-plane endpoints
Select a control-plane endpoint with --control-plane.residency, CONTROL_PLANE_RESIDENCY, or control_plane.residency in YAML. The Go SDK, native runtime commands, and Tunnel MCP plugin also support endpoint selection. With a control-plane client certificate, the client uses the matching mTLS endpoint for global, us, or eu. If you also set a base URL, it must match the selected endpoint. Retries stay on that endpoint. Leave the setting unset to keep your existing default or custom endpoint.
Tunnel assignments and service availability are managed separately. EU Tunnel residency is currently unavailable as a supported customer deployment. Remove the new residency flag and YAML key before downgrading. See residency endpoint selection.
OAuth discovery for static-credential MCP servers
Set MCP_OAUTH_DISCOVERY=disabled, --mcp.oauth-discovery=disabled, or mcp.oauth_discovery: disabled for an MCP server that relies exclusively on static credentials. The client skips startup and doctor OAuth probes and answers later discovery requests locally with HTTP 404 and code oauth_discovery_disabled. Normal MCP initialization, credential forwarding, and upstream authentication errors continue to work. Automatic discovery remains the default. If you explicitly include harpoon in the polling scope with discovery disabled, configure at least one Harpoon target.
During a rolling upgrade, use the environment variable and check each upgraded replica for disabled_by_configuration in /health/oauth. Older replicas continue automatic discovery. Remove the new flag and YAML key before downgrading. See MCP configuration.
Admin UI behind a reverse proxy
The full client can serve the admin UI under a path such as /tools/tunnel/ui. Leave the base path empty when your proxy strips the prefix, or set --admin-ui.base-path=/tools/tunnel when the proxy preserves it. Set --admin-ui.public-origin to allow the exact browser origin for guarded Codex actions when your proxy layout requires it. Existing network access checks apply, and /healthz, /readyz, and /metrics remain available at the root. Remove the new admin UI flags and YAML keys before downgrading. See reverse proxy paths.
Startup diagnostics and security updates
/health/oauthand detailed health now expose up to 16 active and 16 completed OAuth startup probe observations, including response status, the resulting discovery decision, and a validated server request ID when present. Optional metadata absence logs at INFO with the health statenot_advertised. After the process-started log, check/readyzfor readiness and/health/control-planefor observed polling. See startup supervision.tunnel-client doctor --explainnow identifies when a well-known OAuth metadata route returns an HTML page and gives guidance for static-credential and OAuth servers.- Release builds use Go 1.27.4 and
golang.org/x/netv0.62.0, which include upstream security fixes. Go announcement · x/net announcement