Tunnel
Zihin Tunnel gives Zihin Cloud access to services inside your network (databases, ERPs, internal APIs) without opening inbound firewall ports. A small agent runs on your side and opens an outbound-only connection to tunnel.zihin.ai on port 443; Zihin services send their requests through it.
Current version: agent 1.3 — image ghcr.io/zihin-ai/tunnel-agent:1.3.
What you get
- No inbound ports. The agent connects outward on 443 (HTTPS/WSS). No firewall changes.
- Credentials stay on-premise. Zihin Cloud only sends a service name; the agent resolves the internal URL and adds the auth headers locally. Your service credentials never leave your network.
- Transparent. Zihin services call a normal HTTP endpoint; they don't know a tunnel exists.
- Real-time responses. Streaming (SSE / MCP streamable HTTP) passes through natively.
- Cancellation. If Zihin cancels a call, the agent stops the request to your internal service immediately (agent 1.3+).
- Self-healing. The agent reconnects automatically after network blips.
Requirements
| Requirement | Detail |
|---|---|
| Docker (recommended) | Docker Engine 20+ or Docker Desktop |
| Alternative | Node.js 22+ (without Docker) |
| Network | Outbound access on port 443 (HTTPS/WSS) |
| Token | Created in the Zihin Console (format ztun_...) |
| Internal services | URL(s) of the systems to be accessed via tunnel |
The agent uses less than 50MB of RAM and virtually zero CPU when idle. It can run on the same server as your internal services.
Next steps
- Getting Started — install and configure the agent
- Console Management — create the tunnel, rotate or revoke the token
- Troubleshooting — error reference and diagnostics