---
name: serveo-tunnel
description: Expose a local development server through Serveo when the user explicitly asks for a public tunnel, webhook URL, or remote preview.
---

# Serveo Tunnel

Use Serveo to expose a local service through standard OpenSSH. Preserve the short default command and add options only when they solve a stated need.

## Safety gate

Before starting a tunnel, identify the local port and what it serves. Obtain human confirmation unless the user already explicitly requested that exact service be exposed. Never expose databases, admin panels, debug consoles, private files, or unauthenticated sensitive applications without a clear warning and confirmation.

## Start a tunnel

For a local HTTP server on port 3000:

```sh
ssh -R 80:localhost:3000 serveo.net
```

Read the public URL from the SSH output and report it to the user. Keep the process attached or supervise it so it can be stopped cleanly. Do not claim the tunnel works until the public URL returns the expected application.

If outbound port 22 is blocked:

```sh
ssh -p 443 -R 80:localhost:3000 serveo.net
```

If the local framework rejects the public Host header:

```sh
ssh -R 80:localhost:3000 serveo.net --host-header=localhost:3000
```

If the local SSH client needs an explicit end-of-options marker:

```sh
ssh -R 80:localhost:3000 -- serveo.net --host-header=localhost:3000
```

## Host identity

Never disable SSH host-key checking or automatically delete known-host entries. The current Serveo Ed25519 fingerprint is:

```text
SHA256:GnmVK+70U6GqbupoV+gg7LnHHUsW1IjrK0cLqvDJxIk
```

If the fingerprint differs, stop and ask the user to verify it against https://serveo.net/docs/.

## Cleanup

Stop the SSH process when the preview or webhook test is complete. Confirm the public URL no longer reaches the local service when cleanup matters.

For reserved hostnames, WireGuard, the browser extension, PuTTY, proxy options, and current service limits, use https://serveo.net/docs/.