Ship anything to the edge. Secure every request.
Tunnel a service from your laptop or Kubernetes, or deploy the whole app — static, full-stack, Docker, WordPress, functions. Every request passes the same edge: WAF, bot protection, edge login and rate limits, drafted by Iris AI and approved by you.
Runs your stack
Every request takes the same path.
Expose a service you already run, deploy the next one, and protect both on the same edge.
Tunnel what you run today
One outbound connection from your laptop, server or cluster. Nothing to open, nothing to forward.
Tunnels →Deploy what you build next
Push a repo or a folder. Ngris builds it and serves the front end and the backend on one URL.
App hosting →Decide every request at the edge
One policy checks each request before it reaches you, whether it goes to a tunnel or an app.
Security at the edge →Every request passes the same edge.
Security runs before your origin sees a byte, the same way for a tunnel to your laptop and for an app on ngris.
- Bot protection. A bot score on every request and an Under Attack challenge that verified crawlers pass. More
- WAF & firewall. A built-in WAF baseline plus your own rules; allow, block or challenge by IP, country or ASN.
- Edge login. OAuth/OIDC, user accounts with roles, JWTs, API keys and mTLS, with no code changes. More
- Rate limits. Per IP, header, cookie or JWT claim, per route or account-wide.
Debug in minutes, not days.
The Request Inspector captures inbound traffic with searchable payloads and lets you replay with overrides. Built-in redaction keeps secrets safe.
Full-text search
Search across headers and JSON bodies with regex support.
GDPR-friendly redaction
Automatic secret masking and retention controls (7–30 days).
Replay to dev/staging
Editable payloads and headers — replay to any environment.
Alerts to Slack & Discord
Get notified when requests fail or spike unexpectedly.
An AI that runs your edge — with you in charge.
Ask Iris in the dashboard, or drive everything from Claude Code and any MCP client. Writes always wait for your OK.
Iris in the dashboard
Describe the rule; Iris drafts it, shows what it would have blocked in your real traffic, and applies it only when you approve.
Your AI assistant, over MCP
340+ tools over the public API: expose a port, deploy, add a rule, find and replay a failed request — never more than you could do yourself.
The edge underneath.
Built and run by us, from the proxy up: every protocol in, your code wherever it runs.
Popular guides & comparisons
Start with the task you came for — expose a local server, or see how Ngris stacks up against the tool you already use.
Expose localhost to the internet
Turn localhost:3000 into a public HTTPS URL in one command — open it on your phone or share it with a teammate, no port forwarding.
Put a custom domain on localhost
Point your own domain at a local or tunneled service with automatic HTTPS — a stable URL that survives restarts.
GuideTest webhooks with a public URL
Give Stripe, GitHub, or Shopify a public endpoint on your laptop, live-tail every delivery, and replay the ones that failed.
CompareNgris vs ngrok
The policy-first ngrok alternative: the same one-command workflow, plus a per-endpoint policy engine, dedicated ports, and Iris AI.
CompareNgris vs Cloudflare Tunnel
A cloudflared alternative without DNS + CDN lock-in — per-endpoint policy, dedicated ports, and a Kubernetes operator.
CompareNgris vs Vercel
Deploy a React or Vite front end — and run the backend on the same edge — behind a WAF, edge auth, and rate limits.
Runs everywhere you deploy.
One egress-only agent for every OS and runtime, plus a REST API and OpenAPI spec to drive it from code.
brew install ngris-edge/homebrew-tap/ngriscurl -fsSL https://ngris.com/install.sh | shwinget install Ngrisdocker pull ghcr.io/ngris-edge/ngrishelm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operatorhttps://api.ngris.comEverything else, answered.
Still stuck? The docs go deeper, or reach the team at sales@ngris.com.
The ngris agent on your machine, server or cluster opens an outbound, encrypted connection to the ngris edge, so you never open a firewall port. Visitors reach a public HTTPS URL; the edge terminates TLS, applies your policy and sends each request down the tunnel to your local service.
Yes. Deploy a static site, a full-stack app, a Docker or Go, Node or Python backend, WordPress or a serverless function from GitHub, GitLab or the ngris CLI. Ngris detects the framework and builds it, every deploy can get a preview URL, and you can promote or roll back with one command.
Yes. Export a standard (request) => Response handler on Node.js 24. The function scales to zero when idle and the edge starts it again on the next request. Separately, edge functions (in beta) run small JavaScript handlers on the edge itself, in front of any endpoint.
An API gateway sits between clients and your services and handles routing, authentication, rate limits and observability. Ngris does that per endpoint, for tunnels and hosted apps alike, and adds a WAF, bot protection, edge login, a request inspector with replay, and Iris, an AI that drafts rules for you to approve.
Traffic between the agent and the edge is encrypted, and the edge can check every request before it reaches you: WAF, bot score, IP and geo rules, rate limits and edge login. Hosted apps run in gVisor sandboxes, captured traffic can be redacted, and account actions are written to an audit log.
A live view of every request to an endpoint, with headers and body. Search and filter it, and replay a request, edited if you like, to check a fix.
Yes. Connect Cloudflare, Route 53, DigitalOcean, Namecheap, cPanel or Virtualmin and Ngris creates the records and issues and renews a wildcard certificate. With any other DNS host, add a TXT record and a CNAME to cname.ngris.io and upload your own certificate.
Yes. Ngris serves production traffic from edge regions in the EU and the US over HTTP/1.1, HTTP/2 and HTTP/3, with automatic TLS, health checks, alerts and the same security edge on every endpoint.
Ship anything to the edge. Secure every request.
Create an account and launch your first endpoint in under a minute. No config files, no credit card, no friction.