Ngris vs Cloudflare Tunnel
A tunnel with the security built in, and no need to move your DNS. Run ngris http 3000, then attach a policy, bot protection and a login to that endpoint, from one place. An honest comparison: we only claim what our code ships today.
- Keep your DNS where it is
- One policy per endpoint
- HTTP, TCP and UDP
Choose ngris if you want
- A tunnel with edge security, without moving your DNS
- WAF, bot rules and login on the endpoint, not in separate products
- Dedicated TCP/UDP ports and a request inspector with replay
- To host the whole app behind the same edge
- A Kubernetes operator and an MCP server for your AI tools
Where ngris is still maturing
- Edge locations in the EU and the US only
- Dedicated IPs are built, but the add-on is not on sale yet
What ngris does differently
Cloudflare Tunnel connects your service to Cloudflare’s network. Ngris is a standalone edge you control per endpoint.
Your DNS stays where it is
Use an ngris subdomain, or keep your domain at its DNS host. Six hosts get records and a wildcard certificate written for you.
Domains →Security on the endpoint
Bot score, WAF, edge login and rate limits in one policy, not spread across separate products.
Security at the edge →Host the app too
Push the repo and ngris builds it and serves front end and backend behind the same edge.
App hosting →Ngris vs Cloudflare Tunnel, feature by feature
A mark for ngris means it ships today. Several Cloudflare capabilities live in other Cloudflare products, not in the tunnel; we say which.
| Feature | Ngris | Cloudflare Tunnel |
|---|---|---|
| Tunnels and protocols | ||
| HTTPS tunnel from one command | ||
| HTTP/3 (QUIC) | Every endpoint | Cloudflare’s edge |
| TCP tunnels | ||
| UDP tunnels | Check docs | |
| WebSocket | ||
| Custom domains and automatic TLS | ||
| Works with any DNS provider | CNAME or ngris subdomain | Domain on Cloudflare |
| Security at the edge | ||
| Policy engine on each endpoint | 26 rule types | Other Cloudflare products |
| Rate limiting | Other Cloudflare products | |
| WAF, built-in baseline plus your rules | Other Cloudflare products | |
| Bot score and JA3/JA4 fingerprints | Other Cloudflare products | |
| Under attack challenge | Zone setting | |
| JWT and CEL request checks | Check docs | |
| Circuit breaker | Check docs | |
| Edge functions (your JavaScript at the edge) | Beta | Workers |
| Edge login | ||
| OAuth and OIDC sign-in | Via Cloudflare Access | |
| User accounts with roles, on the endpoint | Via Access and your IdP | |
| Basic auth | Check docs | |
| API keys | Via Cloudflare Access | |
| Mutual TLS (client certificates) | Via Cloudflare Access | |
| Traffic tools | ||
| Live request inspector | Check docs | |
| Capture and replay | Not built in | |
| Dedicated TCP/UDP ports | Check docs | |
| Dedicated IPs | Built, not on sale yet | Check plan |
| Beyond the tunnel | ||
| App hosting: static, full-stack, Docker, WordPress, functions | Via Pages and Workers | |
| Kubernetes operator | 10 custom resources | Check docs |
| AI drafts firewall rules | Iris | Beta |
| AI drafts every edge rule: firewall, rate limits, traffic policy, routing, alerts, error pages, edge functions | All 7 rule types | Firewall and rate-limit rulesBeta |
| AI assistant that reads your account and applies changes after you confirm | Iris; can also add firewall rules by itself, with auto‑rollback | Agent Lee, beta |
| MCP server for AI assistants | 340+ tools | Not built in |
Ships today“Check docs” or “Check plan”: we don’t claim a yes or a no. Cloudflare’s products and tiers change, so check cloudflare.com.
Move from cloudflared in a few minutes
One agent per machine, one command per service, and your domain stays with its DNS provider.
Install the agent
One small binary for macOS, Linux, Windows or Docker. Other ways to install
curl -fsSL https://ngris.com/install.sh | shSave your token
Copy your auth token from the dashboard and save it once.
ngris auth --token <your-token>Expose each service
Run one command per local port you served through cloudflared.
ngris http 3000Point your domain and add rules
Connect your DNS provider and ngris writes the record and the certificate, or add a CNAME to cname.ngris.io yourself and upload one. Then turn on a policy, edge login or bot protection for the endpoint.
Frequently asked questions
Is Ngris a good Cloudflare Tunnel alternative?
Yes, if you want a tunnel with the security built in and don't want to move your DNS. Run ngris http 3000 for a public HTTPS URL, then attach a policy, bot protection and edge login to that endpoint. Your domain can stay with its current DNS provider.
Do I have to move my DNS to use Ngris?
No. Use an ngris subdomain, or keep your domain where it is. If your DNS is on Cloudflare, Route 53, DigitalOcean, Namecheap, cPanel or Virtualmin, Ngris creates the records and issues and renews a wildcard certificate. With any other DNS host, add a TXT record and a CNAME to cname.ngris.io yourself and upload your own certificate.
How do I move from cloudflared to Ngris?
Install the agent with curl -fsSL https://ngris.com/install.sh | sh, save your token with ngris auth --token <your-token>, and run ngris http <port> for each service you exposed with cloudflared. Then point your domain at the endpoint and add your rules as a traffic policy.
Does Ngris replace Cloudflare Access?
For your own endpoints and apps, it can: edge login puts sign-in with Google, GitHub, Microsoft, Okta, Auth0 or any OIDC provider, user accounts with roles, JWTs, API keys and mTLS in front of any endpoint, with no code changes. It is not a company-wide zero-trust network for your staff's devices.
Does Ngris work with Kubernetes?
Yes. Install the operator with helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator. Any Ingress with ingressClassName ngris becomes a tunnel, and 10 custom resources cover traffic policies, routing, edge login, domains, certificates and mTLS.
Can my AI assistant manage Ngris?
Yes. Add the MCP server at https://mcp.ngris.com/mcp to Claude Code, Claude Desktop or any MCP client. It exposes 340+ tools over the public API and can only do what your own credential allows.
Related comparisons and guides
A standalone, policy-first edge. Free to start.
Keep your DNS, get the security. No card needed.