New — Iris AI drafts your firewall, routing & rate-limit rules. Explore AI features →

Ngris vs ngrok

Keep the workflow you know: run ngris http 3000 and get a public HTTPS URL. Then put a policy, bot protection and a login in front of every endpoint, and host the whole app on the same edge. An honest comparison: we only claim what our code ships today.

Start free See the comparison

The same one-command tunnel
Import your ngrok traffic policy
HTTP/3 on every endpoint

Which one fits?

Choose ngris if you want

The ngrok workflow, with a policy on every endpoint
Bot protection and edge login without another vendor
To host the whole app, not only tunnel to it
A Kubernetes operator and an MCP server for your AI tools
To bring your ngrok traffic policy with you

Where ngris is still maturing

Edge locations in the EU and the US only
Dedicated IPs are built, but the add-on is not on sale yet

What you get on top of the tunnel

ngrok made “one command, public URL” the norm. Ngris keeps it and adds a full edge.

THE TUNNEL YOU KNOW

Same command, same tunnel

ngris http 3000: one outbound connection, a public HTTPS URL, nothing to open.

Tunnels →

ON TOP: PROTECT

Every request decided at the edge

Bot score, WAF, edge login and rate limits, on the endpoint, before your machine sees a byte.

Security at the edge →

ON TOP: DEPLOY

Host the app when you are ready

Push the repo and ngris builds it and serves front end and backend on one URL.

App hosting →

Ngris vs ngrok, feature by feature

A mark for ngris means it ships today. For ngrok we mark only widely known facts.

Feature	Ngris	ngrok
Tunnels and protocols
HTTPS tunnel in one command
HTTP/3 (QUIC)	Every endpoint	Not built in
TCP tunnels
UDP tunnels		Not built in
WebSocket
Custom domains and automatic TLS
Security at the edge
Policy engine on each endpoint	26 rule types	Traffic Policy
Rate limiting
IP and geo rules
WAF, built-in baseline plus your rules		OWASP CRS, TPU-metered
Bot score and JA3/JA4 fingerprints		Check plan
Under attack challenge		Check plan
JWT and CEL request checks
Circuit breaker		Free on all plans
Edge functions (your JavaScript at the edge)	Beta	Check plan
Edge login
Basic auth
OAuth and OIDC sign-in
User accounts with roles		Check plan
API keys		Check plan
Mutual TLS (client certificates)
Traffic tools
Live request inspector
Capture and replay		Free on all plans
Dedicated TCP/UDP ports		Check plan
Dedicated IPs	Built, not on sale yet	Check plan
Beyond the tunnel
App hosting: static, full-stack, Docker, WordPress, functions		Not built in
Kubernetes operator	10 custom resources
AI drafts firewall rules	Iris	Not built in
AI drafts every edge rule: firewall, rate limits, traffic policy, routing, alerts, error pages, edge functions	All 7 rule types	Not built in
AI assistant that reads your account and applies changes after you confirm	Iris; can also add firewall rules by itself, with auto‑rollback	Not built in
MCP server for AI assistants	340+ tools	Not built in

Ships today“Check plan”: we don’t claim a yes or a no. ngrok’s features and tiers change, so check ngrok.com.

Switch in a few minutes

The commands have the same shape, and your ngrok traffic policy file runs as it is.

traffic-policy.yml · from ngrok

on_http_request:
  - name: office only
    expressions:
      - "req.url.path.startsWith('/admin')"
    actions:
      - type: restrict-ips
        config: { allow: ["203.0.113.0/24"] }
  - name: api limit
    actions:
      - type: rate-limit
        config:
          capacity: 100
          rate: "60s"
          bucket_key: ["conn.client_ip"]
  - actions:
      - type: owasp-crs-request
  - actions:
      - type: oauth
        config: { provider: google }

ngris agent · same file, no edits

$ ngris http 3000 --traffic-policy traffic-policy.yml
traffic-policy: detected ngrok format — converted 3 rule(s), skipped 1
ngrok-compat: rate-limit: ngrok's sliding window (capacity/rate/bucket_key) mapped to an ngris fixed window (limit/window/scope) — close but not identical; verify limit=100 window=60s scope=ip
ngrok-compat: owasp-crs-request → ngris waf in detect mode (logs matches and lets requests through; ngrok blocks by default) — the core ruleset is ngris's built-in baseline, not the full OWASP CRS (add your own SecLang in custom_rules with ruleset core+custom); set mode=block when ready
ngrok-compat: oauth: sign-in is an endpoint setting on ngris (auth mode sso), not a traffic-policy rule — add the OAuth / SSO method on the endpoint's Authentication tab, then your identity provider on its OAuth / SSO tab
# running with: restrict-ips · rate-limit · waf

Install the agent

One small binary for macOS, Linux, Windows or Docker. Other ways to install

curl -fsSL https://ngris.com/install.sh | sh

Save your token

Copy your auth token from the dashboard and save it once.

ngris auth --token <your-token>

Run the command you know

Point the agent at a local port and you are live on the edge.

ngris http 3000

Bring your traffic policy

In an endpoint’s Traffic policy tab, choose Import from ngrok and review the converted rules, with a report of anything skipped. How the converter works

Frequently asked questions

Is Ngris a good ngrok alternative?

Yes, if you want more than a tunnel. Ngris keeps the workflow you know: install a small agent and run ngris http 3000 for a public HTTPS URL. On top of it you get a policy engine on every endpoint, bot protection, edge login, app hosting, a Kubernetes operator and Iris, an AI that drafts your edge rules.

How do I migrate from ngrok to Ngris?

Install the agent with curl -fsSL https://ngris.com/install.sh | sh, save your token with ngris auth --token <your-token>, and run ngris http 3000 against the same local port. Pass --url to keep a stable hostname, or attach your own domain.

Can I bring my ngrok traffic policy?

Yes. In the dashboard, open an endpoint's Traffic policy tab and choose Import from ngrok, or call POST https://api.ngris.com/v1/tools/convert-ngrok-policy with your API key. The ngris agent also reads the ngrok file as-is: ngris http 3000 --traffic-policy traffic-policy.yml. You get native ngris rules to review plus a report of what was converted, what was skipped and why.

What does Ngris do that ngrok does not?

Ngris hosts your whole app behind the same edge as your tunnels, serves HTTP/3 on every endpoint, and includes Iris, an AI assistant that drafts firewall, rate-limit and traffic-policy rules with a dry-run before anything applies, plus an MCP server so your AI tools can run the edge.

Does Ngris work with Kubernetes?

Yes. Install the operator with helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator. Any Ingress with ingressClassName ngris becomes a tunnel, and 10 custom resources cover traffic policies, routing, edge login, domains, certificates and mTLS.

Can my AI assistant manage Ngris?

Yes. Add the MCP server at https://mcp.ngris.com/mcp to Claude Code, Claude Desktop or any MCP client. It exposes 340+ tools over the public API and can only do what your own credential allows.

A policy-first ngrok alternative. Free to start.

Same command, a full edge behind it. No card needed.

Start free Getting started

Ask an AI to summarise this page