New — Iris AI drafts your firewall, routing & rate-limit rules. Explore AI features →

Drive ngris from your terminal, your cluster or your code.

The ngris CLI for tunnels, deploys and local debugging, a Kubernetes operator with Ingress and Gateway API support, the REST API, an MCP server for your AI assistant, and a converter that turns ngrok traffic policies into ngris rules.

Start free Getting started

macOS, Linux, Windows
Kubernetes operator
REST API & MCP

Terminal ngris CLI

$ brew install ngris-edge/homebrew-tap/ngris
$ ngris auth --token <your-token>
# a tunnel with edge rules from a file
$ ngris http 3000 --traffic-policy policy.yml
# serve a folder, or share one in a browser
$ ngris http ./dist
$ ngris webfm ./reports
# what just hit my backend?
$ ngris inspect --status 5xx --follow
# ship an app
$ ngris deploy ./site

The ngris CLI

One binary for macOS, Linux and Windows on amd64 and arm64. It connects out to the edge, so nothing on your machine has to accept inbound connections.

HTTP, TCP and UDP tunnels

ngris http 3000, ngris tcp 5432, ngris udp 5353. Give a host:port to reach another machine on your network.

Edge rules from flags

--traffic-policy with a YAML file, or single flags: --basic-auth, --cidr-allow, --rate-limit, --force-https, --compression, --verify-webhook, --mutual-tls with --client-ca.

Load balancing

Run the same endpoint from several machines and the edge spreads traffic across the agents; --lb-weight sets each agent's share.

Serve a folder

ngris http ./dist serves a directory as a static site through a tunnel, with directory listings if you turn them on.

Web file manager

ngris webfm ./reports shares a folder in the browser, read-only by default. --rw allows uploads and needs basic auth or mTLS.

Local inspector

While a tunnel runs, a web UI on 127.0.0.1:9090 and ngris inspect, ngris replay and ngris export show and re-send the requests that reached your backend.

Deploys and apps

ngris deploy uploads a folder; ngris apps creates apps, follows builds and runtime logs, sets env vars and secrets, schedules cron jobs, and promotes or rolls back. App hosting

Config you can check

ngris config check validates your config file and environment without connecting, which helps in CI and in containers.

Install anywhere

brew install ngris-edge/homebrew-tap/ngris, winget install Ngris, curl -fsSL https://ngris.com/install.sh | sh, or docker pull ghcr.io/ngris-edge/ngris.

Kubernetes, the native way

The ngris operator runs in your cluster and connects your Services out to the edge, so you need no LoadBalancer, no public node IP and no inbound firewall rule.

install & expose

$ helm install ngris-operator \
    oci://ghcr.io/ngris-edge/charts/ngris-operator

# any Ingress with the ngris class becomes a tunnel
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  annotations:
    ngris.io/region: eu-north-1
spec:
  ingressClassName: ngris
  rules:
  - host: web.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: { name: web, port: { number: 80 } }

Ten CRDs in `ngris.io`

For everything Ingress can't say

Tunnel and TunnelMatrix for the connection itself, NgrisEndpoint for the public endpoint.
NgrisTrafficPolicy, NgrisRoutingRule and NgrisAuthPolicy for rate limits, routing and edge login.
NgrisDomain, NgrisCertificate, NgrisClientCA and NgrisMTLSAttachment for domains, certificates and mTLS.
Gateway API: GatewayClass, Gateway and HTTPRoute are picked up when the Gateway API CRDs are installed. Support is partial today; the CRDs above cover the rest.

An Ingress can't express rate limits, mTLS or auth; for those, use the Tunnel and NgrisTrafficPolicy resources directly. Kubernetes & CI docs

The REST API, and a Python SDK

Everything the dashboard does goes through the public API, so you can script it, run it from CI or build on it.

REST API

Base URL https://api.ngris.com/v1. Send an API key in the X-API-KEY header: endpoints, tunnels, apps, domains, policies, traffic and more. API reference

API keys

Create keys in the dashboard with an expiry date and an IP allowlist, and revoke them at any time.

Python SDK

Sync and async clients for the API, plus ngris.connect() to start a tunnel from your code. Source and docs on GitHub.

Or ask your AI assistant

The ngris MCP server at mcp.ngris.com/mcp gives Claude Code, Claude Desktop or any MCP client 340+ tools over the same API: expose a port, deploy, add a rule, find and replay a failed request. It signs in with OAuth or an API key and can only do what you can.

Claude Code

$ claude mcp add --transport http \
    ngris https://mcp.ngris.com/mcp

Your account, from chat

Reads run, writes are confirmed

Endpoints, apps, domains, edge policy, traffic, alerts, billing and support.
No admin surface: every call uses your own credential.
About the MCP server · Connect guide

Coming from ngrok? Bring your traffic policy.

Paste an ngrok traffic-policy.yaml and ngris converts it to native ngris rules, with a report of what converted, what it skipped and why.

traffic-policy.yml · from ngrok

on_http_request:
  - name: office only
    expressions:
      - "req.url.path.startsWith('/admin')"
    actions:
      - type: restrict-ips
        config: { allow: ["203.0.113.0/24"] }
  - name: api limit
    actions:
      - type: rate-limit
        config:
          capacity: 100
          rate: "60s"
          bucket_key: ["conn.client_ip"]
  - actions:
      - type: owasp-crs-request
  - actions:
      - type: oauth
        config: { provider: google }

ngris agent · same file, no edits

$ ngris http 3000 --traffic-policy traffic-policy.yml
traffic-policy: detected ngrok format — converted 3 rule(s), skipped 1
ngrok-compat: rate-limit: ngrok token-bucket (capacity/rate/bucket_key) mapped to ngris fixed-window (limit/window/scope) — close but not identical; verify limit=100 window=60s
ngrok-compat: owasp-crs-request → ngris waf (Coraza core ruleset, mode=detect for safe rollout) — CRS config differs; review + flip to mode=block when ready
ngrok-compat: oauth: auth is configured at the ENDPOINT level on ngris (mode=oauth/oidc/basic), not as a traffic-policy rule — set it on the endpoint's Access settings
# running with: restrict-ips · rate-limit · waf

Dashboard

An endpoint's Traffic policy tab → Import from ngrok. The result opens in the YAML editor with the report next to it; nothing changes until you save.

API

POST /v1/tools/convert-ngrok-policy with your API key and {"policy": "<yaml>"} returns ngris_yaml, converted, skipped and warnings.

MCP

The ngrok_policy_convert tool, so your AI assistant can migrate a policy for you.

Then start the tunnel the way you already know: ngris http 3000. Ngris vs ngrok

Frequently asked questions

How do I install the ngris CLI?

On macOS: brew install ngris-edge/homebrew-tap/ngris. On Windows: winget install Ngris. On Linux: curl -fsSL https://ngris.com/install.sh | sh. Or run the container image ghcr.io/ngris-edge/ngris. Then save your auth token with ngris auth --token <your-token>.

Can I migrate my ngrok traffic policy?

Yes. In the dashboard, open an endpoint's Traffic policy tab and choose Import from ngrok, or call POST https://api.ngris.com/v1/tools/convert-ngrok-policy with your API key and the YAML in the policy field. The ngris agent also reads an ngrok policy file as-is: ngris http 3000 --traffic-policy traffic-policy.yml. You get native ngris rules to review plus a report of what was converted, what was skipped and why. The MCP tool ngrok_policy_convert does the same from your AI assistant.

How do I use ngris with Kubernetes?

Install the operator with helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator. Any Ingress with ingressClassName ngris becomes a tunnel, and ten ngris.io custom resources cover traffic policies, routing, edge login, domains, certificates and mTLS. Gateway API HTTPRoutes are supported in part.

How do I authenticate to the REST API?

Create an API key in the dashboard, optionally with an expiry date and an IP allowlist, and send it in the X-API-KEY header to https://api.ngris.com/v1. The API reference at ngris.com/docs/api lists every endpoint.

Can an AI assistant use these tools?

Yes. Add the MCP server at https://mcp.ngris.com/mcp to Claude Code, Claude Desktop or any MCP client. It exposes 340+ tools over the same public API and can only do what your own credential allows.

Install once, script everything.

Start free, install the CLI or the operator, and drive your edge from the tools you already use.

Start free Read the docs

Ask an AI to summarise this page