Hosted Clusters in Pomerium Zero & MCP Hacking (endpoints from localhost via ssh)

Service update: Pomerium is retiring the hosted data plane and its pom.run tunnel service. This post records the original beta announcement. For current setup instructions, use Migrate from pom.run or Protect an MCP Server.

If you’re building an MCP server and you want a public model (ChatGPT, Claude, or Gemini) to actually call it, you hit the same wall: All the frontier models need a public HTTPS URL.

So instead of hacking on whatever MCP tool you were working on, now you’ve got to figure out tunneling, infra, or weird gNAT issues when you are just trying to hack.

Hosted Clusters in Pomerium Zero (beta)

Today we shipped Hosted Clusters in Pomerium Zero — our first hosted data plane — built for remote MCP servers.

If you’ve got SSH (and you do), just type

ssh -R 0 pom.run

In the terminal from the machine where your MCP server is listening.

Sign in, and Pomerium hands you a public HTTPS URL that forwards back to your localhost over an SSH reverse tunnel. No public NAT? No problem.

Now ChatGPT, Gemini, Claude — anything that can hit an MCP endpoint — can reach the MCP server you’re hacking on without you needing to deploy infra.

What this saves you from

This replaces the whole “I just need a URL” dance:

• no tunnel or VPN client to install (vs ngrok, funnels, Cloudflare Tunnel, etc.)
• no TLS setup
• no fiddling with ephemeral URLs
• you still get sign-in + policy (the way Pomerium works), instead of “here’s a public URL, hope nothing weird happens”

Best of all, it’s just SSH. And you’ve already got it.

What I’ve been using it for

I’ve been testing a little SQLite MCP server locally. Tools like list_tables, query, that kind of thing.

Now the flow is:

• run the server
• ssh -R 0 pom.run
• paste the HTTPS URL into ChatGPT’s Apps SDK (here’s a template)
• ask ChatGPT to call a tool
• it hits my laptop immediately

That’s it. MCP dev loop stays tight and light.

Move to Your Own Pomerium Instance

Create a standard cluster in Pomerium Zero and connect a Pomerium instance that you operate. Existing hosted users can follow Migrate from pom.run.

For new MCP deployments, use Protect an MCP Server.

template for ChatGPT apps SDK: https://github.com/pomerium/chatgpt-app-typescript-template

Happy hacking this holiday season 🎄, Bobby