On May 19, Anthropic announced a feature called MCP tunnels. The feature connects agents to private business systems.

MCP tunnels let AI agents connect directly to your company’s internal systems. Your databases. Your private APIs. Your ticketing system. Your knowledge base. All without exposing any of those systems to the public internet.

A lightweight gateway makes one outbound connection. No inbound firewall rules. No public endpoints. Traffic encrypted end to end. The agent reaches in. Nothing else reaches out.

If you have been using AI by copying data into a chat window and pasting the response back into your tools, this is the architectural shift that makes that workflow obsolete.

What this actually changes

Until now, most enterprise AI worked like this: a human pulled data out of an internal system, gave it to the AI, reviewed the output, and put the result back. The AI never touched the system directly. It operated in a sandbox, disconnected from the real work.

That disconnect is why so many teams stall after the pilot. The AI is technically capable, but operationally isolated. It can write a summary if you hand it the data. It cannot pull the data itself, check the status of a ticket, update a record, or chain three actions together across systems your team uses every day.

MCP tunnels remove that wall. An agent with tunnel access can query your CRM, check inventory in your ERP, pull the latest support tickets, and act on what it finds. It can do this because the agent has authorized, encrypted access to the source.

That gives the agent the context to collaborate.

Why the collaboration frame matters

Think about how you onboard a new team member. You give them access to the systems they need for their work. Slack, the project tracker, the shared drive, the database. You give them context so they can operate independently.

Most organizations have been onboarding AI the other way. Here is a document. Read it. Give me an answer. No system access. No persistent context. No ability to check the current state of anything.

MCP tunnels change the onboarding model for agents. You are giving it the same kind of system access you would give a trusted team member, scoped and controlled, but real.

The organizations that figure this out first will get faster answers and agents that participate in workflows the way a person does: pulling current data, making decisions based on live state, and acting across systems without a human copying and pasting between tabs.

What to ask your technical team

This is a research preview. Not generally available yet. But the direction is set, and Anthropic is not the only one moving here. Google’s Gemini Spark is adding MCP support for third-party apps. The entire market is converging on agents that connect to your tools natively.

Here is what to bring to your next conversation with whoever manages your infrastructure:

Which internal systems would benefit most from agent access? Start with the ones where your team spends the most time pulling data manually. Support ticket queues, inventory lookups, CRM updates, reporting dashboards. These are the workflows where the copy-paste bottleneck costs the most hours.

What does our security posture look like for agent access? MCP tunnels use outbound-only connections with end-to-end encryption. No public endpoints. But your team needs to evaluate: which systems have the right access controls? Where does sensitive data live? What permissions should an agent have versus a person?

Are we building integrations that this would replace? Many teams are spending months building custom API wrappers, middleware, and data pipelines to feed information to AI tools. If native agent-to-system connections are becoming standard, some of that build work may be unnecessary. Better to know now than after the project ships.

The operational reality

This is Belief 1 and Belief 3 colliding. AI is an operations problem, and agents are collaborators. MCP tunnels are the infrastructure that makes both of those statements practical.

When an agent can reach into your ticketing system, pull the five most urgent unresolved issues, cross-reference them against your knowledge base, draft responses, and queue them for human review, that is collaboration with a system that holds the same context your team does.

The companies already running agents inside their workflows, Walmart with Sparky across 10,500 stores, SAP deploying 200-plus specialized agents across enterprise functions, are proving the model works at scale. MCP tunnels are the connective tissue that lets companies of many sizes wire agents into their actual operations.

Consider whether your organization is building toward a model where agents work inside your systems, or still operating in a world where AI is something you visit in a browser tab.

One of those models compounds. The other one stays flat.