On May 19, Anthropic announced a feature called MCP tunnels. The name sounds like plumbing. The implication is not.

MCP tunnels let AI agents connect directly to your company’s internal systems. Your databases. Your private APIs. Your ticketing system. Your knowledge base. All without exposing any of those systems to the public internet.

A lightweight gateway makes one outbound connection. No inbound firewall rules. No public endpoints. Traffic encrypted end to end. The agent reaches in. Nothing else reaches out.

If you have been using AI by copying data into a chat window and pasting the response back into your tools, this is the architectural shift that makes that workflow obsolete.

What this actually changes

Until now, most enterprise AI worked like this: a human pulled data out of an internal system, gave it to the AI, reviewed the output, and put the result back. The AI never touched the system directly. It operated in a sandbox, disconnected from the real work.

That disconnect is why so many teams stall after the pilot. The AI is technically capable, but operationally isolated. It can write a summary if you hand it the data. It cannot pull the data itself, check the status of a ticket, update a record, or chain three actions together across systems your team uses every day.

MCP tunnels remove that wall. An agent with tunnel access can query your CRM, check inventory in your ERP, pull the latest support tickets, and act on what it finds. Not because someone pasted a spreadsheet into a prompt. Because the agent has authorized, encrypted access to the source.

That is not a better chatbot. That is a collaborator with context.

Why the collaboration frame matters

Think about how you onboard a new team member. You do not hand them a printed report and ask them to work from it. You give them access to the systems. Slack, the project tracker, the shared drive, the database. You give them context so they can operate independently.

Most organizations have been onboarding AI the other way. Here is a document. Read it. Give me an answer. No system access. No persistent context. No ability to check the current state of anything.

MCP tunnels change the onboarding model for agents. You are no longer handing an AI a static document and asking it to perform. You are giving it the same kind of system access you would give a trusted team member, scoped and controlled, but real.

The organizations that figure this out first will not just get faster answers from AI. They will get agents that participate in workflows the way a person does: pulling current data, making decisions based on live state, and acting across systems without a human copying and pasting between tabs.

What to ask your technical team

This is a research preview. Not generally available yet. But the direction is set, and Anthropic is not the only one moving here. Google’s Gemini Spark is adding MCP support for third-party apps. The entire market is converging on agents that connect to your tools natively.

Here is what to bring to your next conversation with whoever manages your infrastructure:

Which internal systems would benefit most from agent access? Start with the ones where your team spends the most time pulling data manually. Support ticket queues, inventory lookups, CRM updates, reporting dashboards. These are the workflows where the copy-paste bottleneck costs the most hours.

What does our security posture look like for agent access? MCP tunnels use outbound-only connections with end-to-end encryption. No public endpoints. But your team needs to evaluate: which systems have the right access controls? Where does sensitive data live? What permissions should an agent have versus a person?

Are we building integrations that this would replace? Many teams are spending months building custom API wrappers, middleware, and data pipelines to feed information to AI tools. If native agent-to-system connections are becoming standard, some of that build work may be unnecessary. Better to know now than after the project ships.

The operational reality

This is Belief 1 and Belief 3 colliding. AI is an operations problem, and agents are collaborators, not tools. MCP tunnels are the infrastructure that makes both of those statements practical instead of philosophical.

When an agent can reach into your ticketing system, pull the five most urgent unresolved issues, cross-reference them against your knowledge base, draft responses, and queue them for human review, that is not automation. That is collaboration with a system that holds the same context your team does.

The companies already running agents inside their workflows, Walmart with Sparky across 10,500 stores, SAP deploying 200-plus specialized agents across enterprise functions, are proving the model works at scale. MCP tunnels are the connective tissue that lets every company, not just the ones with massive engineering teams, wire agents into their actual operations.

The question is not whether you need this specific feature today. The question is whether your organization is building toward a model where agents work inside your systems, or still operating in a world where AI is something you visit in a browser tab.

One of those models compounds. The other one stays flat.