mygrok

mygrok is your own ngrok. It forwards a local port to a stable public HTTPS URL on a domain you own — https://jarvis.example.com — running on a server you own. No account to create, no session limits, no random subdomain that changes every restart, and nothing phoning home.

mygrok http 3000 --subdomain=jarvis     # → https://jarvis.example.com
mygrok serve gallery ./photos           # static folder, public URL, one command
mygrok mcp 8790 --subdomain=tools       # local MCP server → claude.ai connector

Two binaries, about 9,500 lines of Go, eight dependencies. mygrokd runs on any box with wildcard DNS pointed at it; mygrok runs wherever you want to expose something.

Why bother self-hosting

Tunnel services are fine until you're paying monthly for a subdomain that keeps changing, or your webhook testing hits a session limit mid-debug, or you'd rather not route an unreleased product through someone else's infrastructure. mygrok is the boring alternative: you own the server, the domain, the certificate, the auth token, and the binary.

What's in it

• Real TLS, automatically. Let's Encrypt certificates that renew themselves. A wildcard via DNS-01 with Route 53, Cloudflare, or DigitalOcean — or per-hostname on demand with no cloud credentials at all.
• Survives reboots. One command installs a launchd agent or a systemd unit, with secrets kept out of argv and out of world-readable unit files.
• Access control that isn't just a password. Per-tunnel and global IP allow/block lists, plus multi-user WebAuthn passkeys with per-tunnel grants — issue an invite link, they register with Touch ID, you grant them the tunnels they should reach. Managed from a web UI or the CLI.
• MCP connectors. Expose a local MCP server to claude.ai, gated by an unguessable capability URL.
• LAN-direct. Visitors on the same network get redirected straight to your machine instead of round-tripping through the server — with a real certificate and no browser warnings.
• Heals from network blips in under a second, instead of sitting in backoff waiting for a dead session to time out.

Getting started

The server goes up in one command on any $5 VPS — DigitalOcean, Hetzner, EC2, Vultr, or a Raspberry Pi under your desk:

curl -sSL https://raw.githubusercontent.com/schappim/mygrok/main/deploy/install-server.sh \
  | sudo bash -s -- --domain example.com --email you@example.com

It creates a service user, writes a hardened systemd unit, generates an auth token, opens the firewall, and prints the two DNS records you still need. Then on your laptop:

brew install schappim/mygrok/mygrok

Clients downloaded from your own server arrive already knowing how to reach it.

MIT licensed. Full documentation, including a complete CLI reference and per-cloud deployment guides, is in the repository.