frederico-kluser

Expose Port Cloudflare Agent Skill — DevOps skill for Claude Code

DevOps community

Agent skill + scripts with a one-command global installer (macOS/Linux): expose any local port online via Cloudflare Tunnel with a one-time-password gate.

How to install Expose Port Cloudflare Agent Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open frederico-kluser/expose-port-cloudflare-agent-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Expose Port Cloudflare Agent Skill does

Agent skill + scripts with a one-command global installer (macOS/Linux): expose any local port online via Cloudflare Tunnel with a one-time-password gate. Password printed as a terminal QR, consumed on first access, URL auto-cleaned, session cookie. No account, no domain, no project changes.

Alternatives in DevOps

Skill Claw — OpenClaw instance administration — manage hosts across macOS, Ubuntu/Debian, Docker, OCI, and Proxmox 2.8k ★
Module 18 GCP Quick.En — Slash /module-18-gcp-quick — Module 18 Lesson 4-1 — Authenticate gog using bundled OAuth (no terminal input re 347 ★
Replace And Ensure $github PAT Is Set In Your Shell — echo "${GITHUB_PAT}" docker login ghcr.io -u --password-stdin 225 ★

README

expose-port-cloudflare-agent-skill

**v1.3.1** · **Expose any local port on the internet through a Cloudflare Tunnel — protected by a password shown as a QR code in the terminal.**

No account, no domain, no changes to your project. The skill mints a random password, appends it to the public URL, prints the full link as a **QR code** (scan and open), **keeps the password valid until you revoke it** (reusable by default — a link preview, a second device, or a re-open can never burn it; `TOKEN_REUSE=0` restores single-use). Opening the link redirects to the clean URL and hands the browser a secure session cookie. Anyone without the password gets **401** — on HTTP **and** WebSocket.

This is an [agent skill](SKILL.md) (Claude Code / agent-compatible) with executable scripts. The target is parsed smartly: `8080`, `localhost:8080`, `http://localhost:8080` or `https://host:9443/path` all work.

Why the gate and the proxy exist

A plain `cloudflared tunnel --url http://127.0.0.1:8080` leaves the service **public and unauthenticated** — anyone with the link can use it. Two failure classes also break naive tunnels:

No auth: quick-tunnel URLs are random but shareable; nothing stops an unintended holder from using the service.
Host-validation fences — Vite rejects tunnel hostnames with 403 since CVE-2025-24010; custom servers (e.g. agent harnesses) often admit only loopback hosts for API/WebSocket paths. Result: the page opens, the app is dead.
Origin mismatch — a proxy that rewrites Host but not Origin breaks WebSocket handshakes (RFC 6455 §10.2).

This skill solves all three with one zero-dependency Node proxy, **without touching the project being exposed**.

Architecture

Browser ── scan QR → https://*.trycloudflare.com/?key=
             │  Cloudflare edge (TLS, HTTP/2, WebSocket via extended CONNECT)
             ▼
        cloudflared (quick tunnel, outbound-only, no account needed)
             │  http://127.0.0.1: