Wormkey
www.wormkey.run- Category
- Developer Tools
- Rank
- No. 2976Tools index
Previous survey · No. 2847 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Deployment & Operations
- Interfaces
- CLI
- Builder
- @metagravity0
- GitHub
- 25 stars
- Date
About
A developer tool that generates public URLs for localhost applications in seconds without requiring accounts or dashboards. Simply run one command to create a secure tunnel and share your local development server with others.
What it does
Wormkey hands a running local web server a shareable address on the internet. A command line client opens one outbound WebSocket to a hosted edge gateway written in Go, which terminates TLS and forwards each incoming HTTP or WebSocket request back down that single connection, many requests interleaved at once. A small Node service issues each session a random three-part name plus secret tokens. The owner gets a separate claim link that turns on an in-page control bar for pausing the tunnel, locking it, capping viewers or removing a viewer.
Why it's ranked here
Beyond plain tunneling, the client is built to be driven by coding agents. It has a single-object JSON output mode, a flag that waits for a local readiness path before connecting, distinct numbered exit codes for failure kinds, captured request logs with local replay, scoped short-lived tokens, and a bundled MCP (Model Context Protocol) server exposing seven tunnel tools. The wire protocol is written down with frame types and limits, the code is MIT licensed, and the control plane ships tests for its token and credential boundaries.
What's good
Responses stream back chunk by chunk instead of being buffered, so progressive rendering survives the tunnel. The client strips hop-by-hop and spoofable forwarding headers before calling your server, caps request bodies at 10MB, answers 503 past 128 pending streams, and times out local calls at 60 seconds. Heartbeats go every 25 seconds, and reconnects back off from one to ten seconds while reusing the same session. Tokens are stored hashed and compared in constant time. Sessions default to a 24 hour life, and an optional flag generates basic auth credentials.
Tradeoffs
The control plane keeps sessions in an in-memory map, so a restart of that service drops every live session. By default the client talks to a hosted control plane and edge run by the project, meaning your traffic passes through their servers unless you self-host all three parts. The documented password prompt asks viewers to put the password in the URL query string. The command reference still calls close unimplemented, while the client source now ships it. Request inspection writes full forwarded headers and base64 request bodies to local logs.
How to use it well
Reach for it to show a teammate or client a work-in-progress app, receive webhooks on a laptop, or let an agent spin up a preview link it can check and tear down itself. Set a short expiry and turn on basic auth for anything not meant to be public. Keep request inspection off when real credentials flow through, since those logs keep them. It is not hosting: the link lives only while your process and the relay run, and teams needing persistent URLs or account controls should look elsewhere.
Technical notes+
docs/PROTOCOL.md specifies binary frames with a 1 byte type and 4 byte big-endian stream id, twelve frame types including PAUSE/RESUME, and v0 limits of 100 concurrent streams and a 10MB body. packages/cli/src/tunnel.ts implements the client: STRIPPED_REQUEST_HEADERS, MAX_PENDING_STREAMS = 128, REQUEST_TIMEOUT_MS = 60_000, BACKOFF_MS [1000, 2000, 5000, 10000]. packages/cli/src/cli.ts defines ExitCode values 10 to 16 and the run, logs, inspect, replay and wait-until-ready commands, with production defaults pointing at a Render-hosted control plane. packages/control-plane/src/index.ts is Fastify with sessions in a Map, sha256 token hashes and timingSafeEqual. packages/gateway/main.go sets CheckOrigin to always true and injects the overlay script into owner HTML responses. packages/mcp/src/index.ts is a hand-rolled stdio JSON-RPC server shelling out to the CLI.
Observed
- License
- MIT
- Languages
- TypeScript (CLI, control plane, MCP server) and Go (edge gateway)
- Install
- npm package wormkey, global install or npx
- Interfaces
- CLI, React overlay component, script-tag overlay, MCP server over stdio
- Runtime requirement
- Node 18 or later for the CLI
- Transport
- Single outbound WebSocket multiplexing HTTP and WebSocket streams
- Session storage
- In-memory map in the control plane
- Tests
- Control plane security tests using the Node built-in test runner
- Self-hosting
- Control plane, edge gateway and CLI all runnable locally
Read from README.md, package.json, docs/PROTOCOL.md, docs/CLI.md, packages/cli/LICENSE, packages/cli/package.json, packages/cli/src/cli.ts, packages/cli/src/tunnel.ts, packages/gateway/main.go, packages/control-plane/src/index.ts, packages/control-plane/test/security.test.ts, packages/mcp/src/index.ts.
What it can do
Generate public URL for localhost application
Local development server running on localhost → Public URL accessible from internet
Create secure tunnel to local server
Localhost application and port number → Encrypted tunnel connection
Share local development work with others
Running local application → Shareable public link
Expose local server without account setup
Single command execution → Active public tunnel
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.