Logo

The connectivity stack for private environments

Publish services to the internet or reach them privately through outbound tunnels with identity, access policy, and connection logs managed at the edge.

Start with rstreamSee how it works

Get started

Go live in three steps

Install the CLI, connect a project, then run rstream forward.
  1. npm i -g @rstreamlabs/rstream-cli
    1

    Install the CLI

    Install rstream on the machine, server, or device that can reach your local service.

  2. rstream loginrstream project use demo
    2

    Connect your project

    Authenticate once, then select the project that will own your endpoints and credentials.

  3. rstream forward 8080
    3

    Open your first endpoint

    Forward a local port and get a secure public address ready to share.

rstream is compatible with Linux, macOS and Windows. Get rstream now.

How it works

Inside an rstream tunnel

The agent connects from the private environment. The edge checks the client identity and policy before routing approved traffic to the upstream and recording the connection.

Clients

d76659d1.t.aws-global-1.c.rstream.io

GET /image.svg

rstream edge network

rstream engine server

accepting connection...

checking IP reputation...

checking geo policy...

verifying token...

routing upstream...

streaming response...

writing connection log...

Upstream

rstream agent

$ rstream forward 8080

forwarding: https://d76659d1.t.aws-global-1.c.rstream.io

waiting for connections...

new connection

local service

$ python -m http.server 8080

Serving HTTP on 127.0.0.1:8080

GET /image.svg HTTP/1.1" 200 -

Go deeper into tunnel types, protocols, and how traffic is forwarded. Explore tunnels.

Core workflows

Public endpoints and private application access

Publish services for standard clients or let authenticated applications dial them privately through the same tunnel runtime.

Public endpoints

Publish a local or private service on a public address while the upstream stays behind an outbound-only tunnel.

Private access

Let authenticated CLI and SDK clients dial named services without publishing them or creating a managed Layer 3 network.

Outbound-only upstreams

Keep origins off the public Internet. Agents establish the connection from inside the environment, so no inbound firewall rule is required.

Policy before routing

Verify people and machines at the edge, apply scoped access policy, then relay approved traffic to the private side.

HTTP and beyond

Use one runtime for HTTP, WebSocket, TCP, TLS, QUIC, DTLS, WebTransport, and private stream or datagram workloads.

Logs and observability

Inspect routing and policy decisions in connection logs, follow live events, and track operational trends through metrics and webhooks.

Learn the core building blocks behind tunnels, agents, and edge routing. Explore the docs.

Security

Zero-trust networking with identity and policy

Verify people and machines at the entrypoint, apply scoped access rules, then trace routing and enforcement decisions in connection logs.

Private origins, encrypted transport

Keep upstreams behind outbound agent connections and protect the agent-to-edge path with encrypted transport.

Human and machine identity

Authenticate browser users with rstream Auth and machines with scoped tokens or mutual TLS before traffic is routed.

Scoped credentials

Limit discovery, creation, and access permissions to specific tunnels, labels, and operations.

Network and geographic policy

Restrict supported entrypoints by trusted IP ranges and geographic rules before they reach upstream services.

Mutual TLS identity

Use client certificates for agent control-channel authentication and for published tunnel access policies.

Audit and credential lifecycle

Record enforcement decisions, then rotate or revoke credentials as access requirements change.

Dive deeper into zero-trust access, rstream Auth, tokens, and enforcement rules at the edge. Read security docs.

Use cases

Use rstream wherever software needs to connect

Apply the same connectivity model to development services, internal systems, remote operations, and agent workflows.

Publish local services

Give a local application a stable public address for webhooks, previews, demos, QA, or external integrations without changing the surrounding network.

Reach private services

Dial internal services by name from authenticated applications and operators while the service remains unavailable to public clients.

Operate remote machines

Reach machines and devices through WebTTY, private tunnels, and APIs while each remote environment keeps an outbound-only connection.

Connect AI agents to real systems

Give agents scoped access to local services, remote machines, GPU runners, and device-local tools, with observable access and task cleanup.

rstream dashboard webtty overview

Explore practical examples for WebRTC video, computer vision, private AI infrastructure, database access, and remote operations. Browse the guides.

Declarative tunnels

Infrastructure as code for consistent tunnels

Define tunnels as configuration that stays in sync with deployments. rstream reconciles desired state and applies updates as services change, using YAML, Docker labels, and Kubernetes custom resources. Protocols, upstream targets, publishing, identity, and access policy live in versioned configuration.

YAML specification

Declare protocol, upstream target, publishing, and access policy in a versioned specification.

Docker labels

Attach tunnel configuration to services through labels so tunnel state follows the runtime stack.

Kubernetes operator

Expose Services with RstreamConnection and RstreamTunnel resources while the operator manages agents and status.

Reconciliation

Keep tunnel state aligned as services change, avoiding drift and ad-hoc tunnel sprawl.

version: 1
tunnels:
  - name: "http-server"
    forward: "127.0.0.1:8080"
    tunnel:
      publish: true
      protocol: "http"
      labels:
        app: "http-server"
      http:
        version: "http/1.1"
        auth:
          token: true
          rstream: true

Move from ad-hoc setup to reconciled connectivity that stays aligned over time. Learn declarative tunnels.

rstream WebTTY

Identity-aware terminal access for remote systems

rstream WebTTY provides browser-based terminal access for managing machines and fleets. It enables secure remote command-line access without inbound ports or network reconfiguration, and sessions can be opened from the web dashboard, the CLI, or an SDK integration with identity and policy enforced at the entrypoint.

Browser sessions

Open remote terminal sessions directly from a browser, without requiring local SSH setup.

Fleet access

Use a consistent access path for machines and devices across environments, with identity and policy applied at the entrypoint.

Outbound-only deployment

Keep inbound ports closed. The WebTTY server establishes connectivity outbound.

Operational integrations

Open sessions from the dashboard, from the CLI, or embed access paths into tooling through SDK integration.

For a live walkthrough, open the Web Remote Terminal demo.

Platform depth

One runtime across protocols and workloads

Use the same runtime for protocol-native endpoints, policy and logs, remote operations, and scoped agent workflows.

Protocol coverage

Web, streams, and real-time on one edge

Publish or privately dial web, stream, and datagram workloads through one access model, with managed STUN and TURN for real-time systems.

Published + privateOne access model

Web

HTTP/1.1HTTP/2HTTP/3WebSocketHTTP UpgradeWebTransport

Streams

TCPTLS

Realtime

QUICDTLSSTUNTURNWebRTC signalingSCTP workloads
Custom domainsCustom workloads

Security & observability

Identity-aware access with connection evidence

Authenticate people and machines, enforce edge policy, then trace connection decisions through logs, metrics, events, and signed webhooks.

connection · 93bd9251allowed
Identity verifiedtoken / mTLS
Edge policy allowedIP / Geo
Upstream routedeu-west-3
Connection recordedstream.summary

Connection logs · Metrics · Signed webhooks

Remote operations

Operate machines without opening SSH

Reach WebTTY servers behind NAT from the browser, CLI, or an SDK while the remote machine keeps an outbound-only connection.

edge-node · WebTTY

› rstream webtty client \

--url rstrm://edge-node

connected to edge-node

identity verified · session ready

› _

Optional E2E

No inbound port

Agent-native workflows

Connect agents to the systems where work happens

Give Codex, Claude Code, and other MCP clients scoped access to local services, remote machines, and device-local tools, with task cleanup attached.

Agent workflowScoped

Codex

Claude Code

→

rstream

MCP · Skills · SDKs

→

Local service

Remote machine

Device-local MCP

rstream_remote_exposecleanup attached

Bring rstream into the stack you already run through the CLI, Kubernetes Operator, run/watch controllers, or native SDKs. Every client runtime is open source and available for inspection. Explore the SDKs. Review the source. Read the specification.

Pricing

A flat monthly price for each project

Start free, then move to a predictable Pro plan with included tunnel capacity and bandwidth as your project grows.

Basic

Ideal for individuals and small projects that need hosted access, WebTTY, and 24-hour logs.

Free

  • HTTPS tunnels
  • WebSocket support
  • Registered WebTTY servers
  • 24-hour WebTTY logs
  • 24-hour connection logs
  • Token-protected access
  • Fine-grained access tokens
  • 5 GB bandwidth per month
  • 2 simultaneous tunnels
Start now

Pro

Designed for small teams requiring full protocol support, strong security controls, and support.

$99 / month

$49 / month

Limited launch offer — locked forever for early users

  • Everything in Basic
  • Global and regional routing
  • Private tunnels
  • TLS, QUIC and DTLS endpoints
  • Published TCP tunnels and reserved addresses
  • Custom domains
  • rstream Auth (interactive HTTP auth)
  • mTLS Tunnel access
  • Challenge mode (HTTP)
  • IP and Geo access policies
  • 30-day connection logs
  • 30-day WebTTY logs
  • Project webhooks
  • Analytics
  • Email support
  • 200 GB bandwidth per month
  • 50 simultaneous tunnels
Start now

Enterprise

For organizations requiring dedicated capacity, workspace-level billing, protected data, audit, and source review.

Custom

  • Everything in Pro
  • Dedicated runtime clusters
  • Optional dedicated or on-premises control plane
  • Workspace-level billing
  • Unlimited enterprise projects
  • Unlimited bandwidth
  • Unlimited tunnels
  • Workspace Protection
  • Trusted browsers and devices
  • Workspace Recovery Kit
  • Activity audit logs and exports
  • Server source code audit or escrow
  • Dedicated support
Contact sales

Prices are listed in US dollars. Applicable taxes may be added. Invoices are provided in the dashboard after purchase. Delete a paid project from the dashboard to stop its future billing.

Compare managed plans, limits, and feature availability. View pricing.

Need to run entirely inside your own perimeter? The free Community Edition is available as a separate self-hosted runtime.

FAQ

What technical teams want to know

Common questions about the platform, who it is for, supported protocols, security, observability, SDKs, and deployment options.

rstream publishes local or private services on public endpoints and lets authenticated clients dial named private services. The origin connects outbound, while the edge handles identity, access policy, routing, and connection logs.

For more detailed information, refer to the documentation.

Connect your first service

Start with rstreamDownload rstream CLI

CLI installation · View all methods

/bin/sh -i -c "$(curl -fsSL https://rstream.io/scripts/install.sh)"