{"rid":"egress/opentunnel","card":{"rid":"egress/opentunnel","eid":"github-anomalyco","topic":"egress","slug":"opentunnel","provider":"OpenTunnel","url":"https://github.com/anomalyco/opentunnel","domain":"github.com","category":"hosted blind tls tunnel (tcp 443, tls clienthello only)","tier":"free","verdict":"fails-egress","vorder":5,"grp":"rejected","confidence":"reported","binding":"none","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-06","n_evidence":1,"usd_month":null,"usd_per_tb_month":null,"summary":"each client gets a unique <id>.opentunnel.xyz subdomain and TLS is terminated locally","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"opentunnel","provider":"OpenTunnel","url":"https://github.com/anomalyco/opentunnel","category":"hosted blind tls tunnel (tcp 443, tls clienthello only)","tier":"free","free_tier":{"stated":"each client gets a unique <id>.opentunnel.xyz subdomain and TLS is terminated locally","unit":"none","metered_on":"none","source_url":"https://github.com/anomalyco/opentunnel","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://github.com/anomalyco/opentunnel","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://github.com/anomalyco/opentunnel","notes":""},"egress":{"terms":"No byte allowance or price is published in the README.; ingress: http-only","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://github.com/anomalyco/opentunnel"},"interface":["cli"],"interface_detail":"npm client.","tooling":"vendor client (TypeScript).","chaining":"Web ingress for a free VM, with client-side TLS termination.","limits":[],"limits_note":"","binding":"none","binding_note":"No quota is published, so the byte wall is unknown; the hard wall is that the relay reads only the TLS ClientHello and routes by SNI, so only TLS-wrapped traffic reaches the client. No UDP.","identity_cost":{"kind":"anonymous","detail":"a client claims a route by hostname; no account is described in the README.","country":"None"},"reliability_note":"Depends on a Cloudflare TCP Workers beta and a temporary AWS relay.","confidence":"reported","confidence_note":"The hosted service is young (MIT declared, no LICENSE file); a published quota would sharpen the binding.","evidence":[{"url":"https://github.com/anomalyco/opentunnel","date":"2026-10-23","proved":"'It accepts public TCP on 443 and reads only the TLS ClientHello. A tunnel hostname is carried, still encrypted, over the tunnel bridge WebSocket'"}],"verdict":"fails-egress","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"Blind TLS relay on Cloudflare Workers with an AWS relay for inbound TCP. Interesting shape, no UDP.","extras":{"wg_path":"none","wg_detail":"","ingress":"http-only","volume_tib_month":null,"volume_stated":"No byte allowance or price is published in the README.","bytes_transit":"yes","transit_note":""}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0,"unit":"TB","per":"month","currency":"USD","usd":0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}