Enterprise exclusive

Model Tunnel

Your models, on your servers, inside the same catalog as the frontier. One outbound connection turns any OpenAI-compatible runtime into private/your-org/your-model, governed like everything else, billed at zero.

Talk to sales See the Enterprise plan

Architecture

One outbound connection, nothing inbound

Your firewall rules don't change. The tunnel dials out; the gateway never dials in.

Install

Production in an afternoon

Point it at your runtime, give it a name, bring it up. The credential is minted on your hardware; the API can list, rotate and revoke tunnels but can never create one.

1. Install the binary next to vLLM, Ollama, TGI or any OpenAI-compatible server.
2. Bring the tunnel up. It authenticates with a pinned mTLS identity and starts heartbeating.
3. Publish models. They appear in your org's catalog as private/…, callable with the same SDKs, keys, budgets and locks.

Binary

curl -fsSL https://get.switchgate.ai/tunnel | sh

switchgate tunnel up \
  --runtime http://localhost:8000/v1 \
  --publish private/acme/legal-qwen-72b \
  --max-concurrency 32

Kubernetes

helm install sg-tunnel switchgate/tunnel \
  --set runtime.url=http://vllm.inference.svc:8000/v1 \
  --set publish[0]=private/acme/legal-qwen-72b \
  --set replicas=2

Security model

Designed for the paranoid reviewer

Outbound-only: no inbound ports, no public endpoint, nothing to scan. If the tunnel is down, the model simply isn't reachable.
Pinned mTLS identity per tunnel: rotate or revoke each one individually via the API; a revoked identity is severed in seconds.
Content stays home: prompts and completions for private models are answered inside your network; the control plane receives routing metadata only.
Governed like everything else: per-user budgets, model locks, key rate limits and audit events apply to private models exactly as to cloud ones.
Team scoping: restrict each published model to named teams, so the legal fine-tune is not the intern's toy.
High availability: multiple replicas per runtime; the gateway load-balances and reroutes around a lost connection in seconds.

Questions

Model Tunnel FAQ

Is the Model Tunnel an AI or an agent that acts on my server?

No. It's a small static binary (or container) whose entire job is to hold one outbound mTLS connection open to the gateway and relay inference requests to the runtime next to it. It executes nothing else, listens on no ports, and its source-available code can be audited before it touches production.

Do prompts to my private model ever leave my network?

No. Requests to private/ models are relayed through the tunnel and answered by your runtime inside your network. The control plane sees routing metadata (model name, token counts, latency, the trace ID) so your ledger works; it never sees content.

What does it cost to call my own model?

Zero credits. You already paid for the GPUs. Tunneled models appear on the same ledger with real token counts so utilization is visible, billed at 0.

What happens if the tunnel drops?

Run multiple replicas: the gateway load-balances across them and routes around a lost connection in seconds. You can also declare cloud fallbacks per model, so private-first can degrade to a provider you approve instead of an error.

Why is it Enterprise-only?

Because it's an inside-the-perimeter component, and doing that responsibly means SAML/SCIM identity, org-level allowlists, a DPA and a named engineer on our side. Those live on the Enterprise plan. Tunnels you set up today will also be marketplace-ready when reselling opens.

Your GPUs deserve a seat in the catalog

The Model Tunnel ships with the Enterprise plan, with a named engineer to hold the wrench.

Talk to sales Explore Enterprise