Aeion Bridge vs Manual Tunneling Solutions

Traditional tunneling requires inbound access:

``` ngrok: ngrok agent on local machine ↑ inbound TCP (port 4443) ngrok cloud servers ↓ HTTPS Your app

Problem: Corporate firewalls block inbound ports. Solution: Pay for ngrok's more expensive plans with tunnelBehindFirewall option.

Cloudflare Tunnel: cloudflared daemon on local machine ↑ outbound Cloudflare edge ↓ HTTPS Your app

Problem: Need Cloudflare account, DNS setup, teams/org setup. Solution: 1-2 hours of configuration before first tunnel.

SSH Tunnel: ssh -R 8080:localhost:3000 user@vps.example.com ↑ outbound SSH (port 22) VPS with port forwarding ↓ HTTPS Your app

Problem: VPS cost, SSH key management, restart scripts, monitoring. Solution: Ansible/Capistrano scripts + cron jobs. ```

Aeion Bridge uses outbound only:

``` Bridge client on your laptop ↑ outbound WebSocket (port 443) Aeion OS cloud ↓ Your app

No inbound ports. No firewall exceptions. Works from any network.

This is the critical difference. ```

ngrok (Personal/Startup plans):

``` Personal: $0/month → 1 tunnel, 4-hour timeout, random subdomain → Not suitable for production

Startup: $50/month → 5 tunnels, no timeout, custom domains → Basic auth, IP allowlist → No Team features

Pro: $100/month → 10 tunnels, custom domains → Teams, SAML SSO → API access, inspection, replay

Business: $200/month → Unlimited tunnels → SAML SSO, roles → Edge routes, header manipulation

Total: $600-2,400/year Plus: Time to configure and maintain ```

Cloudflare Tunnel (zero-trust approach):

``` Free: $0/month → Unlimited tunnels → Cloudflare account required (identity provider setup) → DNS configuration required → Access policies (basic) → Teams/Zero Trust: $4-20/user/month

Total: $0-240/year (solo) + $48-240/user/month (team) Setup time: 1-2 hours (DNS, Cloudflare config, identity provider) ```

SSH Tunnel (self-hosted on VPS):

``` VPS cost: $10-20/month (DigitalOcean, Hetzner) → 1-2GB RAM, 1 CPU → For SSH daemon + nginx reverse proxy

Setup time: 1+ hour → Install and configure sshd → Set up nginx reverse proxy → SSH key management → Auto-restart on reboot (systemd unit) → Monitoring (Uptime Kuma) → SSL certificate (Let's Encrypt)

Ongoing: → VPS cost: $120-240/year → Maintenance: ~2-4 hours/month → Security updates → SSH key rotation → VPS provider issues

Total: $120-240/year + 24-48 hours/year maintenance ```

Aeion Bridge:

``` Included in Aeion OS: $0 Setup time: 15 minutes Ongoing: $0, maintenance handled by Aeion OS

Total: $0/year ```

Annual savings:

vs ngrok Pro: $1,200 - 2,400 vs Cloudflare (team): $600 - 3,000+ vs SSH Tunnel: $120 - 240 + 24-48 hours labor

ngrok and Cloudflare are generic TCP/HTTP tunnels:

``` ngrok forwards: any TCP traffic Cloudflare Tunnel forwards: HTTP/HTTPS

You still need to: 1. Build your own API layer on top of the tunnel 2. Implement authentication (API keys, JWTs) 3. Handle rate limiting 4. Implement scopes and permissions 5. Build tool discovery 6. Handle error responses 7. Log everything for audit

That's weeks of work. ```

Aeion Bridge is MCP-native from the ground up:

``` MCP (Model Context Protocol): → AI agents discover tools automatically → Standardized tool interface → Built-in tool calling semantics → JSON Schema for arguments

Bridge MCP tools (a sample of 50+): → compute.image.generate → compute.tts.generate → bridge.docker.list_containers → bridge.terminal.exec

AI agent sees no difference between: → Cloud tool (crm.contacts.list) → Bridge tool (compute.image.generate)

Both are MCP tools. Both callable the same way. ```

What you'd build with ngrok vs what you get with Bridge:

``` With ngrok ($50-200/month + weeks of dev): 1. ngrok tunnel to localhost:3000 2. Build REST API for image generation 3. Integrate with Stable Diffusion API 4. Build auth middleware (JWT validation) 5. Build scope checking 6. Build audit logging 7. Deploy and maintain

Time: 3-4 weeks Cost: $600-2,400/year in ngrok + dev time

With Aeion Bridge ($0 + 15 minutes): 1. Install Bridge client 2. Install Stable Diffusion model 3. Use compute.image.generate tool

Time: 15 minutes Cost: $0 ```

ngrok security:

``` ✅ TLS encryption on tunnel ✅ IP allowlisting (paid plans) ✅ Basic auth (paid plans) ✅ API key support (you build it)

❌ No scope-based authorization ❌ No per-device permissions ❌ No audit trail for tool calls ❌ Raw TCP exposed (paid plans expose port directly) ❌ Token-based auth is DIY ```

Cloudflare Tunnel security:

``` ✅ Zero Trust model (identity-based) ✅ Access policies (who can access what) ✅ SSO integration (paid plans) ✅ IP allowlisting

❌ Complex policy configuration ❌ Requires Cloudflare identity provider setup ❌ No native MCP tool semantics ❌ Access logs are per-URL, not per-action ```

SSH Tunnel security:

``` ✅ SSH key auth ✅ User-based access control

❌ No encryption on inner traffic (just SSH tunnel) ❌ No scope-based authorization ❌ No audit logging ❌ Root access on VPS risk ❌ SSH keys need rotation management ❌ No tool-level permissions ```

Aeion Bridge security:

``` ✅ Tenant-scoped API keys ✅ Scope-based authorization (per-capability) ✅ Per-device key restrictions ✅ Audit logging for every tool call ✅ WebSocket over TLS (HTTPS) ✅ Token expiration ✅ Revocable at any time

Example — limit Bridge client to specific device: { "type": "bridge_client", "scopes": ["ai:generate", "files:local"], "deviceRestriction": { "hostname": "johns-macbook.local", "macAddress": "AA:BB:CC:DD:EE:FF" } } // This key ONLY works on John's MacBook // Revoked if laptop stolen ```

ngrok multi-device:

``` Problem: Personal plan = 1 tunnel. Pro plan ($100/mo) = 10 tunnels.

Team scenario: → Developer A: tunnel to dev environment → Developer B: tunnel to staging → DevOps: tunnel to prod (monitoring only) → Bridge: tunnel to local GPU server

That's 4 tunnels. Pro plan needed ($100/mo).

Invoice for 10 devs: → ngrok: $100/mo → Cloudflare (if used): $50-200/mo → DevOps time to configure: 2-4 hours ```

Aeion Bridge multi-device:

``` Each developer installs Bridge client. Each Bridge client authenticates with their own API key.

No tunnel limit. No per-tunnel cost. Works automatically.

Admin → Bridge → Devices: John's MacBook Pro — Online Sarah's Windows Desktop — Online GPU Server (Linux) — Online QA Laptop — Offline (not connected) ```

Scoped access per role:

```typescript // Developer key — full access to their own machine { name: "John's Laptop", scopes: ["ai:generate", "terminal:execute", "docker:manage", "git:manage"], deviceRestriction: "Johns-MacBook.local", }

// QA key — no terminal, no git { name: "QA Laptop", scopes: ["ai:generate", "files:local", "media:capture"], deviceRestriction: "QA-Laptop.local", }

// GPU server — image generation only { name: "GPU Server", scopes: ["ai:generate"], deviceRestriction: "gpu-server.internal", } ```

Migration path from ngrok:

``` 1. Keep ngrok running for existing integrations 2. Install Aeion Bridge alongside 3. Migrate services one at a time:

Week 1: Image generation → ngrok: Stable Diffusion API → Bridge: compute.image.generate → Remove ngrok dependency → Test with AeionClaw

Week 2: Terminal access → ngrok: SSH access → Bridge: bridge.terminal.exec → Remove SSH tunnel → Admin UI terminal via Bridge

Week 3: Docker management → ngrok: Port 2375 → Bridge: bridge.docker.* → Remove Docker exposure → Secure Docker via Bridge scope

Week 4: Full cutover → Disable ngrok → Monitor Bridge connections → Cost savings: $100-200/month ```

Hybrid approach (if ngrok is still needed):

``` Some services may still need ngrok: → External webhook receivers (ngrok → localhost:3000) → Third-party integrations requiring fixed URLs

Bridge handles: → All internal tooling → AI generation → DevOps (terminal, Docker, Git) → Hardware access

Use both. Bridge for internal, ngrok for external-only. Or migrate everything to Bridge and use cloud webhooks instead. ```