TunnelCrib is closer to Boundary than to Teleport: both provide controlled, protocol-agnostic network access to private Services through a control plane and Relay or worker data plane. The difference is mainly maturity and architecture.
| Area | TunnelCrib | HashiCorp Boundary |
|---|---|---|
| Primary purpose | Direct or relayed TCP access to a Service on a Device | Identity-aware secure remote access broker |
| Data path | Direct TunnelCrib Client and Agent path first; TunnelCrib Relay or Private Relay fallback | Worker-proxied sessions, including ingress/egress and multi-hop workers |
| Control plane | Python WebSocket server with in-memory registry | HA stateless controllers backed by PostgreSQL |
| Device and Service registration | TunnelCrib Agent advertises approved Services | Managed targets, host catalogs, target configuration, and worker tags |
| Identity | Organization/device registration and ECDSA P-256 proof | Users, groups, OIDC and other auth methods, roles, and grants |
| Authorization | Organization boundary plus per-Client Agent-access policy (allow/deny, per Service) | Fine-grained RBAC policies over scopes, targets, sessions, and workers |
| Credentials | User's normal protocol credentials remain separate | Can broker/inject credentials, often integrated with Vault |
| Reliability | Single server registry; Private Relay fallback | HA controllers, persistent database, worker health, and routing |
| Recording/audit | Durable activity log of connects and Tunnels; no session recording yet | Durable audit events and optional SSH session recording |
| Connectivity advantage | Can avoid Relays entirely with encrypted P2P | Predictable, managed routing across complex networks |
Key distinction: TunnelCrib creates a local Tunnel that standard networking tools use to reach a selected Service, whether that's an SSH client, RDP client, or HTTP client. Boundary is an access-management product: it decides who may access which target, selects a worker route, can manage credentials, and records the authorized session.
TunnelCrib's Private Relay is conceptually nearest to a Boundary worker, but it is fallback transport only. A Boundary worker is the normal data-plane component and supports deliberate placement, tags, multi-hop routing, health management, and scalable scheduling.
To move TunnelCrib toward Boundary, prioritize persistent organization, Device, Service, and Tunnel state; user/role RBAC; OIDC; Device inventory; session recording; Relay health/capacity scheduling; and eventually Vault-backed credential brokering.
Competitor capabilities change over time. This comparison was last reviewed on 2026-09-09. Corrections are welcome — [email protected].