Network and firewall

Connections go out from the Host

Linux Host connects outward to Miko’s gateway. Its ordinary client connection does not require an inbound firewall rule, router port forwarding or a public listener on your server. Allow outbound HTTPS and secure WebSockets over TCP 443.

Allow the gateway directly

Pairing and the Host’s connection to gw.getmiko.app do not use the installer’s –proxy setting. The server needs direct outbound HTTPS and WSS to the gateway on TCP 443, also when you install with –proxy; a network that only allows traffic through a proxy cannot pair the server. A successful website request alone does not establish that the agent connection can stay open.

Miko addresses

Destination	Purpose	Transport
www.getmiko.app	Product site and contact	HTTPS / TCP 443
docs.getmiko.app	Documentation	HTTPS / TCP 443
app.getmiko.app	Web app	HTTPS / TCP 443
api.getmiko.app	Account and machine control API	HTTPS / TCP 443
gw.getmiko.app	Machine pairing and relayed client connection, always direct	WSS / TCP 443
get.getmiko.app	Production Linux installer	HTTPS / TCP 443
dl.getmiko.app	Production releases and update downloads	HTTPS / TCP 443
registry.npmjs.org	Provider package installation and updates	HTTPS / TCP 443

Use the addresses shown by your installation. Development environments use different hosts. Allow DNS resolution and keep the system clock correct; signed releases are checked against time. Avoid fixed IP allowlists for these hostnames.

Agent traffic is separate

Each agent program sends requests to its own AI provider. Projects may also need their Git host, package registries, MCP servers or deployment services. Miko’s address list is not a complete allowlist for every command an agent can run.

API-key provider	Configured API host
Anthropic	api.anthropic.com
OpenAI	api.openai.com
Google Gemini	generativelanguage.googleapis.com
DeepSeek	api.deepseek.com
Mistral	api.mistral.ai
xAI	api.x.ai
Groq	api.groq.com
Moonshot	api.moonshot.ai
Z.ai	api.z.ai
OpenRouter	openrouter.ai

These are the hosts for the ten API-key providers listed first. Other providers in the register, and a custom endpoint, use their own hosts. Provider browser sign-in, model downloads and tools can use additional domains. Check the provider’s sign-in screen and your network logs when allowing that flow.

Proxy and diagnosis

The Linux installer accepts –proxy with an HTTP or HTTPS proxy URL. It applies to the Host’s own HTTPS requests and its updates, not to pairing or the gateway connection, and leaves your own shell environment unchanged. Proxy URLs containing a user name or password are refused.

Agents use the server’s own proxy settings in /etc/environment; do not assume the –proxy option routes every command an agent runs.

Inspect the Host’s checks and recent logs

sudo miko-host doctor --json
sudo miko-host logs

Doctor checks the configured gateway, release server and npm registry. When the Host was installed with –proxy, those checks go through the proxy, so a passing gateway check does not prove that the direct gateway connection works. Doctor does not test every provider or prove that an end-to-end session is established.