Skip to main content
This page lists everything a corporate firewall, secure web gateway (SWG), or SASE must permit so that managed devices can reach Runlayer. It is the answer to the common enterprise-review question: “Which endpoints do we need to allowlist, and does Runlayer collide with our existing proxy/VPN?” For self-hosted deployments whose VPC/tasks sit behind egress filters (WorkOS, AuthKit, catalog, ToolGuard bootstrap, Bedrock, and related hosts), see Self-Hosted Egress Requirements. Runlayer is not a transparent network proxy. AI clients, the CLI, the AI Watch agent, and the browser extension each connect outbound over HTTPS (TCP 443) to a small set of known hostnames. There are no inbound connections to end-user devices and no re-routing of unrelated traffic. See Connecting AI Clients for how clients point at a Runlayer proxy endpoint.

​
Outbound allowlist

​
Managed devices to Runlayer

Allow HTTPS / TCP 443 from managed devices (and any egress proxy) to the following hostnames.
A Runlayer-hosted tenant hostname points to an AWS load balancer whose destination IPs can change. For traffic from managed devices to Runlayer, allowlist the tenant hostname, not its current IPs. If your firewall supports only IP rules, contact support@runlayer.com. This is separate from the outbound source addresses Runlayer uses to reach upstream services, described below. For a self-hosted deployment, the platform hostname is your own domain, which resolves to infrastructure you control.

​
Soft UI / optional browser hosts

These are fetched by the webapp in the browser. Blocking them does not break core MCP proxying or login, but degrades UX.

​
Conditional browser egress

​
What clients do not need to reach directly

  • Upstream SaaS / MCP servers and LLM providers during normal tool use. For hosted connectors, Runlayer reaches upstream APIs from the platform / gateway side using the outbound source addresses described below. The browser still needs the conditional OAuth access described above during authentication. Local MCPs are another exception: they run through the CLI on the user’s machine and connect to whatever that local server needs.
  • Provider compliance APIs. Web-chat compliance imports are polled by the Runlayer platform, not by the device.

​
Runlayer source IP addresses (hosted platform egress)

Hosted connector requests to upstream SaaS, MCP, LLM, and compliance APIs use static public IPv4 addresses or tenant IPv6 ranges. You can restrict upstream API keys and firewall rules to these source addresses. The addresses are tenant-specific rather than a shared global range. An admin can copy the complete current list from Settings → Network Access. For self-hosted deployments, outbound source addresses are determined by your infrastructure (typically NAT Gateway EIPs). The destination hosts those tasks must reach are listed in Self-Hosted Egress Requirements. Local MCP traffic originates from the device or environment running the local server, not from the Runlayer-hosted tenant. Traffic an agent sends from its own sandbox (shell commands, web fetch, the built-in browser) leaves through the agent runtime instead. Whether it uses these addresses depends on how that runtime is networked, so contact Runlayer before restricting a key that an agent calls directly from its sandbox.

​
TLS inspection (SWG / SASE)

If your SWG/SASE terminates and re-signs TLS, the CLI and AI Watch agent must trust the corporate root CA used by the inspection appliance:
  • This is honored automatically through the OS trust store (macOS Keychain, Windows certificate stores, Linux CA bundle) when the root is installed system-wide.
  • If it is not system-wide, use the --ca-bundle flag or the RUNLAYER_CA_BUNDLE / SSL_CERT_FILE / REQUESTS_CA_BUNDLE environment overrides. See AI Watch Troubleshooting and the TLS-inspected-network note in MCP Troubleshooting.
  • For self-hosted backends whose own outbound HTTPS uses a private CA:
    • ECS: Configure trusted_ca_pem with one or more additional private CA certificates. The module combines them with the image’s public roots automatically.
    • Kubernetes: Configure spec.trustedCa with a ConfigMap containing a complete PEM bundle. The operator mounts this value verbatim as the trust store, so the bundle must include standard public roots and any private CA certificates.

​
Coexistence with VPN / SASE

Runlayer runs alongside Zscaler, Netskope, Cloudflare WARP, Palo Alto Prisma, and similar tools without competing for the network path — it operates at the application layer, installs no OS-level proxy or VPN, and does not change system proxy settings or split-tunnel rules. See the detailed answer in the AI Watch FAQ.

​
Self-hosted deployments

Two different directions: With WAF IP allowlisting enabled, AgentCore must use VPC + PrivateLink (not PUBLIC) so the assistant can call your app without needing AgentCore’s public IPs on the WAF allowlist — covered on the egress page and in the Terraform guide.

​
Troubleshooting egress