Connections go out from the Host
Linux Host connects outward to Miko’s gateway. Its ordinary client connection does not require an inbound firewall rule, router port forwarding or a public listener on your server. Allow outbound HTTPS and secure WebSockets over TCP 443.
Miko addresses
| Destination | Purpose | Transport |
|---|---|---|
| www.getmiko.app | Product site, documentation and contact | HTTPS / TCP 443 |
| app.getmiko.app | Web app | HTTPS / TCP 443 |
| api.getmiko.app | Account and machine control API | HTTPS / TCP 443 |
| gw.getmiko.app | Machine pairing and relayed client connection, always direct | WSS / TCP 443 |
| get.getmiko.app | Production Linux installer | HTTPS / TCP 443 |
| dl.getmiko.app | Production releases and update downloads | HTTPS / TCP 443 |
| registry.npmjs.org | Provider package installation and updates | HTTPS / TCP 443 |
Use the addresses shown by your installation. Development environments use different hosts. Allow DNS resolution and keep the system clock correct; signed releases are checked against time. Avoid fixed IP allowlists for these hostnames.
Agent traffic is separate
Each agent program, such as Claude Code, Codex, Grok Build, OpenCode or Antigravity, sends requests to its AI provider. Projects may also need their Git host, package registries, MCP servers or deployment services. Miko’s address list is not a complete allowlist for every command an agent can run.
| API-key provider | Configured API host |
|---|---|
| Anthropic | api.anthropic.com |
| OpenAI | api.openai.com |
| Google Gemini | generativelanguage.googleapis.com |
| DeepSeek | api.deepseek.com |
| Mistral | api.mistral.ai |
| xAI | api.x.ai |
| Groq | api.groq.com |
| Moonshot | api.moonshot.ai |
| Z.ai | api.z.ai |
| OpenRouter | openrouter.ai |
These are the routes for the API keys in the table above. Other API key accounts, custom endpoints, provider browser sign-in, model downloads and tools can use additional domains. Check the provider’s sign-in screen and your network logs when allowing that flow.
Proxy and diagnosis
The Linux installer accepts --proxy with an HTTP or HTTPS proxy URL. It applies to the Host’s own HTTPS requests and its updates, not to pairing or the gateway connection, and leaves your own shell environment unchanged. Proxy URLs containing a user name or password are refused.
Agents use the server’s own proxy settings in /etc/environment; do not assume the --proxy option routes every command an agent runs.
sudo miko-host doctor --json
sudo miko-host logsDoctor checks the configured gateway, release server and npm registry. When the Host was installed with --proxy, those checks go through the proxy, so a passing gateway check does not prove that the direct gateway connection works. Doctor does not test every provider or prove that an end-to-end session is established.