Server outbound connections
For: cluster operators and plugin authors.
The server
| Host | Why | When | Turn it off |
|---|---|---|---|
version-info.temporal.io | Temporal's version check, which would send the cluster's ID, version, OS, database type and SDKs | Never: off in dev and cluster mode (frontend.enableServerVersionCheck) | Already off |
newsfeed.temporal.io | The Temporal UI's news feed, in your browser | Never: off (DisableNewsFetch) | Already off |
LLM providers: api.anthropic.com, api.openai.com, and the base URL of each provider you add | The gateway calls the model a job asked for, with the tenant's key; oz0 doctor asks for the list of models to check a key | Only when a tenant has a key or a provider and an agent calls a model | No key, or local models only |
| Your OTLP collector | Traces of the server and the nodes | Only with server start --otlp-endpoint (Temporal's own traces only with OTEL_TRACES_EXPORTER in the server's environment) | Leave it unset |
| Your identity providers | Console sign-in | Only with --oidc-config | Leave it unset |
| Your S3-compatible object store | Large payloads | Only when configured | Leave it unset |
Temporal Cloud (<namespace>.tmprl.cloud, login.tmprl.cloud) or your own Temporal | The Temporal backend | Only with --temporal-backend cloud or external | Embedded Temporal, the default |
Git forges (github.com and its API, GitLab, any Git URL) | Plugin installs and updates from Git, private repositories with a token, and Connections such as the GitHub App | When an admin installs a plugin from a forge, or connects one; and when a job proposes an update of a plugin installed from Git, the edge asks the forge for the commit its ref is at (refs only, nothing downloaded) | Install from a local folder or bundle |
registry.npmjs.org, pypi.org | Pinning a plugin's npm: and pypi: tools and harness packages, with every package they depend on, to exact versions and the hashes of their files (pinning and hashes) | When a plugin with such a package is installed or updated, pinned in the manifest or not | OZ0_PLUGIN_PYPI_URL and OZ0_PLUGIN_NPM_URL point the edge at your own mirrors (the npm one also for imported plugins' npx servers and marketplace npm entries); or no such plugins |
| OCI registries | Mirroring a plugin's container image on the edge | When a plugin with an oci: tool is installed | No such plugins |
registry.modelcontextprotocol.io | The MCP Registry: plugin mcp, plugin install mcp:..., the console's MCP Registry page | Only when someone uses them | OZ0_MCP_REGISTRY_URL points at your own registry |
hub.oz0.ai (coming soon) | The plugin hub's signed index | Only for hub: installs and index refresh; builds without our root key never fetch it | index remove oz0; your own index with index add |
| The URLs of routines' safe outputs, flows' webhooks and chat channels | What an agent's routine posts, and replies to Slack and Discord | Only when a tenant sets them up | Do not configure them |
| The tenant's LLM providers, for live evals and model canaries | An eval routine runs a plugin's eval cases against the models its agents use; a model canary sends about 15 one-token calls a day (294 once, to start); a kept case runs three times; all with the tenant's key, billed to the tenant | Only after a tenant admin saves an eval routine or turns a canary on, or someone keeps a job as an eval case | Do not save eval routines; oz0 model canary off |
The address in oz0 server dist pull | Mirroring a release onto the edge | Only when an operator runs it | Copy the folder by hand |
slack.com (/api/oauth.v2.access with a made-up code, /api/auth.test), discord.com (/api/v10/users/@me, /api/v10/applications/@me, /api/oauth2/token with a client credentials grant), and the addresses other plugins' connection checks name | The edge checks a client secret or bot token an admin pasted or a connection saved, for an app of the tenant's own (guided steps) | Only while an admin runs a connection's steps, from the edge | Set the secrets by hand (oz0 secret set) instead of connecting |
The token endpoints of providers signed with OAuth2 (auth.token_url), such as oauth2.googleapis.com for Vertex AI and login.microsoftonline.com for Entra | The edge trades a tenant's client secret or service account key for a bearer token; one request per tenant and provider when a token is about to end, never with a redirect followed | Only for a provider record whose auth.kind is oauth2_client_credentials or oauth2_jwt_bearer, when an agent calls it | Use a header key, or delete the record |
Your SMTP relay (--smtp-addr) and the webhook targets a tenant admin names in a notification rule | Notifications of approvals that wait, escalate or expire, questions, budget requests and failed jobs: email over STARTTLS or TLS with the relay's certificate verified, and signed JSON POSTs | An SMTP relay only when configured; a webhook only when a tenant admin adds one (private addresses only in networks --notify-allow-net allows); both from the edge | Leave --smtp-addr unset, and delete the tenant's webhook rules (oz0 notify rule delete) |
login.botframework.com (the Bot Connector's OpenID metadata and keys), login.microsoftonline.com (/<tenant>/oauth2/v2.0/token, a client credentials grant for the bot), and the key hosts of any other plugin's jwt event source | Details | Details | Details |
The URL given to oz0 plugin import openapi | Reading an OpenAPI document to write a plugin from it (OpenAPI import): one GET from the operator's machine, HTTPS only, TLS verified, no credentials, at most 16 MiB and 30 seconds, redirects only to HTTPS | Only when someone runs the command with an https:// URL | Download the document yourself and give the file |
| Your identity providers' discovery documents and keys, from the edge | The token exchange for apps checks a person's token against the keys of the provider the app names (the issuer a cluster admin configured, never an app's own URL): discovery once, the keys once and again for a key the edge does not hold at most once a minute per provider; exchanges are limited per address and per app | Only after a tenant's owner registers an app, when its backend exchanges a token; from the edge (management already reaches the providers for sign-in) | Register no app, or oz0 app delete |
| The base URL or token endpoint of each provider record that reads a secret being set | Testing a provider's key before it is stored: one GET /v1/models with the candidate key, or one token request with the candidate client secret or service account key, never cached and never with a redirect followed, under the record's own address rules | Only when a tenant admin sets a secret a provider record reads, with the test (the default for such secrets); from the edge | oz0 secret set --no-test --reason ..., or untick the test on Credentials' Secrets tab |
The secret stores an operator lists in an edge's --secret-stores file (OpenBao, Vault, a cloud's secret manager, or any program that speaks the protocol) | The edge starts each store's process, which reads the tenants' secret references from its store: when a reference is first used, then once every cache_ttl for the hot swap, a health check a minute, and for oz0 secret export-to-sealed. The process dials what its own configuration names; the edge itself dials nothing | Only on an edge started with --secret-stores, for the references tenants set | Leave --secret-stores unset; oz0 secret export-to-sealed first moves the references back to sealed secrets |
| Whatever your key commands reach: an HSM, a cloud KMS or a secrets engine | The server runs the command you gave to unwrap the master key and the secrets key, and asks it whether it still reaches its wrapping key; the server itself opens no connection for it | Only with --master-key-command or --secrets-key-command: at each start, every 10 minutes, and when an operator runs the wrap and unwrap-to-file commands | Leave the flags unset; oz0 server master-key unwrap-to-file moves a key back to a plain file |
pypi.org, registry.npmjs.org, OCI registries, plugin indexes and release addresses, on an edge that serves an offline folder (server start --offline-dir) | Details | Details | Details |
The advisory feed you name with OZ0_ADVISORY_FEED (or server start --advisory-feed-file), such as OSV's storage.googleapis.com/osv-vulnerabilities/PyPI/all.zip | Details | Details | Details |
| The tenant's LLM providers, for comparisons | A comparison runs an agent's cases on two arms, several times each, as shadow runs, with the tenant's key, billed to the tenant and within the comparison's budget | Only when a tenant's operator or admin starts one (oz0 compare-savings start, or the Measured savings page) | Do not start comparisons |
The API of a Git plugin's forge (api.github.com, or /api/v3, /api/v4 or /api/v1 on the forge's own host) | Details | Details | Details |
The token endpoints of on_behalf_of connections (a literal https:// URL in the plugin's manifest) | Details | Details | Details |
The clouds' token services: sts.<region>.amazonaws.com (AWS STS), sts.googleapis.com and iamcredentials.googleapis.com, login.microsoftonline.com (Entra), or the endpoints an operator names with --cloud-endpoint | Cloud federation: the edge exchanges the calling agent's workload token (the agent, never a person) for a credential that lives an hour, kept in memory for the job's next calls; the endpoints are fixed, never a manifest's or a tenant's, and no redirect is followed | Only for a model provider of auth.kind: federated when an agent calls it, or a plugin's connection of kind federated when one of its tools is called; from the edge | Use providers and connections with keys, delete the federated records, or uninstall the plugin |
The folder or S3 bucket given to oz0 tenant oidc publish | Discovery for a private cluster: the tenant's discovery document and public key set, read from an edge and written where the clouds can fetch them | Only when an operator runs the command, from the machine it runs on | Do not run it (oz0 tenant oidc jwks only prints the key set) |
| The hosts of MCP clients' client metadata documents that a tenant lists | Details | Details | Details |
| The tenant's LLM providers, for judge jobs | A judge looks at a sampled finished job, or at a judge's anchors, with the tenant's key, through the gateway and its data rules, billed to the tenant | Only for agents whose definition declares quality.sample or anchors_file, or that a tenant rule samples; anchors only when an eval routine or sampling runs | Rate 0 in a tenant rule (oz0 tenant quality --sample AGENT=0), or no quality.sample and no anchors |
The token endpoints of connections whose tokens the edge refreshes (a literal https:// URL in the plugin's manifest, or the host a connection was connected for) | Details | Details | Details |
graph.microsoft.com (POST /v1.0/users/<sender>/sendMail) from a node, login.microsoftonline.com (/<tenant>/oauth2/v2.0/token, a client credentials grant for the tenant's own Entra app) from the edge, and the SMTP relay (--smtp-addr) for agents' mail | The mail agents send with ai.oz0/email: through the relay the edge sends it; through Microsoft Graph the edge mints the app's token for each message it allowed and the plugin's server posts the message, its only egress | Only in a tenant with ai.oz0/email installed, its mail domains named and a send approved; Graph only when the tenant set EMAIL_TRANSPORT to graph and connected email-graph | Uninstall the plugin, or oz0 plugin revoke-reads email mail; oz0 connection delete email-graph stops the tokens |
login.botframework.com (the Bot Connector's OpenID metadata and keys), login.microsoftonline.com (/<tenant>/oauth2/v2.0/token, a client details
Why
The edge checks each Teams delivery's token against the published keys (fetched over HTTPS, kept for their lifetime up to a day, again for an unknown key at most once a minute), and gets the bot's token for each post with the connection's client secret (ai.oz0/teams)
When
Only in a tenant with ai.oz0/teams (or a plugin with a jwt source) installed: keys when a delivery comes, the token while connecting and when a post is made; from the edge
Turn it off
Uninstall the plugin; oz0 connection delete teams stops the tokens
pypi.org, registry.npmjs.org, OCI registries, plugin indexes and release addresses, on an edge details
Why
None: the edge pins pypi: and npm: packages against the folder's files in its own process, takes plugin bundles, OCI plugins and tools' images only from the folder by digest, and fetches no plugin index by URL (an index imported with index add --file is never fetched); server dist pull --from <folder> takes a release and its toolchain from it; an offline node (oz0-node run --offline) takes every plugin package, Python and npm, from the edge's mirrors of the folder
When
Never while the edge serves a folder
Turn it off
Already off. Git sources, and the hosts in other rows a folder does not hold (LLM providers, notifications, a harness's binaries), still need their own answer
The advisory feed you name with OZ0_ADVISORY_FEED (or server start --advisory-feed-file), such as OSV's storage.googleapis.com/osv-vulnerabilities/PyPI/all.zip
Why
Advisories for the vulnerability scan of installed plugins' packages: one GET of the whole document (OSV entries, OSV's zip or the hub's format), never a query naming your packages; HTTPS with TLS verified (plain HTTP only to loopback), no redirect followed, at most 256 MB
When
Only when an operator sets the feed (off by default): when an edge takes over the scanner's lease (at its start) and every --advisory-feed-every (a day), within the hour after a failed fetch; from the edge
Turn it off
Leave it unset (its advisories are dropped at the next scan); import a file instead, or rely on the index's
The API of a Git plugin's forge (api.github.com, or /api/v3, /api/v4 or /api/v1 on the forge's own host)
Why
Recording the repository's ID and owner at a Git install, and checking them at each update, so that a repository transferred or created again under the same URL is noticed (updates from new hands); with a private repository's token, sent to that host only
When
When an admin installs or updates a plugin from a Git URL on github.com, gitlab.com, codeberg.org, or a host named with --forge; never for an install from a plugin index (its custody is the index's), plugin inspect, or an offline edge unless --forge names the forge
Turn it off
--forge none at install, which later updates remember, or a source that is not a Git URL
The token endpoints of on_behalf_of connections (a literal https:// URL in the plugin's manifest)
Why
The edge exchanges a delegated identity token, which names the person a job runs for, for the service's own token (RFC 8693): one request per covered tool call, from the edge, never with a redirect followed, at public addresses only (any address in dev mode, or a network --connect-allow-net lists)
When
Only in a tenant with a plugin that declares such a connection, when one of its tools is called, and only after a tenant admin allowed delegated tokens off the cluster (oz0 tenant oidc delegated-off-cluster, off by default)
Turn it off
Leave delegated tokens inside the cluster, or uninstall the plugin. The issuer's own discovery document and keys are served, never sent: outside services fetch them from the edge
The hosts of MCP clients' client metadata documents that a tenant lists
Why
When an MCP client identifies itself by the https URL of its metadata document, the edge fetches that document to learn the client's name and redirect addresses: only for a host or URL on the tenant's mcp_clients allowlist, over https with TLS verified, only from public addresses (checked after the name resolves), no redirects followed, at most 5 KiB within 5 seconds, kept a few minutes
When
Only after a tenant admin allows a client host or document URL (oz0 mcp clients policy --allow), when a person connects such a client; from the edge
Turn it off
List no hosts or documents (the default): registered loopback clients need no fetch
The token endpoints of connections whose tokens the edge refreshes (a literal details
Why
The edge renews a connection's token with its refresh token before it expires (RFC 6749 section 6): one request when calls find less than ten minutes left (or less than half the token's lifetime, when that is shorter), from one of them on one edge however many find it at once, to the origin the refresh token was issued at only, never with a redirect followed, at public addresses only (any address in dev mode, or a network --connect-allow-net lists)
When
Only in a tenant with a plugin whose connection declares token.refresh, once it is connected, when one of its tools is called
Turn it off
oz0 connection delete <name>, or uninstall the plugin
The edge's plugin-source fetches use public HTTPS addresses. Private networks are reachable only where oz0 server start --plugin-source-allow-net lists them. This applies to the sources above: Git forges and APIs, package indexes, OCI registries and token services, the MCP Registry, plugin indexes and listed bundles.
The same rules cover addresses named in plugin content, including marketplace entries, tool images and remote-tool sign-in checks. The edge never reaches its own interface addresses, even inside an allowed network, its link or cloud metadata services. See where the edge fetches from. Dev mode can reach every address.