---
title: "Server outbound connections"
description: "Server outbound connections for cluster operators and plugin authors."
canonical_url: "https://docs.oz0.ai/concepts/outbound-connections/server"
---
# Server outbound connections

> Server outbound connections for cluster operators and plugin authors.

For: cluster operators and plugin authors.

## The server

<table>
<thead>
  <tr>
    <th>
      Host
    </th>
    
    <th>
      Why
    </th>
    
    <th>
      When
    </th>
    
    <th>
      Turn it off
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        version-info.temporal.io
      </code>
    </td>
    
    <td>
      Temporal's version check, which would send the cluster's ID, version, OS, database type and SDKs
    </td>
    
    <td>
      <strong>
        Never
      </strong>
      
      : off in dev and cluster mode (<code>
        frontend.enableServerVersionCheck
      </code>
      
      )
    </td>
    
    <td>
      Already off
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        newsfeed.temporal.io
      </code>
    </td>
    
    <td>
      The Temporal UI's news feed, in your browser
    </td>
    
    <td>
      <strong>
        Never
      </strong>
      
      : off (<code>
        DisableNewsFetch
      </code>
      
      )
    </td>
    
    <td>
      Already off
    </td>
  </tr>
  
  <tr>
    <td>
      LLM providers: <code>
        api.anthropic.com
      </code>
      
      , <code>
        api.openai.com
      </code>
      
      , and the base URL of each provider you add
    </td>
    
    <td>
      The gateway calls the model a job asked for, with the tenant's key; <code>
        oz0 doctor
      </code>
      
       asks for the list of models to check a key
    </td>
    
    <td>
      Only when a tenant has a key or a provider and an agent calls a model
    </td>
    
    <td>
      No key, or <a href="https://docs.oz0.ai/fleet/local-models">
        local models
      </a>
      
       only
    </td>
  </tr>
  
  <tr>
    <td>
      Your OTLP collector
    </td>
    
    <td>
      Traces of the server and the nodes
    </td>
    
    <td>
      Only with <code>
        server start --otlp-endpoint
      </code>
      
       (Temporal's own traces only with <code>
        OTEL_TRACES_EXPORTER
      </code>
      
       in the server's environment)
    </td>
    
    <td>
      Leave it unset
    </td>
  </tr>
  
  <tr>
    <td>
      Your identity providers
    </td>
    
    <td>
      Console sign-in
    </td>
    
    <td>
      Only with <code>
        --oidc-config
      </code>
    </td>
    
    <td>
      Leave it unset
    </td>
  </tr>
  
  <tr>
    <td>
      Your S3-compatible object store
    </td>
    
    <td>
      Large payloads
    </td>
    
    <td>
      Only when configured
    </td>
    
    <td>
      Leave it unset
    </td>
  </tr>
  
  <tr>
    <td>
      Temporal Cloud (<code>
        &lt;namespace>.tmprl.cloud
      </code>
      
      , <code>
        login.tmprl.cloud
      </code>
      
      ) or your own Temporal
    </td>
    
    <td>
      The Temporal backend
    </td>
    
    <td>
      Only with <code>
        --temporal-backend cloud
      </code>
      
       or <code>
        external
      </code>
    </td>
    
    <td>
      Embedded Temporal, the default
    </td>
  </tr>
  
  <tr>
    <td>
      Git forges (<code>
        github.com
      </code>
      
       and its API, GitLab, any Git URL)
    </td>
    
    <td>
      Plugin installs and updates from Git, private repositories with a token, and <a href="https://docs.oz0.ai/admin/connections">
        Connections
      </a>
      
       such as the GitHub App
    </td>
    
    <td>
      When an admin installs a plugin from a forge, or connects one; and when a job <a href="https://docs.oz0.ai/govern/reviewed-changes/proposals#change-requests-a-job-files">
        proposes an update
      </a>
      
       of a plugin installed from Git, the edge asks the forge for the commit its ref is at (refs only, nothing downloaded)
    </td>
    
    <td>
      Install from a local folder or bundle
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        registry.npmjs.org
      </code>
      
      , <code>
        pypi.org
      </code>
    </td>
    
    <td>
      Pinning a plugin's <code>
        npm:
      </code>
      
       and <code>
        pypi:
      </code>
      
       tools and harness packages, with every package they depend on, to exact versions and the hashes of their files (<a href="https://docs.oz0.ai/build/plugins/packages#pinning-and-hashes">
        pinning and hashes
      </a>
      
      )
    </td>
    
    <td>
      When a plugin with such a package is installed or updated, pinned in the manifest or not
    </td>
    
    <td>
      <code>
        OZ0_PLUGIN_PYPI_URL
      </code>
      
       and <code>
        OZ0_PLUGIN_NPM_URL
      </code>
      
       point the edge at your own mirrors (the npm one also for imported plugins' <code>
        npx
      </code>
      
       servers and marketplace npm entries); or no such plugins
    </td>
  </tr>
  
  <tr>
    <td>
      OCI registries
    </td>
    
    <td>
      Mirroring a plugin's container image on the edge
    </td>
    
    <td>
      When a plugin with an <code>
        oci:
      </code>
      
       tool is installed
    </td>
    
    <td>
      No such plugins
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        registry.modelcontextprotocol.io
      </code>
    </td>
    
    <td>
      The MCP Registry: <code>
        plugin mcp
      </code>
      
      , <code>
        plugin install mcp:...
      </code>
      
      , the console's MCP Registry page
    </td>
    
    <td>
      Only when someone uses them
    </td>
    
    <td>
      <code>
        OZ0_MCP_REGISTRY_URL
      </code>
      
       points at your own registry
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        hub.oz0.ai
      </code>
      
       (coming soon)
    </td>
    
    <td>
      The plugin hub's signed index
    </td>
    
    <td>
      Only for <code>
        hub:
      </code>
      
       installs and <code>
        index refresh
      </code>
      
      ; builds without our root key never fetch it
    </td>
    
    <td>
      <code>
        index remove oz0
      </code>
      
      ; your own index with <code>
        index add
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      The URLs of routines' safe outputs, flows' webhooks and chat channels
    </td>
    
    <td>
      What an agent's routine posts, and replies to Slack and Discord
    </td>
    
    <td>
      Only when a tenant sets them up
    </td>
    
    <td>
      Do not configure them
    </td>
  </tr>
  
  <tr>
    <td>
      The tenant's LLM providers, for live evals and model canaries
    </td>
    
    <td>
      An <a href="https://docs.oz0.ai/improve/evals/regressions#scheduled-evals">
        eval routine
      </a>
      
       runs a plugin's eval cases against the models its agents use; a <a href="https://docs.oz0.ai/spend/models-and-keys/canaries-and-retirement#model-canaries">
        model canary
      </a>
      
       sends about 15 one-token calls a day (294 once, to start); a kept case runs three times; all with the tenant's key, billed to the tenant
    </td>
    
    <td>
      Only after a tenant admin saves an eval routine or turns a canary on, or someone keeps a job as an eval case
    </td>
    
    <td>
      Do not save eval routines; <code>
        oz0 model canary off
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      The address in <code>
        oz0 server dist pull
      </code>
    </td>
    
    <td>
      Mirroring a release onto the edge
    </td>
    
    <td>
      Only when an operator runs it
    </td>
    
    <td>
      Copy the folder by hand
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        slack.com
      </code>
      
       (<code>
        /api/oauth.v2.access
      </code>
      
       with a made-up code, <code>
        /api/auth.test
      </code>
      
      ), <code>
        discord.com
      </code>
      
       (<code>
        /api/v10/users/@me
      </code>
      
      , <code>
        /api/v10/applications/@me
      </code>
      
      , <code>
        /api/oauth2/token
      </code>
      
       with a client credentials grant), and the addresses other plugins' connection checks name
    </td>
    
    <td>
      The edge checks a client secret or bot token an admin pasted or a connection saved, for an app of the tenant's own (<a href="https://docs.oz0.ai/admin/connections#your-own-app-about-two-minutes">
        guided steps
      </a>
      
      )
    </td>
    
    <td>
      Only while an admin runs a connection's steps, from the edge
    </td>
    
    <td>
      Set the secrets by hand (<code>
        oz0 secret set
      </code>
      
      ) instead of connecting
    </td>
  </tr>
  
  <tr>
    <td>
      The token endpoints of providers signed with OAuth2 (<code>
        auth.token_url
      </code>
      
      ), such as <code>
        oauth2.googleapis.com
      </code>
      
       for Vertex AI and <code>
        login.microsoftonline.com
      </code>
      
       for Entra
    </td>
    
    <td>
      The edge trades a tenant's client secret or service account key for a bearer token; one request per tenant and provider when a token is about to end, never with a redirect followed
    </td>
    
    <td>
      Only for a provider record whose <code>
        auth.kind
      </code>
      
       is <code>
        oauth2_client_credentials
      </code>
      
       or <code>
        oauth2_jwt_bearer
      </code>
      
      , when an agent calls it
    </td>
    
    <td>
      Use a header key, or delete the record
    </td>
  </tr>
  
  <tr>
    <td>
      Your SMTP relay (<code>
        --smtp-addr
      </code>
      
      ) and the webhook targets a tenant admin names in a <a href="https://docs.oz0.ai/admin/notifications">
        notification rule
      </a>
    </td>
    
    <td>
      Notifications of approvals that wait, escalate or expire, questions, budget requests and failed jobs: email over STARTTLS or TLS with the relay's certificate verified, and signed JSON POSTs
    </td>
    
    <td>
      An SMTP relay only when configured; a webhook only when a tenant admin adds one (private addresses only in networks <code>
        --notify-allow-net
      </code>
      
       allows); both from the edge
    </td>
    
    <td>
      Leave <code>
        --smtp-addr
      </code>
      
       unset, and delete the tenant's webhook rules (<code>
        oz0 notify rule delete
      </code>
      
      )
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        login.botframework.com
      </code>
      
       (the Bot Connector's OpenID metadata and keys), <code>
        login.microsoftonline.com
      </code>
      
       (<code>
        /&lt;tenant>/oauth2/v2.0/token
      </code>
      
      , a client credentials grant for the bot), and the key hosts of any other plugin's <code>
        jwt
      </code>
      
       event source
    </td>
    
    <td>
      <a href="#loginbotframeworkcom-the-bot-connectors-openid-metadata-and-keys-loginmicrosoftonlinecom-tenantoauth2v20token-a-client-details">
        Details
      </a>
    </td>
    
    <td>
      <a href="#loginbotframeworkcom-the-bot-connectors-openid-metadata-and-keys-loginmicrosoftonlinecom-tenantoauth2v20token-a-client-details">
        Details
      </a>
    </td>
    
    <td>
      <a href="#loginbotframeworkcom-the-bot-connectors-openid-metadata-and-keys-loginmicrosoftonlinecom-tenantoauth2v20token-a-client-details">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      The URL given to <code>
        oz0 plugin import openapi
      </code>
    </td>
    
    <td>
      Reading an OpenAPI document to write a plugin from it (<a href="https://docs.oz0.ai/build/parts/openapi-import">
        OpenAPI import
      </a>
      
      ): one GET from the operator's machine, HTTPS only, TLS verified, no credentials, at most 16 MiB and 30 seconds, redirects only to HTTPS
    </td>
    
    <td>
      Only when someone runs the command with an <code>
        https://
      </code>
      
       URL
    </td>
    
    <td>
      Download the document yourself and give the file
    </td>
  </tr>
  
  <tr>
    <td>
      Your identity providers' discovery documents and keys, from the edge
    </td>
    
    <td>
      The <a href="https://docs.oz0.ai/build/apps/runtime-api/authentication#apps-that-act-as-their-people">
        token exchange for apps
      </a>
      
       checks a person's token against the keys of the provider the app names (the issuer a cluster admin configured, never an app's own URL): discovery once, the keys once and again for a key the edge does not hold at most once a minute per provider; exchanges are limited per address and per app
    </td>
    
    <td>
      Only after a tenant's owner registers an app, when its backend exchanges a token; from the edge (management already reaches the providers for sign-in)
    </td>
    
    <td>
      Register no app, or <code>
        oz0 app delete
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      The base URL or token endpoint of each provider record that reads a secret being set
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/admin/secrets/rotation#a-providers-key-is-tested-before-it-is-stored">
        Testing a provider's key before it is stored
      </a>
      
      : one <code>
        GET /v1/models
      </code>
      
       with the candidate key, or one token request with the candidate client secret or service account key, never cached and never with a redirect followed, under the record's own address rules
    </td>
    
    <td>
      Only when a tenant admin sets a secret a provider record reads, with the test (the default for such secrets); from the edge
    </td>
    
    <td>
      <code>
        oz0 secret set --no-test --reason ...
      </code>
      
      , or untick the test on Credentials' Secrets tab
    </td>
  </tr>
  
  <tr>
    <td>
      The secret stores an operator lists in an edge's <code>
        --secret-stores
      </code>
      
       file (OpenBao, Vault, a cloud's secret manager, or any program that speaks the protocol)
    </td>
    
    <td>
      The edge starts each store's process, which reads the tenants' <a href="https://docs.oz0.ai/admin/secrets/external-stores#secrets-in-your-own-store">
        secret references
      </a>
      
       from its store: when a reference is first used, then once every <code>
        cache_ttl
      </code>
      
       for the hot swap, a <code>
        health
      </code>
      
       check a minute, and for <code>
        oz0 secret export-to-sealed
      </code>
      
      . The process dials what its own configuration names; the edge itself dials nothing
    </td>
    
    <td>
      Only on an edge started with <code>
        --secret-stores
      </code>
      
      , for the references tenants set
    </td>
    
    <td>
      Leave <code>
        --secret-stores
      </code>
      
       unset; <code>
        oz0 secret export-to-sealed
      </code>
      
       first moves the references back to sealed secrets
    </td>
  </tr>
  
  <tr>
    <td>
      Whatever your <a href="https://docs.oz0.ai/admin/key-commands">
        key commands
      </a>
      
       reach: an HSM, a cloud KMS or a secrets engine
    </td>
    
    <td>
      The server runs the command you gave to unwrap the master key and the secrets key, and asks it whether it still reaches its wrapping key; the server itself opens no connection for it
    </td>
    
    <td>
      Only with <code>
        --master-key-command
      </code>
      
       or <code>
        --secrets-key-command
      </code>
      
      : at each start, every 10 minutes, and when an operator runs the wrap and unwrap-to-file commands
    </td>
    
    <td>
      Leave the flags unset; <code>
        oz0 server master-key unwrap-to-file
      </code>
      
       moves a key back to a plain file
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        pypi.org
      </code>
      
      , <code>
        registry.npmjs.org
      </code>
      
      , OCI registries, plugin indexes and release addresses, on an edge that serves an <a href="https://docs.oz0.ai/fleet/offline-install">
        offline folder
      </a>
      
       (<code>
        server start --offline-dir
      </code>
      
      )
    </td>
    
    <td>
      <a href="#pypiorg-registrynpmjsorg-oci-registries-plugin-indexes-and-release-addresses-on-an-edge-details">
        Details
      </a>
    </td>
    
    <td>
      <a href="#pypiorg-registrynpmjsorg-oci-registries-plugin-indexes-and-release-addresses-on-an-edge-details">
        Details
      </a>
    </td>
    
    <td>
      <a href="#pypiorg-registrynpmjsorg-oci-registries-plugin-indexes-and-release-addresses-on-an-edge-details">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      The advisory feed you name with <code>
        OZ0_ADVISORY_FEED
      </code>
      
       (or <code>
        server start --advisory-feed-file
      </code>
      
      ), such as OSV's <code>
        storage.googleapis.com/osv-vulnerabilities/PyPI/all.zip
      </code>
    </td>
    
    <td>
      <a href="#the-advisory-feed-you-name-with-oz0_advisory_feed-or-server-start-advisory-feed-file-such-as-osvs-storagegoogleapiscomosv-vulnerabilitiespypiallzip">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-advisory-feed-you-name-with-oz0_advisory_feed-or-server-start-advisory-feed-file-such-as-osvs-storagegoogleapiscomosv-vulnerabilitiespypiallzip">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-advisory-feed-you-name-with-oz0_advisory_feed-or-server-start-advisory-feed-file-such-as-osvs-storagegoogleapiscomosv-vulnerabilitiespypiallzip">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      The tenant's LLM providers, for comparisons
    </td>
    
    <td>
      A <a href="https://docs.oz0.ai/improve/measured-savings">
        comparison
      </a>
      
       runs an agent's cases on two arms, several times each, as shadow runs, with the tenant's key, billed to the tenant and within the comparison's budget
    </td>
    
    <td>
      Only when a tenant's operator or admin starts one (<code>
        oz0 compare-savings start
      </code>
      
      , or the Measured savings page)
    </td>
    
    <td>
      Do not start comparisons
    </td>
  </tr>
  
  <tr>
    <td>
      The API of a Git plugin's forge (<code>
        api.github.com
      </code>
      
      , or <code>
        /api/v3
      </code>
      
      , <code>
        /api/v4
      </code>
      
       or <code>
        /api/v1
      </code>
      
       on the forge's own host)
    </td>
    
    <td>
      <a href="#the-api-of-a-git-plugins-forge-apigithubcom-or-apiv3-apiv4-or-apiv1-on-the-forges-own-host">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-api-of-a-git-plugins-forge-apigithubcom-or-apiv3-apiv4-or-apiv1-on-the-forges-own-host">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-api-of-a-git-plugins-forge-apigithubcom-or-apiv3-apiv4-or-apiv1-on-the-forges-own-host">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      The token endpoints of <code>
        on_behalf_of
      </code>
      
       connections (a literal <code>
        https://
      </code>
      
       URL in the plugin's manifest)
    </td>
    
    <td>
      <a href="#the-token-endpoints-of-on_behalf_of-connections-a-literal-https-url-in-the-plugins-manifest">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-token-endpoints-of-on_behalf_of-connections-a-literal-https-url-in-the-plugins-manifest">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-token-endpoints-of-on_behalf_of-connections-a-literal-https-url-in-the-plugins-manifest">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      The clouds' token services: <code>
        sts.&lt;region>.amazonaws.com
      </code>
      
       (AWS STS), <code>
        sts.googleapis.com
      </code>
      
       and <code>
        iamcredentials.googleapis.com
      </code>
      
      , <code>
        login.microsoftonline.com
      </code>
      
       (Entra), or the endpoints an operator names with <code>
        --cloud-endpoint
      </code>
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/fleet/cloud-federation">
        Cloud federation
      </a>
      
      : the edge exchanges the calling agent's workload token (the agent, never a person) for a credential that lives an hour, kept in memory for the job's next calls; the endpoints are fixed, never a manifest's or a tenant's, and no redirect is followed
    </td>
    
    <td>
      Only for a model provider of <code>
        auth.kind: federated
      </code>
      
       when an agent calls it, or a plugin's connection of kind <code>
        federated
      </code>
      
       when one of its tools is called; from the edge
    </td>
    
    <td>
      Use providers and connections with keys, delete the federated records, or uninstall the plugin
    </td>
  </tr>
  
  <tr>
    <td>
      The folder or S3 bucket given to <code>
        oz0 tenant oidc publish
      </code>
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/fleet/cloud-federation#private-clusters">
        Discovery for a private cluster
      </a>
      
      : the tenant's discovery document and public key set, read from an edge and written where the clouds can fetch them
    </td>
    
    <td>
      Only when an operator runs the command, from the machine it runs on
    </td>
    
    <td>
      Do not run it (<code>
        oz0 tenant oidc jwks
      </code>
      
       only prints the key set)
    </td>
  </tr>
  
  <tr>
    <td>
      The hosts of MCP clients' <a href="https://docs.oz0.ai/build/apps/mcp-server/oauth#who-may-connect">
        client metadata documents
      </a>
      
       that a tenant lists
    </td>
    
    <td>
      <a href="#the-hosts-of-mcp-clients-client-metadata-documents-that-a-tenant-lists">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-hosts-of-mcp-clients-client-metadata-documents-that-a-tenant-lists">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-hosts-of-mcp-clients-client-metadata-documents-that-a-tenant-lists">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      The tenant's LLM providers, for judge jobs
    </td>
    
    <td>
      A judge looks at a <a href="https://docs.oz0.ai/improve/outcome-checks/sampling#sampled-judging-of-finished-jobs">
        sampled finished job
      </a>
      
      , or at a judge's <a href="https://docs.oz0.ai/improve/outcome-checks/sampling#anchors-is-it-the-judge-or-the-agent">
        anchors
      </a>
      
      , with the tenant's key, through the gateway and its data rules, billed to the tenant
    </td>
    
    <td>
      Only for agents whose definition declares <code>
        quality.sample
      </code>
      
       or <code>
        anchors_file
      </code>
      
      , or that a tenant rule samples; anchors only when an eval routine or sampling runs
    </td>
    
    <td>
      Rate 0 in a tenant rule (<code>
        oz0 tenant quality --sample AGENT=0
      </code>
      
      ), or no <code>
        quality.sample
      </code>
      
       and no anchors
    </td>
  </tr>
  
  <tr>
    <td>
      The token endpoints of connections whose tokens the edge refreshes (a literal <code>
        https://
      </code>
      
       URL in the plugin's manifest, or the host a connection was connected for)
    </td>
    
    <td>
      <a href="#the-token-endpoints-of-connections-whose-tokens-the-edge-refreshes-a-literal-details">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-token-endpoints-of-connections-whose-tokens-the-edge-refreshes-a-literal-details">
        Details
      </a>
    </td>
    
    <td>
      <a href="#the-token-endpoints-of-connections-whose-tokens-the-edge-refreshes-a-literal-details">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        graph.microsoft.com
      </code>
      
       (<code>
        POST /v1.0/users/&lt;sender>/sendMail
      </code>
      
      ) from a node, <code>
        login.microsoftonline.com
      </code>
      
       (<code>
        /&lt;tenant>/oauth2/v2.0/token
      </code>
      
      , a client credentials grant for the tenant's own Entra app) from the edge, and the SMTP relay (<code>
        --smtp-addr
      </code>
      
      ) for agents' mail
    </td>
    
    <td>
      The mail agents send with <a href="https://docs.oz0.ai/build/plugins/verified/email">
        ai.oz0/email
      </a>
      
      : through the relay the edge sends it; through Microsoft Graph the edge mints the app's token for each message it allowed and the plugin's server posts the message, its only egress
    </td>
    
    <td>
      Only in a tenant with ai.oz0/email installed, its mail domains named and a send approved; Graph only when the tenant set <code>
        EMAIL_TRANSPORT
      </code>
      
       to <code>
        graph
      </code>
      
       and connected <code>
        email-graph
      </code>
    </td>
    
    <td>
      Uninstall the plugin, or <code>
        oz0 plugin revoke-reads email mail
      </code>
      
      ; <code>
        oz0 connection delete email-graph
      </code>
      
       stops the tokens
    </td>
  </tr>
</tbody>
</table>

### `login.botframework.com` (the Bot Connector's OpenID metadata and keys), `login.microsoftonline.com` (`/<tenant>/oauth2/v2.0/token`, a client details

#### Why

The edge checks each Teams delivery's token against the published keys (fetched over HTTPS, kept for their lifetime up to a day, again for an unknown key at most once a minute), and gets the bot's token for each post with the connection's client secret ([ai.oz0/teams](https://docs.oz0.ai/build/plugins/verified/teams))

#### When

Only in a tenant with ai.oz0/teams (or a plugin with a `jwt` source) installed: keys when a delivery comes, the token while connecting and when a post is made; from the edge

#### Turn it off

Uninstall the plugin; `oz0 connection delete teams` stops the tokens

### `pypi.org`, `registry.npmjs.org`, OCI registries, plugin indexes and release addresses, on an edge details

#### Why

None: the edge pins `pypi:` and `npm:` packages against the folder's files in its own process, takes plugin bundles, OCI plugins and tools' images only from the folder by digest, and fetches no plugin index by URL (an index imported with `index add --file` is never fetched); `server dist pull --from <folder>` takes a release and its toolchain from it; an offline node (`oz0-node run --offline`) takes every plugin package, Python and npm, from the edge's mirrors of the folder

#### When

**Never** while the edge serves a folder

#### Turn it off

Already off. Git sources, and the hosts in other rows a folder does not hold (LLM providers, notifications, a harness's `binaries`), still need their own answer

### The advisory feed you name with `OZ0_ADVISORY_FEED` (or `server start --advisory-feed-file`), such as OSV's `storage.googleapis.com/osv-vulnerabilities/PyPI/all.zip`

#### Why

Advisories for the [vulnerability scan](https://docs.oz0.ai/build/plugins/vulnerabilities) of installed plugins' packages: one GET of the whole document (OSV entries, OSV's zip or the hub's format), never a query naming your packages; HTTPS with TLS verified (plain HTTP only to loopback), no redirect followed, at most 256 MB

#### When

Only when an operator sets the feed (off by default): when an edge takes over the scanner's lease (at its start) and every `--advisory-feed-every` (a day), within the hour after a failed fetch; from the edge

#### Turn it off

Leave it unset (its advisories are dropped at the next scan); [import a file](https://docs.oz0.ai/build/plugins/vulnerabilities#an-operators-file) instead, or rely on the index's

### The API of a Git plugin's forge (`api.github.com`, or `/api/v3`, `/api/v4` or `/api/v1` on the forge's own host)

#### Why

Recording the repository's ID and owner at a Git install, and checking them at each update, so that a repository transferred or created again under the same URL is noticed ([updates from new hands](https://docs.oz0.ai/build/plugins/install/update#updates-from-new-hands)); with a private repository's token, sent to that host only

#### When

When an admin installs or updates a plugin from a Git URL on `github.com`, `gitlab.com`, `codeberg.org`, or a host named with `--forge`; never for an install from a plugin index (its custody is the index's), `plugin inspect`, or an offline edge unless `--forge` names the forge

#### Turn it off

`--forge none` at install, which later updates remember, or a source that is not a Git URL

### The token endpoints of `on_behalf_of` connections (a literal `https://` URL in the plugin's manifest)

#### Why

The edge exchanges a [delegated identity token](https://docs.oz0.ai/concepts/delegation-and-identity#on-behalf-of-a-person), which names the person a job runs for, for the service's own token (RFC 8693): one request per covered tool call, from the edge, never with a redirect followed, at public addresses only (any address in dev mode, or a network `--connect-allow-net` lists)

#### When

Only in a tenant with a plugin that declares such a connection, when one of its tools is called, and only after a tenant admin allowed delegated tokens off the cluster (`oz0 tenant oidc delegated-off-cluster`, off by default)

#### Turn it off

Leave delegated tokens inside the cluster, or uninstall the plugin. The issuer's own discovery document and keys are served, never sent: outside services fetch them from the edge

### The hosts of MCP clients' client metadata documents that a tenant lists

#### Why

When an MCP client identifies itself by the https URL of its metadata document, the edge fetches that document to learn the client's name and redirect addresses: only for a host or URL on the tenant's `mcp_clients` allowlist, over https with TLS verified, only from public addresses (checked after the name resolves), no redirects followed, at most 5 KiB within 5 seconds, kept a few minutes

#### When

Only after a tenant admin allows a client host or document URL (`oz0 mcp clients policy --allow`), when a person connects such a client; from the edge

#### Turn it off

List no hosts or documents (the default): registered loopback clients need no fetch

### The token endpoints of connections whose tokens the edge refreshes (a literal details

#### Why

The edge renews a connection's token with its refresh token before it expires (RFC 6749 section 6): one request when calls find less than ten minutes left (or less than half the token's lifetime, when that is shorter), from one of them on one edge however many find it at once, to the origin the refresh token was issued at only, never with a redirect followed, at public addresses only (any address in dev mode, or a network `--connect-allow-net` lists)

#### When

Only in a tenant with a plugin whose connection declares `token.refresh`, once it is connected, when one of its tools is called

#### Turn it off

`oz0 connection delete <name>`, or uninstall the plugin

The edge's plugin-source fetches use public HTTPS addresses. Private networks are reachable only where `oz0 server start --plugin-source-allow-net` lists them. This applies to the sources above: Git forges and APIs, package indexes, OCI registries and token services, the MCP Registry, plugin indexes and listed bundles.

The same rules cover addresses named in plugin content, including marketplace entries, tool images and remote-tool sign-in checks. The edge never reaches its own interface addresses, even inside an allowed network, its link or cloud metadata services. See [where the edge fetches from](https://docs.oz0.ai/build/plugins/install/sources#where-the-edge-fetches-from). Dev mode can reach every address.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.