Network requirements
Use this page before assigning AgentKeeper through MDM, repo hooks, or gateway deployment. The goal is simple: endpoints must reach AgentKeeper for enrollment, policy, heartbeat, and runtime...
Use this page before assigning AgentKeeper through MDM, repo hooks, or gateway deployment. The goal is simple: endpoints must reach AgentKeeper for enrollment, policy, heartbeat, and runtime evidence; package artifacts must be available from either AgentKeeper-hosted downloads or your own managed package store.
Required egress
| Destination | Required for | Notes |
|---|---|---|
| AgentKeeper app origin | Enrollment, policy fetch, heartbeat, self-test, runtime events, setup health, and support bundle upload when requested. | Use the tenant origin shown in the dashboard. Hosted production uses https://www.agentkeeper.dev unless your organization has a private endpoint. |
| AgentKeeper download paths or your package store | Runtime, Gateway, browser, and helper artifacts. | Prefer pinned package versions and checksums. For offline deployments, stage artifacts in your MDM or software distribution system. |
| MDM provider endpoints | Assignment, inventory, remediation, and device state. | AgentKeeper does not replace Jamf, Iru/Kandji, Intune, GPO, SCCM, Workspace ONE, or similar delivery systems. |
| Browser extension stores or internal extension store | Browser extension installation when not side-loaded by policy. | Use managed browser policies for force-install and managed config. |
| Identity provider endpoints | SSO and Directory Sync. | Required only when those integrations are enabled. |
Protocols
| Protocol | Use |
|---|---|
| HTTPS 443 | AgentKeeper app, runtime API, downloads, webhooks, browser extension events, and dashboard access. |
| Localhost loopback | Local runtime, hook, and gateway handoff on the workstation. Do not expose local runtime ports externally. |
AgentKeeper does not require inbound internet access to workstations. Local hooks and services initiate outbound requests.
TLS inspection
TLS inspection can break enrollment, policy fetch, artifact downloads, browser extension capture, and support diagnostics if the endpoint does not trust the inspection root.
Before broad assignment:
- Confirm the workstation trusts the corporate inspection certificate.
- Run the runtime
doctorandself-testcommands from Validate deployment. - Confirm a live event reaches Activity after the target AI agent restarts.
- If TLS inspection cannot be made reliable, bypass inspection for the AgentKeeper app origin and pinned artifact hosts.
Offline packaging
For restricted networks, stage artifacts yourself:
- Download the runtime package, metadata, and
checksums.txtfrom Download artifacts. - Verify SHA-256 before wrapping or uploading to MDM.
- Store the exact artifact filename, version, checksum, and MDM assignment name with the release record.
- Use the same package metadata for install, detect, uninstall, and rollback.
- Validate one clean install, one dirty-machine upgrade, one live event, one known BLOCK, and one rollback before broad assignment.
Proxy guidance
If developer workstations use an authenticated proxy, configure the OS or service account path before installing AgentKeeper. Runtime services run outside an interactive shell, so shell-only proxy variables may not apply.
Record:
- Proxy hostname and port.
- Whether TLS inspection is enabled.
- Whether the runtime service or LaunchDaemon inherits proxy settings.
- Whether MDM scripts run with the same proxy access as an interactive user.