> ## Documentation Index
> Fetch the complete documentation index at: https://docs.concatflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network requirements

> The agent needs two outbound HTTPS destinations on port 443. Nothing inbound.

The agent never listens on a port. It only opens outbound connections.

| Destination | Protocol | When |
| - | - | - |
| `api.concatflow.com:443` | HTTPS | Once, the first time the agent starts, to enroll. |
| `agents.concatflow.com:443` | WebSocket over TLS (`wss://`) | All the time. Queries and results travel on this connection. |
| Your database | Its native protocol | Inside your network, as usual. |

The agent learns the second address when it enrolls. You do not configure it.

## Firewalls

Allow outbound TCP 443 to both hostnames. No inbound rule is needed, and the database keeps its existing rules.

## Proxies

The agent keeps one WebSocket open and idle between queries. Some proxies close idle connections. Concatflow pings the connection every 30 seconds to keep it alive. If a proxy still cuts it, exempt `agents.concatflow.com` from its idle timeout.

> [!WARNING]
>
> The agent connects to `agents.concatflow.com` directly. It does not use `HTTPS_PROXY` for that connection. If all outbound traffic must go through an explicit proxy, the agent enrolls but cannot connect.

## Encryption

Everything that leaves your network is encrypted. The agent refuses to start if `CUBIT_API_URL` is not `https://`:

```text theme={"system"}
ERROR source_client CUBIT_API_URL must use TLS (https://, wss:// or tls://): http://api.example.com
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.