Skip to main content

​
CodeRabbit-hosted domains

For CodeRabbit-hosted services, the environment running CodeRabbit CLI must allow outbound TCP traffic on port 443. No inbound firewall rule is required. Allow the domain names below instead of fixed IP addresses because the addresses behind these services can change.
These requirements cover outbound traffic from the environment running the CLI. CodeRabbit IP addresses for connecting to private Git provider instances cover traffic in the opposite direction and do not replace this domain list.
For a standard US setup, allow cli.coderabbit.ai, app.coderabbit.ai, and ide.coderabbit.ai. For a standard EU setup, allow cli.coderabbit.ai, app.eu.coderabbit.ai, and ide.eu.coderabbit.ai. Run cr auth status to confirm the active region.

​
Optional and command-specific access

Some CLI features contact additional services. Allow only the entries needed for your workflow. GitHub can redirect release downloads to its asset delivery domains. Follow GitHub’s current network guidance rather than relying on one fixed asset hostname. Default-branch detection can contact the repository’s configured origin. If the origin is unavailable from the restricted environment, pass --base <branch> to avoid that lookup.

​
Configure Claude Code cloud environments

Claude Code cloud environments use the network policy attached to the selected environment. To run CodeRabbit from an environment with restricted access:
  1. Edit the selected Claude Code cloud environment.
  2. Set Network access to Custom and retain Claude’s default allowed domains.
  3. Add the applicable CodeRabbit domains from the table above, one domain per line.
  4. Save the environment and start a new cloud session so the updated policy applies.
Claude routes GitHub traffic through a separate GitHub proxy. Adding GitHub domains to the environment’s allowed-domain list does not change those controls. Prefer exact domain names for the permanent policy. A broad wildcard grants access to more CodeRabbit subdomains than the CLI requires.

​
Authenticate cloud and headless sessions

Browser-based authentication does not require a public inbound firewall rule. Fresh cloud sessions do not inherit CodeRabbit authentication from your local computer. Use an Agentic API key only when the runtime can inject it securely, and follow the Headless CLI integration guide.
Claude Code cloud environment values are not a dedicated secret store, and users of a shared environment can read them. Do not persist an Agentic API key there. If you cannot inject the key securely at runtime, use the CodeRabbit GitHub App or run the CLI in an environment with a supported secret store.

​
Self-hosted CodeRabbit

For a self-hosted CodeRabbit deployment, allow the hostname, protocol, and port configured for your instance. The CLI uses HTTPS for authentication and API requests and WSS for the review connection. You might still need cli.coderabbit.ai if you install or update the CLI from CodeRabbit’s distribution service. See Use with self-hosted CodeRabbit for configuration steps.

​
Troubleshooting

Run cr doctor from the same restricted environment as one connectivity smoke test, then retry the exact command or hostname that failed. cr doctor is a connectivity smoke test. A passing report does not replace retrying the original command and does not prove that an authenticated review can complete through every network intermediary.

​
What’s next

Headless CLI integration

Authenticate non-interactively with an Agentic API key

Use with self-hosted CodeRabbit

Connect the CLI to your organization’s self-hosted CodeRabbit instance

CLI Command Reference

Review CLI commands, options, and diagnostics