> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# CLI network requirements
> Allow the outbound domains and ports required to run CodeRabbit CLI from restricted networks, proxies, and cloud sandboxes.
## CodeRabbit-hosted domains
For CodeRabbit-hosted services, the environment running CodeRabbit CLI must allow outbound TCP traffic on port 443. No inbound firewall rule is required. Allow the domain names below instead of fixed IP addresses because the addresses behind these services can change.
These requirements cover outbound traffic from the environment running the CLI. CodeRabbit IP addresses for connecting to private Git provider instances cover traffic in the opposite direction and do not replace this domain list.
| Domain | Protocol and port | Purpose | When to allow |
| ---------------------- | ----------------- | ------------------------------------------------- | ---------------------------------------------------------- |
| `cli.coderabbit.ai` | HTTPS, TCP 443 | Installation, binary downloads, and update checks | Installation and updates |
| `app.coderabbit.ai` | HTTPS, TCP 443 | Authentication and CLI service requests | Login and account flows for organizations in the US region |
| `ide.coderabbit.ai` | WSS, TCP 443 | Hosted review connection | Every hosted review for organizations in the US region |
| `app.eu.coderabbit.ai` | HTTPS, TCP 443 | Authentication and CLI service requests | Login and account flows for organizations in the EU region |
| `ide.eu.coderabbit.ai` | WSS, TCP 443 | Hosted review connection | Every hosted review for organizations in the EU region |
For a standard US setup, allow `cli.coderabbit.ai`, `app.coderabbit.ai`, and `ide.coderabbit.ai`. For a standard EU setup, allow `cli.coderabbit.ai`, `app.eu.coderabbit.ai`, and `ide.eu.coderabbit.ai`. Run `cr auth status` to confirm the active region.
## Optional and command-specific access
Some CLI features contact additional services. Allow only the entries needed for your workflow.
| Domain | Protocol and port | Purpose | When to allow |
| -------------------------------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------- |
| `www.coderabbit.ai` | HTTPS, TCP 443 | Configuration schema download | When running `cr config validate` |
| `api.github.com`, `github.com`, and GitHub release asset hosts | HTTPS, TCP 443 | Checks and downloads for verified CodeRabbit skills | When running `cr skills` |
| Your Git provider and repository hosts | HTTPS on TCP 443, SSH on TCP 22, or a custom protocol and port | Default-branch detection, repository cloning, and linked-repository access | When the workflow needs remote Git access |
GitHub can redirect release downloads to its asset delivery domains. Follow GitHub's current network guidance rather than relying on one fixed asset hostname.
Default-branch detection can contact the repository's configured origin. If the origin is unavailable from the restricted environment, pass `--base ` to avoid that lookup.
## Configure Claude Code cloud environments
Claude Code cloud environments use the network policy attached to the selected environment. To run CodeRabbit from an environment with restricted access:
1. Edit the selected [Claude Code cloud environment](https://code.claude.com/docs/en/cloud-environments#allow-specific-domains).
2. Set **Network access** to **Custom** and retain Claude's default allowed domains.
3. Add the applicable CodeRabbit domains from the table above, one domain per line.
4. Save the environment and start a new cloud session so the updated policy applies.
Claude routes GitHub traffic through a [separate GitHub proxy](https://code.claude.com/docs/en/cloud-environments#github-proxy). Adding GitHub domains to the environment's allowed-domain list does not change those controls.
Prefer exact domain names for the permanent policy. A broad wildcard grants access to more CodeRabbit subdomains than the CLI requires.
## Authenticate cloud and headless sessions
Browser-based authentication does not require a public inbound firewall rule. Fresh cloud sessions do not inherit CodeRabbit authentication from your local computer. Use an Agentic API key only when the runtime can inject it securely, and follow the [Headless CLI integration](/cli/headless-cli-integration) guide.
Claude Code cloud environment values are not a dedicated secret store, and users of a shared environment can read them. Do not persist an Agentic API key there. If you cannot inject the key securely at runtime, use the [CodeRabbit GitHub App](/platforms/github-com) or run the CLI in an environment with a supported secret store.
## Self-hosted CodeRabbit
For a self-hosted CodeRabbit deployment, allow the hostname, protocol, and port configured for your instance. The CLI uses HTTPS for authentication and API requests and WSS for the review connection. You might still need `cli.coderabbit.ai` if you install or update the CLI from CodeRabbit's distribution service. See [Use with self-hosted CodeRabbit](/cli/cli-with-self-hosted-CodeRabbit) for configuration steps.
## Troubleshooting
Run `cr doctor` from the same restricted environment as one connectivity smoke test, then retry the exact command or hostname that failed.
| Symptom | Likely boundary | Next action |
| -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Proxy-level `CONNECT 403` or [`x-deny-reason: host_not_allowed`](https://code.claude.com/docs/en/errors#host-not-allowed-in-a-cloud-session) | The cloud environment or proxy blocked the request before it reached CodeRabbit | Allow the exact requested domain, save the policy, and start a new session |
| CodeRabbit backend is unreachable | HTTPS access to the regional `app` domain is blocked | Check the domain allowlist, firewall, VPN, and proxy policy |
| WebSocket is unreachable, hangs, or closes with code `1006` | WSS access to the regional `ide` domain is blocked or the proxy does not support WebSocket upgrades | Allow WSS over TCP 443 and confirm the proxy supports WebSocket connections |
| CodeRabbit returns `401` or `403` after the connection succeeds | Authentication, API key, or entitlement failed | Run `cr auth status` and validate the Agentic API key or browser login |
| `cr doctor` passes but the review still fails | Basic connectivity succeeded, but the complete review path still failed | Retry the exact command, then collect the CLI version, timestamp, doctor output, and redacted logs for support |
`cr doctor` is a connectivity smoke test. A passing report does not replace retrying the original command and does not prove that an authenticated review can complete through every network intermediary.
## What's next
Authenticate non-interactively with an Agentic API key
Connect the CLI to your organization's self-hosted CodeRabbit instance
Review CLI commands, options, and diagnostics