Network requirements

The agent needs two outbound HTTPS destinations on port 443. Nothing inbound.

The agent never listens on a port. It only opens outbound connections.

Destination	Protocol	When
api.concatflow.com:443	HTTPS	Once, the first time the agent starts, to enroll.
agents.concatflow.com:443	WebSocket over TLS (wss://)	All the time. Queries and results travel on this connection.
Your database	Its native protocol	Inside your network, as usual.

The agent learns the second address when it enrolls. You do not configure it.

Firewalls

Allow outbound TCP 443 to both hostnames. No inbound rule is needed, and the database keeps its existing rules.

Proxies

The agent keeps one WebSocket open and idle between queries. Some proxies close idle connections. Concatflow pings the connection every 30 seconds to keep it alive. If a proxy still cuts it, exempt agents.concatflow.com from its idle timeout.

The agent connects to agents.concatflow.com directly. It does not use HTTPS_PROXY for that connection. If all outbound traffic must go through an explicit proxy, the agent enrolls but cannot connect.

Encryption

Everything that leaves your network is encrypted. The agent refuses to start if CUBIT_API_URL is not https://:

ERROR source_client CUBIT_API_URL must use TLS (https://, wss:// or tls://): http://api.example.com