Add a canonical network access allowlist

[Sayan-]

Summary

• add a searchable Network Access page with the domains, ports, and protocols required by each browser feature
• separate outbound firewall requirements from iframe Content Security Policy configuration
• link the allowlist from browser creation, control, observation, Live View, replays, and the restricted-network integration guide

---

Note

Low Risk
Documentation and navigation only; no runtime, API, or security behavior changes.

Overview
Adds a Network Access doc (info/network-access) as the single source for outbound firewall allowlists (API, auth, CDP/WSS on 8443, Live View STUN/TURN, replay S3) and for CSP snippets for embedded Live View and replays, plus troubleshooting bullets.

The page is registered under Info in docs.json. Live View and replay embedding guides now point readers to that page for firewall rules and CSP instead of treating CSP as the only network story; Live View still shows the CSP example inline but defers “complete” requirements to the new doc.

Create, observe, control, and the Claude managed-agents networking step get short callouts linking to the allowlist when outbound traffic is restricted (including CDP/WebDriver when going beyond API-only workers).

^{Reviewed by Cursor Bugbot for commit a0f2937. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

Risk Assessment: Very Low

Decision: Already approved — not re-approving

Re-evaluated f33be504 independently from the file diff. The change set is unchanged since the prior approval, and risk has not increased.

What changed

• New info/network-access.mdx reference page (destinations, ports, protocols, CSP snippets, troubleshooting)
• One docs.json Info-nav entry for that page
• Cross-links from Live View, replays, create/control/observe, and Claude managed-agents pages

Why Very Low

• Documentation-only Mintlify pages and nav config (+69 / −1 across 8 files)
• No application logic, auth, infrastructure, or production configuration changes
• No CODEOWNERS file or required ownership review
• Same HEAD commit as the existing approval; no new blast radius

Action: Existing approval stands. Re-evaluate if a later push adds non-docs files or operational/config changes.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Sep 10, 2026, 7:59 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[masnwilliams]

looks good — the documented browser connection, live view, and replay destinations match the implementation, and the new cross-links make the allowlist easier to find.

non-blocking: because the table labels api.onkernel.com as covering the CLI, consider clarifying that this covers authenticated API requests rather than the browser-based kernel login flow, which also uses the OAuth and dashboard hosts on port 443.

[cursor]

Risk Assessment: Very Low

Decision: Already approved — not re-approving. Risk did not increase after the latest push.

Re-evaluated HEAD a0f29375 independently from the file diff (not from PR description or commit-message claims).

What changed

• New info/network-access.mdx reference page (destinations, ports, protocols, CSP snippets, troubleshooting)
• One docs.json Info-nav entry for that page
• Cross-links from Live View, replays, create/control/observe, and Claude managed-agents pages
• Latest commit only splits CLI login hosts (auth.onkernel.com, dashboard.onkernel.com) from authenticated API/CLI requests and adds a matching troubleshooting bullet

Why Very Low

• Documentation-only Mintlify pages and nav config (+71 / −1 across 8 files)
• No application logic, auth, infrastructure, or production configuration changes
• No CODEOWNERS file or required ownership review
• Follow-up commit stays inside the same docs page; blast radius is unchanged

Action: Existing approval stands. Re-evaluate if a later push adds non-docs files or operational/config changes.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[Sayan-]

noice great call ty