Skip to main content
This page details the network access required by the Miru Agent so you can configure firewalls on your device’s network. All connections are outbound and initiated by the agent. No inbound ports need to be opened on the device.

​
Required endpoints

Allow outbound traffic from the device to the following hosts:

​
MQTT connection

The connection to mqtt.mirurobotics.com is raw MQTT over TLS on port 443, not HTTPS or WebSocket traffic. The agent does not support HTTP proxies for this connection; it needs a direct connection to the broker.
Firewalls that perform TLS inspection, or that only allow HTTP traffic on port 443, may drop the MQTT connection. Exempt mqtt.mirurobotics.com from these policies.
If the MQTT connection is blocked, the agent continues to work over HTTPS but loses real-time deployment notifications. New deployments reach the device on the next sync cycle triggered by polling, a Device API request, or an agent restart. See Triggers for details.

​
Older agent versions

Agent versions prior to v0.10.3 connect to mqtt.mirurobotics.com on TCP port 8883 instead of 443. Allow port 8883 for devices running these versions, or upgrade them.

​
Installation and upgrades

The following host is required when installing or upgrading the agent on the device: To avoid downloading on the device, download the package on another computer and transfer it. See Poor connectivity.

​
On-device traffic

Applications on the device reach the agent through the local Device API, which is not reachable from other machines and requires no firewall rules. See Network posture for details.
Last modified on October 13, 2026