{"hosts":[{"port":443,"host":"vitro.run","required":true,"why":"the MCP endpoint, the record reads, the tunnel, and the binary itself"},{"port":443,"host":"mtrrvagsxvdqtfemhtau.supabase.co","required":false,"why":"signing in and refreshing an OAuth token; not contacted at all by a psk_live_ key"}],"inbound":false,"note":"Remote MCP is exempt from the network policy on several agent platforms; the tunnel is not, and needs the first host below allowlisted.","registration":{"command":"claude mcp add --scope user --transport http vitro https://vitro.run/mcp","name":"vitro","json":"{\n  \"mcpServers\": {\n    \"vitro\": {\n      \"type\": \"http\",\n      \"url\": \"https://vitro.run/mcp\"\n    }\n  }\n}","url":"https://vitro.run/mcp","transport":"http"},"mcp":{"url":"https://vitro.run/mcp","transport":"http"},"egress_only":true}