[meliaj]

Summary

Adds an "SDK direct routing" section to the firewall allowlist page, plus one troubleshooting bullet.

• Lists the browser subresources the Node, Python, and Go SDKs send straight to the browser instead of api.onkernel.com: curl, computer, playwright, process, fs, logs/stream, telemetry/stream, repl, and webmcp.
• Documents KERNEL_BROWSER_ROUTING_SUBRESOURCES: not set routes the defaults, empty routes nothing directly, and a comma-separated list routes only those subresources.
• Adds a table and a shell example.

Why

A network that allows api.onkernel.com but not the wildcard domains and ports used by browser URLs will time out on these calls. The page didn't mention the routing or the opt-out.

Verification

• Read the routing code in all three SDKs. The default list, the empty-value behavior, and the comma-list behavior match.
• I haven't run an SDK with the variable set, and I haven't rendered the page with mintlify dev.

For the next changelog entry

This PR doesn't edit changelog.mdx, since an entry covers everything since the last one. For whoever writes the next full entry:

Network path: repl and webmcp calls now go directly to the browser's base_url instead of api.onkernel.com. Allow the *.onkernel.com and *.kernel.sh domains on ports 443 and 8443, or set KERNEL_BROWSER_ROUTING_SUBRESOURCES="" to keep them on the API.

---

Note

Low Risk
Documentation-only changes to the network access guide with no runtime or security behavior changes in this repo.

Overview
Updates the firewall allowlist doc with a new SDK direct routing section: it explains that Node, Python, and Go SDKs can hit browser hosts (same domains/ports as cdp_ws_url) for certain subresources instead of api.onkernel.com, which can cause timeouts if only the API host is allowlisted.

It also documents KERNEL_BROWSER_ROUTING_SUBRESOURCES (default direct routes, empty string to force all traffic via the API, or a comma-separated allowlist), with a behavior table and shell examples, and adds a troubleshooting bullet for timeouts on process, fs, playwright, or repl when browser creation still works.

^{Reviewed by Cursor Bugbot for commit 4c6ea35. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 12, 2026, 11:40 PM

💡 Tip: Enable Automations to automatically generate PRs for you.