poema cloud

Network rules

An instance's network is closed (Concepts): it reaches the hosts your plan allows, on port 443, and nothing reaches it from the internet. The Network page lists those hosts, adds your own where your plan takes them, and holds two more things, rules for the calls to a host and listeners.

Call rules

A rule is for one host and port of your plan or your own hosts, not a wildcard. It can hold:

  • Allow lines, METHODS PATH, such as GET,HEAD /repos/acme/** or * /user: the instance may send that host only requests that match one.
  • Tools, for an MCP server: one name, or a prefix ending in *, per line. The server's tool list is cut to them, and a call to any other is refused.
  • A token, which poema adds to every call on the way out, as a bearer token or in a header you name. It is written once and never shown again, and the instance never holds it.

A host with a rule is reached through poema's call route alone: an instance calls $POEMA_HOSTS_URL/HOST/PATH instead of the host. A client that calls a fixed host itself, such as gh or most SDKs, cannot use it; an MCP server can. For that reason the hosts that git and the package managers install from (github.com, codeload.github.com, objects.githubusercontent.com, raw.githubusercontent.com, gitlab.com, registry.npmjs.org, pypi.org, files.pythonhosted.org, proxy.golang.org, sum.golang.org, index.crates.io, static.crates.io, deb.debian.org) take no rule. An MCP server you add to the library gets a rule that only routes its calls, so that how it is addressed never changes; you can add limits to it later. A rule can be set for the organization or, with a project picked, for one project, where it replaces the organization's for that host. A token is the organization's alone. A scope holds 20 rules.

An instance learns which hosts are limited when it starts, so a rule takes full effect on instances started after it, and the MCP servers of instances made before a rule keep the address they had: clearing a rule that routes one breaks those until the instances are updated (Projects and the library). Clear asks first for that reason. A rule whose host is no longer on your list is marked inactive and ignored.

Listeners

A listener opens a port of an organization's or a project's instances, by name, port and protocol (http, grpc or tcp), to the instances of your namespace that link to it. It does not open anything to the internet: to reach an instance yourself, use poema forward NAME 3000:3000 with an API key, for an instance made with the Terminal box. A scope holds 8 listeners.