Networking

Horizon exposes public HTTPS endpoints to MCP clients and makes outbound connections when hosted server code or the gateway calls another system. The direction of the connection determines which network control to configure.

​

Static egress addresses

Static egress addresses let an upstream system allowlist traffic from Horizon without opening access to the wider internet. They are available on . The addresses are shared Horizon infrastructure rather than dedicated addresses for one server. Allowlist every address for each applicable traffic path so traffic remains available across Horizon’s runtime capacity. Once static IPs are enabled, hosted and external servers receive static egress on their next deployment. For a GitHub organization with an IP allowlist, allowlist both the Horizon gateway and build jobs addresses and the Horizon web app requests to GitHub addresses. Contact horizon-support@prefect.io if you need help determining which traffic paths apply. Static egress is useful when:

• hosted tools call an API that restricts callers by source address
• Horizon connects to an external MCP endpoint behind an IP allowlist
• a build needs to reach a restricted GitHub Enterprise endpoint

A static egress address identifies Horizon as the network source. Horizon authentication and authorization still identify and govern the actor inside each MCP request.

​

External endpoints

The Horizon gateway initiates connections to external MCP servers. The remote endpoint must therefore be reachable from Horizon over public HTTPS. An endpoint that accepts only connections from its own private network cannot be registered directly. To keep a publicly reachable endpoint restricted, expose HTTPS on port 443 and allowlist Horizon’s static egress addresses. Continue to require OAuth or an API key at the remote endpoint because an IP allowlist complements application credentials rather than replacing them. An outbound-only firewall rule does not make the remote server reachable from Horizon.

​

Related docs