ProPR contacts your SCM host, your AI model endpoints, and your own infrastructure. It also sends one usage
report a day to telemetry.meister-dev.ai. Those are all the destinations, and this page lists them so you
can build an allowlist from it.
ProPR needs no license server and downloads no model catalog - see where your code goes.
The usage report contains no code, no repository names and no user names. A Community installation sends a random installation identifier and can switch the report off. A commercial installation also sends its license identifier, which identifies the licensee, and keeps sending while the license is in force - see usage statistics.
What you have to host yourself
| Requirement | Notes |
|---|---|
| The three release images, mirrored | Pull them from the public registry into your internal one and keep the tags aligned - see running published images |
| Not a source build | Building the images from the checkout needs package feeds, so mirroring released images is the offline path - see quickstart |
PostgreSQL with the vector extension | See what you need |
| A writable review workspace volume | See review workspace |
| A durable, backed-up key ring volume | See what to back up |
| The certificate protecting the key ring, where one is configured | A key service reached over the network is not available offline; the certificate protector needs a file. See the certificate protector |
What needs no network at all
| Capability | Why it works offline |
|---|---|
| The model catalog | Embedded in the product; a newer snapshot is an operator upload, not a fetch - see the model catalog |
| The ProRV knowledge lens | Its catalog is embedded too - see review passes |
| The edition and its capabilities | The license file is verified against a trust anchor compiled into the product and then stored in your own database; no license server is contacted in either edition - see activating a license |
| Sign-in | Local accounts need nothing external. Single sign-on to a cloud identity provider does, and is licensed - see sign-in and sessions |
| Review diagnostics | The protocol, findings and thread memory are all in your database - see reviews |
Point ProPR at a model you host
Use the meisterdev/openAiCompatible family for anything serving an OpenAI-shaped API at a URL you supply, including
something you run yourself - see AI providers.
An endpoint on a private address needs the private-egress opt-in. Read outbound request protection before you plan the endpoint. The endpoint needs a TLS certificate the container running ProPR trusts, because nothing skips certificate validation.
Three family-specific consequences of a private endpoint:
- Azure OpenAI. A private endpoint keeps the Azure hostname this family requires - see outbound request protection.
- AWS Bedrock. A private or VPC endpoint names no region, so supply it as the
regiondefault query parameter, and enter the models by hand because discovery needs an AWS host - see AWS Bedrock. - Embeddings. Thread memory and ProCursor need an embedding model, so you have to serve one yourself. Check what degrades if nothing does - see purposes.
What ProPR still contacts
- Your AI provider, unless you host the model yourself. The compliance host list constrains which provider families and endpoint hosts a tenant may reach - see restrict where your code goes.
- Your SCM host. Token connections authenticate with a credential issued by that host. Azure DevOps Services OAuth connections also contact Microsoft Entra token endpoints. Azure DevOps Services PAT connections contact the SCM host without acquiring an Entra token. See support matrix.
- Your own collectors, if you configured a trace or log endpoint - see observability.
telemetry.meister-dev.ai, once a day. Community installations can switch this off under Administration → Usage Statistics - see usage statistics.
Confirm it worked
- Verify each AI connection. The probe is a real call to your endpoint, so a green verification proves the path, the credential and the certificate at once.
- Call
GET /healthzand confirm every check it reports is healthy - see what the health checks mean. - Attach a model from the catalog and confirm it arrives with a context window and a price. That metadata came from inside the image; nothing was fetched.
- Trigger one review from the API and read its protocol - see trigger a review.
- Read your egress logs for that review. A review reads data from your SCM host and contacts your
configured AI models. Azure DevOps Services OAuth connections also contact Microsoft identity endpoints.
You see your own collectors if configured. An entry for
telemetry.meister-dev.aiis the daily usage report, not part of the review. - On a Community installation, switch the usage report off, then confirm
telemetry.meister-dev.aino longer appears in your egress logs.
If a verification or a health check fails, troubleshooting routes the symptom.