> ## Documentation Index
> Fetch the complete documentation index at: https://momentic.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> The canonical docs host is https://momentic.ai/docs. Append .md to any page URL for clean Markdown. Fetch https://momentic.ai/docs/llms.txt for the page index and https://momentic.ai/docs/llms-full.txt for every page in one file.
> For an unattended setup, run `npx --yes @momentic/wizard@latest -y --platform web --editor-tools skills` (use `--platform ios` or `--platform android` for mobile). Never run an interactive command in a non-TTY shell.
> Mo is the autonomous QA agent, a separate product from the YAML test framework: its npm package and CLI are `qa` (not `mo` — `npx mo` is a different project). Install with `npm install -g qa`, authenticate the same MOMENTIC_API_KEY way, install repo skills with `qa skills -y`, and start a session with `qa start "<brief>"` or `qa <url>`. Docs: https://momentic.ai/docs/mo.md.
> You cannot complete the browser sign-in yourself. Read the API key from the exact MOMENTIC_API_KEY environment variable (similarly named vars like BILT_MOMENTIC_API_KEY are ignored), or ask the user to create one at https://app.momentic.ai/settings/api-keys and paste it back.
> Momentic's capability summary for agents is at https://momentic.ai/docs/skill.md. Install the skills with `npx momentic skills --yes` (or `npx momentic-mobile skills --yes` for mobile).
> Tests are YAML files in the user's repository. Use only the step names listed at https://momentic.ai/docs/reference/commands.md and the file structure at https://momentic.ai/docs/core-concepts/file-format.md. Do not invent step names, config keys, or CLI flags.
> Web tests run on Chromium, iOS tests on simulators, and Android tests on emulators. Physical devices are not supported.

# Tunneling

> Let Mo reach a web app on your machine or private network.

Mo runs in a hosted browser. Use a tunnel when the app you want to test is on
your machine or a private network. You can start one with the `qa` CLI or run
the Connector Docker image on a network host.

<Warning>
  Tunneling is in alpha. Behavior may change, and performance is not guaranteed.
</Warning>

## Prerequisites

Allow outbound TCP 443 from the machine running `qa tunnel` or the Connector
container to these IP addresses. Tunnels currently connect through West US 3.

| Destination | IP address       |
| ----------- | ---------------- |
| Shared API  | `34.149.80.75`   |
| West US 3   | `135.234.111.33` |

The machine also needs DNS resolution and network access to the target app.

## Tunnel with the CLI

Use `qa tunnel` when the app is reachable from the machine running the CLI.
Start the tunnel for the exact address Mo will open, then pass its ID to
`qa start`:

```bash theme={null}
tunnel_id=$(qa tunnel start localhost:3000 | jq -r .tunnelId)
qa start "Test the checkout flow on http://localhost:3000" --tunnel "$tunnel_id"
```

The address can also be a private hostname or IP address. For example, if your
machine can reach `staging.internal:8080`, you can tunnel it without Docker:

```bash theme={null}
tunnel_id=$(qa tunnel start staging.internal:8080 | jq -r .tunnelId)
qa start "Test the checkout flow on http://staging.internal:8080" --tunnel "$tunnel_id"
```

Keep the tunnel running until the session finishes, then stop it with
`qa tunnel stop "$tunnel_id"`. Pass more addresses to `qa tunnel start` if the
flow needs them. The [`qa tunnel` reference](/docs/cli-reference/mo/commands/tunnel)
covers foreground mode and listing tunnels.

## Run the Connector with Docker

For a VM that can reach an internal app, run the Connector container there. The
Connector needs outbound access to Momentic and does not open an inbound port on
your network. Get the Connector image from Momentic before starting.

### Start the Connector

Set `CONNECTOR_IMAGE` to the image reference Momentic gave you, and set
`MOMENTIC_API_KEY` to your organization's API key. This example lets Mo open
`https://app.internal.example` through a Connector named `internal-poc`:

```bash theme={null}
export CONNECTOR_IMAGE='<image supplied by Momentic>'
export MOMENTIC_API_KEY='<Momentic API key>'
export MOMENTIC_APPROVED_APPS='[{"name":"internal app","browserAddress":"app.internal.example:443","target":"app.internal.example:443","scheme":"https"}]'

docker run --detach \
  --name momentic-connector \
  --network host \
  --volume momentic-connector-state:/var/lib/browser-fleet-connector \
  --env MOMENTIC_API_BASE_URL=https://api.momentic.ai \
  --env MOMENTIC_API_KEY \
  --env MOMENTIC_CONNECTOR_NAME=internal-poc \
  --env MOMENTIC_APPROVED_APPS \
  "$CONNECTOR_IMAGE"
```

`browserAddress` is the host and port Mo opens. `target` is the host and port
the Connector reaches on your network. Set `scheme` to `http` or `https` to
match the app. On a Linux host, `--network host` lets the Connector reach
services bound to the host's loopback address. Keep the state volume so the
Connector retains its identity across restarts.

Check `docker logs momentic-connector` to confirm enrollment succeeds. Then
start a Mo session with the Connector name:

```bash theme={null}
qa start "Test the sign-in flow on https://app.internal.example" --tunnel internal-poc
```

See [use the Mo CLI](/docs/mo/cli) for installation and sign-in.