Corporate networks

HTTP(S) proxy

Set the usual variables and Moka routes model providers, HTTP MCP servers and catalog URLs through the proxy:

export HTTPS_PROXY=http://proxy.corp.example:8080
export NO_PROXY=.corp.example,10.0.0.0/8
npx @mokalabs/sandbox
# or: npx @mokalabs/sandbox --proxy http://proxy.corp.example:8080

Moka prints Proxy: … at startup when it’s active. localhost, 127.0.0.1 and ::1 always bypass the proxy, so Ollama, LM Studio and the UI keep working.

Caution

This uses Node’s built-in proxy support, which needs Node 22.21+ or 24+. On older versions Moka starts, but warns that it can’t use the proxy.

stdio MCP servers inherit HTTP(S)_PROXY, NO_PROXY, NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, npm_config_registry, PIP_INDEX_URL and UV_INDEX_URL, so npx and uvx servers can download and connect from behind the proxy too.

Company certificates

Company LLM gateways, and proxies that inspect TLS, often use certificates from an internal certificate authority. Your browser trusts them because IT installed that authority in your system (the macOS keychain or the Windows certificate store). Node doesn’t look there by default, so connections fail with errors like self-signed certificate in certificate chain or unable to get local issuer certificate.

Moka trusts the certificates your system trusts, like a browser does: with Node 22.19+ or 24.5+ it loads them at startup, and on Node 22.15+ it restarts itself once with --use-system-ca. MCP servers it starts get NODE_USE_SYSTEM_CA=1, so npx servers trust them too. The startup banner shows Certs: Node's + your system's when this is on. Turn it off with --no-system-ca (or MOKA_SYSTEM_CA=0).

If the certificate isn’t in your system store either (or you’re on an older Node), get your company’s root certificate as a .pem file and point Node at it:

export NODE_EXTRA_CA_CERTS=/path/to/company-root.pem
npx @mokalabs/sandbox

On a Mac, IT-installed certificates are usually in the System keychain. This exports them all to one file:

security find-certificate -a -p /Library/Keychains/System.keychain > ~/company-cas.pem
export NODE_EXTRA_CA_CERTS=~/company-cas.pem

When a connection fails because of a certificate, Moka’s error message says which of these to do.

Caution

Don’t turn off certificate checks (NODE_TLS_REJECT_UNAUTHORIZED=0) to get around this: your API keys and prompts would be sent to anyone who can intercept the connection.

Curated registries (Artifactory, Nexus, …)

@mokalabs/sandbox bundles all of its code and has zero runtime dependencies, so npx installs exactly one package from your registry.

Many companies quarantine packages for a number of days after they’re published (a “minimum release age” or curation policy). If your registry says it can’t find @mokalabs/sandbox, the latest release is probably still in quarantine. Pin a version that has cleared it:

npm view @mokalabs/sandbox time --json     # publish dates per version
npx @mokalabs/sandbox@0.2.0                 # any version older than your policy

The Moka repo applies the same rule to its own dependencies: pnpm-workspace.yaml sets minimumReleaseAge: 20160 (14 days), so everything bundled into a release was public for at least two weeks.