METAGROK
GROK BOT / when-route-traffic-relay-breaks-hostname-https

When the route-through-desktop relay breaks hostname HTTPS

when-route-traffic-relay-breaks-hostname-https

This walkthrough leaves you with a checked route-through-desktop setting and a DNS check on your own machine, so you can tell a hostname HTTPS failure from a shared-egress problem. Check that setting first. Checked Oct 5, 2026.

The proxy at 127.0.0.1:8791 is the route-through-desktop relay, not the cloud computer's shared egress. Cursor staff (Colin) said this on the forum on Oct 5, 2026. The setting can be on even if you do not remember turning it on. Staff also said it may have been turned on recently without you choosing it. They did not describe the mechanism, so this page does not either.

Official docs call the toggle Route egress through this desktop, under Settings → Computer (private networks, settings and notifications). Cursor's Grok Bot FAQs and staff call it Route traffic through this computer. This page uses both names and does not pick one. Staff described a Network heading under Settings → Computer; docs.x.ai do not use that sub-heading.

What the relay does

When the setting is on, a CONNECT by hostname is answered with 200 right away, and the name is then resolved and dialed from your own desktop. If your desktop cannot resolve it, resolves it to a private or VPN fake-IP address, or cannot connect, the stream closes. That looks like "200, then TLS EOF". IP-literal CONNECTs stay on the computer's normal path. Staff said made-up hostnames getting a 200 is the giveaway.

The same setting also explains Chrome on the Bot computer timing out on every site. Staff said Chrome on that computer goes out through your Mac's own internet connection. If your Mac cannot reach a site directly, for example with the VPN off, or with a VPN that only covers some apps, every page on the Bot's computer times out.

Custom MCP connectors are a different path. Staff said they connect from Cursor's servers, not from your cloud computer. Cursor does not publish a fixed IP list for that path right now. The connector needs to accept inbound HTTPS from the public internet.

Check the setting

  1. Open Grok Bot on every computer that has it installed.
  2. Open Settings → Computer and turn off the route-through-desktop setting (labelled Route egress through this desktop in the docs; staff and some help pages call it Route traffic through this computer).
  3. Wait about a minute, then retry the hostname. A made-up hostname should now return 502.
  4. On the desktop itself, run dig HOSTNAME and read whether that machine can resolve the name.

If Chrome on the Bot computer still times out after the toggle is off on every install, retry the page and confirm the desktop can reach the same site without the Bot.

Related

Pitfalls

  • Blaming shared egress or a "SAND" proxy for 127.0.0.1:8791. Staff said that address is your own relay.
  • Leaving the toggle on on a second laptop or desktop that also has Grok Bot installed.
  • Asking Cursor for a published MCP connector allowlist. Staff said they do not publish a fixed IP list for that path right now.