Allow URLs and Antivirus Exclusions for Anypoint Code Builder

Configure your firewall, antivirus, and proxy settings to allow Anypoint Code Builder URLs, and exclude the files, folders, and executables that Anypoint Code Builder uses from antivirus scanning. Allowing these URLs ensures Anypoint Code Builder can connect to Anypoint Platform services, download dependencies, and access Maven repositories. Antivirus exclusions prevent real-time scanning from slowing down disk operations. Together, this configuration prevents connection issues and improves performance.

Allow Anypoint Code Builder URLs and Paths

Allow URLs and exclude paths to ensure the best performance in Anypoint Code Builder.

Security and Antivirus Software

If you have security and antivirus software, add Anypoint Code Builder to the allowlist. Running real-time antivirus protection software on your operating system can have a negative impact on Anypoint Code Builder performance, particularly during canvas loading and extension initialization. Continuous disk I/O from real-time scanning causes delays when Mule applications perform intense disk operations. Exclusions reduce file locking, false positives, and I/O latency during builds. Steps to solving these performance issues vary depending on your antivirus software.

Your organization’s security policy decides whether exclusions are allowed and how they’re deployed. Use these lists with your security team.

Antivirus Exclusion Paths

Exclude the following directories and executables from real-time antivirus scanning. The paths vary by operating system.

Windows
macOS

As a first step, add the following high-I/O directories to your antivirus exclusion list:

Anypoint Code Builder data: %USERPROFILE%\AnypointCodeBuilder
Local Maven repository: %USERPROFILE%\.m2
Anypoint extensions: %USERPROFILE%\.vscode\extensions\salesforce.*

If performance issues persist, also exclude the following directories:

VS Code user data: %APPDATA%\Code
VS Code extensions and settings: %USERPROFILE%\.vscode
Temporary files used by Anypoint Code Builder and build tools: %USERPROFILE%\AppData\Local\Temp
%APPDATA%\Local\Temp
The directory where you store your Mule projects (your projects directory). Exclude the entire tree, not single files.

And the following executables:

java.exe or javaw.exe: Java runtime used by Mule and tooling
node.exe: Node.js used by VS Code extensions and scripts
Code.exe: Visual Studio Code

Add the following directories to your antivirus exclusion list:

Anypoint Code Builder data: ~/AnypointCodeBuilder
Local Maven repository: ~/.m2 or ~/.m2/repository
VS Code user data: ~/Library/Application Support/Code
VS Code extensions and settings: ~/.vscode
Temporary files used by Anypoint Code Builder and build tools: $TMPDIR (or /tmp when that is your temp location)
The directory where you store your Mule projects (your projects directory). Exclude the entire tree, not single files.

And these executables:

java: Java runtime used by Mule and tooling. Use the resolved path from your JDK installation.
node: Node.js used by VS Code extensions and scripts
The Visual Studio Code application bundle, for example, Visual Studio Code.app

Anypoint Code Builder Directories

All Anypoint Code Builder users need read and write permissions for the directory where Anypoint Code Builder is installed. If you use a Windows antivirus application, ensure that the plugins/ and features/ directories are under the trusted category.

Allowlist Recommendation

Allowlist the Anypoint Code Builder workspace folder in your client OS security settings. In Windows, allowlist the Windows default temp folder where Anypoint Code Builder stores temporary files.

MuleSoft and Third-Party URLs

Allow these URLs so that they aren’t blocked or interrupted by your organization’s firewall or proxy.

Some entries use a wildcard (*) to indicate that all subdomains must be allowed. The parent domain itself (for example, anypoint.code-builder.platform.salesforce.com) may not resolve directly, as it serves as a base for specific service endpoints. This is expected behavior.

MuleSoft

MuleSoft Maven repositories and connectors update site
- https://repository.mulesoft.org
- https://*.repository.mulesoft.org
Anypoint Code Builder update sites
- https://anypoint.code-builder.platform.salesforce.com
- https://*.anypoint.code-builder.platform.salesforce.com
Anypoint Platform services: CloudHub, Exchange, Core Services [Commcloud / Hyperforce]
- https://anypoint.mulesoft.com
- https://*.anypoint.mulesoft.com
- https://platform.mulesoft.com
- https://*.platform.mulesoft.com
Nexus
- https://nexus.build.msap.io
- https://*.nexus.build.msap.io
All assets downloaded from Exchange
- https://exchange2-asset-manager-kprod.s3.amazonaws.com
- https://*.exchange2-asset-manager-kprod.s3.amazonaws.com
- https://exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com
- https://*.exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com
Resources for API Portals
- https://exchange2-file-upload-service-kprod.s3.amazonaws.com
- https://*.exchange2-file-upload-service-kprod.s3.amazonaws.com

Third-Party

Maven
- https://repo.maven.apache.org/maven2
- https://*.repo.maven.apache.org/maven2
- https://repo1.maven.org/maven2
- https://*.repo1.maven.org/maven2
LaunchDarkly
- https://clientstream.launchdarkly.com
- https://*.clientstream.launchdarkly.com
- https://clientsdk.launchdarkly.com
- https://*.clientsdk.launchdarkly.com
- https://app.launchdarkly.com
- https://*.app.launchdarkly.com
- https://events.launchdarkly.com
- https://*.events.launchdarkly.com
- https://otel.observability.app.launchdarkly.com
- https://*.otel.observability.app.launchdarkly.com
- https://pub.observability.app.launchdarkly.com
- https://*.pub.observability.app.launchdarkly.com