> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# Routing commands

Use the `intercept` and `bypass` commands to manage the [daemon's](/passport/reference/passport-cli/daemon/) routing rules, which decide whether each outbound host routes through the Passport Proxy or connects directly. Intercept rules send matching hosts through the proxy. Bypass rules send them straight to the origin. These commands edit the daemon's local routing rules. IT teams can also push rules with [mobile device management](/passport/reference/passport-cli/deploy-with-mdm/). Passport merges all rule sources. Where they conflict, mandatory and MDM rules take precedence over local ones.

> **Info**
>
> A pattern is an exact host or a leading wildcard, such as `api.example.com` or `*.example.com`. A leading wildcard like `*.example.com` matches subdomains but not the apex `example.com`. To cover the domain and all its subdomains, add both. Leading-dot `NO_PROXY` forms such as `.example.com` aren't supported. Quote patterns so your shell doesn't expand the wildcards.

## `passport intercept`

Manage the rules for hosts that route through the Passport Proxy.

### `passport intercept list`

List the intercept rules, including any forced by mobile device management.

```bash showLineNumbers={false}
passport intercept list [options]
```

**`--local`**

Show only the local `daemon.yml` rules.

---

### `passport intercept add`

Add a local intercept rule.

```bash showLineNumbers={false}
passport intercept add <pattern>
```

**`<pattern>`**

The host to route through the proxy, as an exact host or a leading wildcard.

---

```bash showLineNumbers={false}
passport intercept add "*.example.com"
```

### `passport intercept remove`

Remove a local intercept rule.

```bash showLineNumbers={false}
passport intercept remove <pattern>
```

**`<pattern>`**

The host rule to remove.

---

```bash showLineNumbers={false}
passport intercept remove "*.example.com"
```

## `passport bypass`

Manage the rules for hosts that connect directly, skipping the Passport Proxy.

### `passport bypass list`

List the bypass rules, including any forced by mobile device management.

```bash showLineNumbers={false}
passport bypass list [options]
```

**`--local`**

Show only the local `daemon.yml` rules.

---

### `passport bypass add`

Add a local bypass rule.

```bash showLineNumbers={false}
passport bypass add <pattern>
```

**`<pattern>`**

The host to connect to directly, as an exact host or a leading wildcard.

---

```bash showLineNumbers={false}
passport bypass add "*.internal.example.com"
```

### `passport bypass remove`

Remove a local bypass rule.

```bash showLineNumbers={false}
passport bypass remove <pattern>
```

**`<pattern>`**

The host rule to remove.

---

```bash showLineNumbers={false}
passport bypass remove "*.internal.example.com"
```