IT requirements.
What your IT and security teams need before anyone installs a Captain EPM product: the hosts each product contacts, the SHA-256 checksum of each installer and the system requirements. You do not need an account to read this page.
To evaluate or install a product, contact us and the team will set you up.
System requirements.
EPM Commander Add-in
- Windows 10 or Windows 11 (64-bit)
- Microsoft Excel 2016, 2019, 2021 or Microsoft 365 — Windows desktop edition
- Oracle EPM Cloud subscription
- .NET Framework 4.8, VSTO Runtime and Microsoft Edge WebView2 runtime
- Administrator rights to install (per-machine installer)
- 4 GB RAM minimum (8 GB recommended)
EPM Admiral (Planning & FCC)
- Windows 10 or Windows 11 (64-bit)
- Oracle EPM Cloud subscription
- Claude Desktop App (or compatible MCP client)
- No Node.js or developer tools required
- Enterprise OAuth 2.0 or Basic Auth credentials
For IT and security teams.
We are a small publisher, so some proxies and endpoint policies will not recognise our installers yet. Everything you need to verify and approve them is here — and if it is still blocked, tell us and we will work through it with you.
Hosts to allow
captain-epm.comWebsite, documentation and product sheetsapi.captain-epm.comLicence activation, sign-in and installer updates- Your Oracle EPM Cloud hostAll application traffic, straight from Excel
Only if you use the feature:
- Your Oracle identity domainOAuth sign-in, if you use it instead of basic authentication
api.anthropic.com, api.openai.com or generativelanguage.googleapis.comThe AI assistant — only the provider whose key you configure, and none if you configure no keydocs.oracle.comRelease Report, which reads Oracle’s monthly What’s Newcdn.jsdelivr.net, unpkg.com, fonts.googleapis.com, fonts.gstatic.comChart, graph and font files loaded by some windows: the performance dashboards, the integration graph, bulk security and the AI chat
All connections are HTTPS. Your Oracle EPM traffic goes straight from Excel to your own environment, and AI traffic goes only to the provider you configure.
Hosts to allow
- Your Oracle EPM Cloud hostEvery tool call, straight from the server on the user’s machine
- Your Oracle identity domainOAuth token requests, if you use OAuth instead of basic authentication
captain-epm.comEPM Admiral 26.10.002 and later: the person approves the computer here, in their browser, once, when installingapi.captain-epm.comEPM Admiral 26.10.002 and later: activation when installing, and a check-in each time it starts (it keeps working for 14 days by default without one)
From EPM Admiral 26.10.002, installing asks the person to approve the computer once at captain-epm.com, and each start checks in with api.captain-epm.com. The check-in carries the product, the computer name, the Windows user name, the EPM Admiral version and a one-way machine identifier, never EPM data. If it cannot get through, EPM Admiral keeps working for 14 days by default from the last successful check-in. Uninstalling and choosing to remove its settings tells api.captain-epm.com the computer is gone.
Earlier versions contact Captain EPM only to download the installer: signing in and starting the download happen at captain-epm.com, and the file itself comes from api.captain-epm.com. In every version the server has no update check, runs on the user's machine and opens no inbound port by default.
Where the data goes next
EPM Admiral returns what it reads from Oracle EPM to your MCP client — Claude Desktop, for example — and that client sends it to its own AI provider. That connection belongs to the client, not to EPM Admiral, so review it under your agreement with that provider. Setting a connection to read-only stops every write for that environment.
If your policy blocks executable downloads
Sophos Web Control, Zscaler, Netskope and others can block every .exe download by file type, whatever its signature or origin. That rule is doing its job. We will not suggest you switch it off, and we will not repackage the installer to slip past it — a vendor who disguises a payload to defeat your controls has told you something about themselves.
Two things that do work. The first covers both the EPM Commander and the EPM Admiral installers; the second is offered for EPM Commander:
- A scoped website exception.Allow
api.captain-epm.com(where the installer file is served) andcaptain-epm.com(where users sign in and start the download) for the group that needs the installers, rather than relaxing the rule for everyone. In Sophos Central that is Web Control → Website Management, referenced from the policy covering those users. Check each installer against its SHA-256 in the table below first. - Managed deployment, so nobody downloads anything.For EPM Commander, we can package the add-in for you to push through Intune or Group Policy, which keeps the file-type rule intact and takes the end user out of it entirely. Ask us about it.
The EPM Admiral installer is per-user and needs no administrator rights.
SHA-256 checksums
Verify a download before you approve it. On Windows: Get-FileHash .\<file> -Algorithm SHA256
| File | Build | Size | SHA-256 |
|---|---|---|---|
| EPMCommander.exe | 26.10.001 | 36.17 MB | b927bb4465d1082a3c751f9eacc5887907f4be1f155ecc203dfce92ed5b8dc4f |
| EPMAdmiral_Setup.exe | 26.10.004 | 17.85 MB | eedc394516022979238550d446995e74f4288dec839afa9c8a98424c88dde16d |
Reporting a security issue
Contact details and disclosure policy are published at /.well-known/security.txt.