Why is my launchctl program not accepting external connections? I am trying to set up the Check_MK agent with launchd on a Mac server, to return data over port 6556 when another machine connects to it.

(The agent itself is essentially just a shell script that outputs various information about the machine's status in a vaguely machine-readable format.)

I am able to connect to it from the machine itself, e.g. with curl localhost:6556, but if I try to connect externally, it just times out.

I have a .plist file set up like the one at de.mathias-kettner.check_mk.plist, stored in /Library/LaunchDaemon:

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
        &lt;key&gt;EnvironmentVariables&lt;/key&gt;
        &lt;dict&gt;
                &lt;key&gt;HOME&lt;/key&gt;
                &lt;string&gt;/var/root&lt;/string&gt;
                &lt;key&gt;PATH&lt;/key&gt;
                &lt;string&gt;/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin:/usr/local/bin&lt;/string&gt;
        &lt;/dict&gt;
        &lt;key&gt;Label&lt;/key&gt;
        &lt;string&gt;de.mathias-kettner.check_mk&lt;/string&gt;
        &lt;key&gt;ProgramArguments&lt;/key&gt;
        &lt;array&gt;
                &lt;string&gt;/usr/local/bin/check_mk_agent&lt;/string&gt;
        &lt;/array&gt;
        &lt;key&gt;Sockets&lt;/key&gt;
        &lt;dict&gt;
                &lt;key&gt;Listeners&lt;/key&gt;
                &lt;dict&gt;
                        &lt;key&gt;SockServiceName&lt;/key&gt;
                        &lt;string&gt;6556&lt;/string&gt;
                &lt;/dict&gt;
        &lt;/dict&gt;
        &lt;key&gt;inetdCompatibility&lt;/key&gt;
        &lt;dict&gt;
                &lt;key&gt;Wait&lt;/key&gt;
                &lt;false/&gt;
        &lt;/dict&gt;
        &lt;key&gt;AbandonProcessGroup&lt;/key&gt;
        &lt;true/&gt;
        &lt;key&gt;StandardErrorPath&lt;/key&gt;
        &lt;string&gt;/var/log/check_mk.err&lt;/string&gt;
        &lt;key&gt;WorkingDirectory&lt;/key&gt;
        &lt;string&gt;/var/root&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;


(The only difference is that the check_mk_agent is /usr/local/bin instead of /usr/bin, because I couldn't create the file there.)

The check_mk_agent file itself can be found at: check_mk_agent.macosx

The strange thing is, if I point the .plist file to something like /bin/date, then it works externally as well.

The only thing I can conclude is that the task runs with different permissions depending on the IP or interface the connection comes from, but I don't know how to change the permissions it tries to run with.
why you are not using ssh to request the data from the agent at the mac?
https://mathias-kettner.de/checkmk_datasource_programs.html
You need not the launchd.

regards,
Oliver