Fix: no egress allowlist

Check: egress. Controls: ASI01, MCP10.

An agent that can reach any host can send any secret to any host. An allowlist ends that.

Detect

List what the agent talks to now:

# macOS and Linux: established outbound connections
lsof -nP -iTCP -sTCP:ESTABLISHED | awk '{print $1, $9}' | sort -u | head -40

Fix on Linux (container or VM)

Allow DNS, loopback and named hosts. Drop the rest:

sudo iptables -A OUTPUT -o lo -j ACCEPT
sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
for h in api.anthropic.com api.openai.com api.securemyagent.ai github.com; do
  for ip in $(getent ahostsv4 "$h" | awk '{print $1}' | sort -u); do
    sudo iptables -A OUTPUT -d "$ip" -j ACCEPT
  done
done
sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -P OUTPUT DROP

IPs change. Prefer a proxy that filters by hostname.

Fix with a proxy

Run the agent with HTTPS_PROXY set to a proxy that allows only listed hostnames. Block everything else.

Fix on macOS

Use an application firewall that filters outbound traffic per app, and allow only the hosts the runtime needs.

Keep a short list

Typical allowlist: your model provider, api.securemyagent.ai, your package registry, your git host. Everything else needs approval.

Verify

curl -sS -m 5 https://example.com -o /dev/null -w '%{http_code}\n'

Expect a failure. Pro: Guard enforces the allowlist per tool call and blocks payloads that match fingerprints of your secrets.