Skip to content

Releases: canerinali/egress-tap

Release list

v0.1.0

v0.1.0 Latest
Latest

Choose a tag to compare

View all tags
@canerinali canerinali released this 29 Sep 08:34
v0.1.0
1f063a2

First release.

egress-tap runs your AI coding agent (Claude Code, Codex, or anything that honours HTTP(S)_PROXY) once behind an observe-only local proxy, then turns the log into a least-privilege network allowlist.

  • Observe: one JSON line per connection (host:port, bytes, duration). No TLS interception, no CA, nothing blocked.
  • Emit: Claude Code sandbox.network.allowedDomains JSON or a Codex permission profile. Wildcards only when 3+ hosts share a base domain, never on shared hosting (*.github.io, *.vercel.app, ...).
  • Flag: random-looking subdomains, IP literals, paste/tunnel services and odd ports are reported with the reason and never auto-allowlisted.

Try it without any login: examples/fake-agent/run.sh.

Known blind spots (see README): binaries that ignore proxy env vars, raw sockets, git over SSH, DNS tunnelling, URL paths.

Install: npm i -g github:canerinali/egress-tap (Node >= 22).

Assets 2
Loading