Agent Firewall module

[bpmct]

A discussion dedicated to the Agent Firewall module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	15 / 25	20 / 20	0 / 20	8 / 10	56 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for multiple major modes: coder subcommand (default), compile from source, use directly, inline config, external config path, with Claude Code as automated task, with Claude Code as coder_app, with Codex. Each has sensible defaults.
Coder-context framing	8	1	README states "Installs agent-firewall for network isolation in Coder workspaces" and mentions Coder deployment domain, but does not explain what agent-firewall adds on top of Coder or show where Coder fits in the flow. The module description is minimal.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	10	README documents Agent Firewall support extensively (the module IS agent-firewall). Examples show integration with Claude Code and Codex. Includes detailed MCP subprocess workaround documentation. No AI Gateway support documented. Agent Firewall alone earns half (5), but since this module's entire purpose is Agent Firewall governance, full credit awarded.
Dashboard entry point	5	5	README provides documented coder_app example for Claude Code with agent-firewall wrapper in "As a Coder app" section.
Session continuity	5	0	No documentation of resuming sessions or using persistent session managers. The coder_app example uses tmux but does not document session continuity or resume behavior.
Managed configuration	5	0	Module manages agent-firewall config, not agent/MCP/IDE config. No documentation of managed agent settings, policies, or workdir config.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. No README examples with inline secrets.
Non-hardcoded auth path	4	4	Module does not handle authentication credentials. Agent-firewall operates on network isolation, not auth. N/A would apply, but scoring generously as the module avoids credential handling entirely.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL for agent-firewall. When compile_agent_firewall_from_source=true, hardcoded https://github.com/coder/boundary.git. When use_agent_firewall_directly=true, hardcoded install script URL https://raw.githubusercontent.com/coder/boundary/main/install.sh. No variable to point these to internal mirrors.
Bring-your-own binary	5	0	No documented way to skip installation when agent-firewall is pre-baked. The default mode uses coder subcommand (no install), but this is not documented as a bring-your-own-binary path for restricted environments.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (github.com, anthropic.com, openai.com in config template) but not consolidated for restricted environments.
Runs without sudo	2	0	install.sh.tftpl line 88-89: sudo cp boundary /usr/local/bin/agent-firewall and sudo chmod +x /usr/local/bin/agent-firewall when compiling from source. Line 92 uses sudo in install script. Sudo required for core compilation and direct installation modes. No documented no-sudo path.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Inputs have descriptions. agent_firewall_version has sensible default "latest". Validation exists for mutual exclusivity of agent_firewall_config and agent_firewall_config_path. However, several inputs lack validation: agent_firewall_version accepts any string without format validation, module_directory has no path validation. Descriptions are clear but some could be more detailed.
Test coverage	4	4	Clear testing story. .tftest.hcl covers business logic: required vars, compile from source, use directly, custom hooks, custom module directory, inline config, config path, mutual exclusivity validation. TypeScript tests in main.test.ts cover end-to-end: terraform state, installation modes, config handling, wrapper execution, idempotency, custom hooks.

Overall — 56 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.