Outbound network

By default, an agent’s sandbox can reach any address on the internet. To allow only the hosts the agent needs, add an [egress] table to the agent’s opencomputer.toml and deploy again:

schema = 1
id = "support"
name = "Support"

[egress]
allow = [
  "api.github.com",   # exact domain
  "example.com",      # exact domain
  "*.example.com",    # wildcard: every subdomain, not example.com itself
  "203.0.113.10",     # IP address
  "10.20.0.0/16",     # CIDR
]

Every process in the sandbox is held to the list: commands, sandbox_exec, background jobs, and anything they start. Connections to anything else are refused.

What each entry allowsCopy Anchor Link

• A wildcard does not cover its own domain. "*.example.com" allows api.example.com and a.b.example.com, not example.com. To reach both, list "example.com" and "*.example.com".
• Domains cover HTTPS on port 443 only. Plain http://, other ports, and non-TLS protocols to a domain are refused. To reach those, list the destination’s IP address or CIDR instead.
• Domains are matched on the TLS server name. The connection goes to the allowed host whatever IP address the client picks, so pointing an allowed name at another address does not reach that address.
• DNS lookups are not filtered. Names outside the list still resolve; the connection is what is refused. Resolvers other than the sandbox’s own are blocked.
• Platform hosts are always allowed. The sandbox can always reach OpenComputer and the storage it loads your agent from, so you never list them.

allow = [] (or an [egress] table with no allow) allows nothing beyond the platform hosts. Without an [egress] table the network stays open.

RulesCopy Anchor Link

• Up to 64 domains and 64 IP addresses or CIDRs.
• Domains take no scheme, port or path. "https://api.github.com" and "api.github.com:443" are rejected. A bare "*" is rejected; remove the [egress] table instead.
• A bare IP address means that single address (/32 or /128).

An invalid entry stops the deploy before anything is uploaded:

opencomputer.toml [egress] allow entry "https://api.github.com" is not a domain ("api.github.com", "*.example.com"), IP address or CIDR; leave out schemes, ports and paths

The API rejects it too, with 400 invalid_egress, if you call POST /v1/deployments directly. There the allowlist is "egress": { "domains": [...], "cidrs": [...] }; the CLI splits allow into these two lists for you.

Fixed IP addressesCopy Anchor Link

To have the sandbox’s traffic leave from a fixed set of IP addresses, for example so a customer can allowlist your agent, set fixed_ips to a region:

[egress]
fixed_ips = "au"

All of the sandbox’s outbound traffic then leaves from that region’s addresses. A region can have more than one; successive tool calls take turns between them, so allowlist every address the region lists. The regions and their addresses are public:

curl https://managedagents.opencomputer.dev/v1/egress-ips

{ "regions": { "au": { "ipv4": ["209.71.97.179", "209.71.110.167"] }, ... } }

• fixed_ips works with or without allow. With both, the sandbox reaches only the allowed hosts, and reaches them from the fixed addresses.
• If the region’s addresses are unreachable, the sandbox has no network rather than falling back to other addresses.
• The region of fixed_ips is independent of the agent’s region; pick the same one to keep latency down.

An unknown region stops the deploy, and the API answers 400 invalid_fixed_ips to "fixedIps": "<region>" on POST /v1/deployments.

Changing the listCopy Anchor Link

A change applies to sandboxes started after the deploy. A sandbox that is already running keeps the list it started with until it stops. Each agent in a project has its own opencomputer.toml, so agents in one project can have different lists.

The list covers the agent’s sandbox. Model calls, and MCP servers the agent connects to, are made by OpenComputer outside the sandbox and are not held to it.