> ## Documentation Index
> Fetch the complete documentation index at: https://opencomputer.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://opencomputer.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://opencomputer.manicule.dev/api/mcp.
> Every agent surface: https://opencomputer.manicule.dev/.well-known/llms-manifest.json

# Outbound network (/agents/egress)

<!-- agent-signals: reading_time_min: 4 · est_tokens: 1196 · updated: 2026-10-21 -->
Related: [Serverless Agents](/agents/overview.md), [How it works](/agents/mental-model.md), [Quickstart](/agents/quickstart.md), [Projects and agents](/agents/projects.md), [Reactive agents](/agents/reactive-agents.md), [Sessions and turns](/agents/sessions.md)

> Allow an agent's sandbox to reach only the hosts it needs

By default, an agent's sandbox can reach any address on the internet. To allow
only the hosts the agent needs, add an `[egress]` table to the agent's
`opencomputer.toml` and deploy again:

```toml
schema = 1
id = "support"
name = "Support"

[egress]
allow = [
  "api.github.com",   # exact domain
  "example.com",      # exact domain
  "*.example.com",    # wildcard: every subdomain, not example.com itself
  "203.0.113.10",     # IP address
  "10.20.0.0/16",     # CIDR
]
```

Every process in the sandbox is held to the list: commands, `sandbox_exec`,
background jobs, and anything they start. Connections to anything else are
refused.

## What each entry allows

| Entry                               | Allows                                                             |
| ----------------------------------- | ------------------------------------------------------------------ |
| `"api.github.com"`                  | HTTPS (TLS on port 443) to that host                               |
| `"*.example.com"`                   | HTTPS to any subdomain, at any depth, but not `example.com` itself |
| `"203.0.113.10"`, `"2001:db8::1"`   | any protocol and port to that address                              |
| `"10.20.0.0/16"`, `"2001:db8::/32"` | any protocol and port to that range                                |

* **A wildcard does not cover its own domain.** `"*.example.com"` allows
  `api.example.com` and `a.b.example.com`, not `example.com`. To reach both,
  list `"example.com"` and `"*.example.com"`.
* **Domains cover HTTPS on port 443 only.** Plain `http://`, other ports, and
  non-TLS protocols to a domain are refused. To reach those, list the
  destination's IP address or CIDR instead.
* **Domains are matched on the TLS server name.** The connection goes to the
  allowed host whatever IP address the client picks, so pointing an allowed
  name at another address does not reach that address.
* **DNS lookups are not filtered.** Names outside the list still resolve; the
  connection is what is refused. Resolvers other than the sandbox's own are
  blocked.
* **Platform hosts are always allowed.** The sandbox can always reach
  OpenComputer and the storage it loads your agent from, so you never list
  them.

`allow = []` (or an `[egress]` table with no `allow`) allows nothing beyond the
platform hosts. Without an `[egress]` table the network stays open.

## Rules

* Up to 64 domains and 64 IP addresses or CIDRs.
* Domains take no scheme, port or path. `"https://api.github.com"` and
  `"api.github.com:443"` are rejected. A bare `"*"` is rejected; remove the
  `[egress]` table instead.
* A bare IP address means that single address (`/32` or `/128`).

An invalid entry stops the deploy before anything is uploaded:

```text
opencomputer.toml [egress] allow entry "https://api.github.com" is not a domain ("api.github.com", "*.example.com"), IP address or CIDR; leave out schemes, ports and paths
```

The API rejects it too, with `400 invalid_egress`, if you call
`POST /v1/deployments` directly. There the allowlist is
`"egress": { "domains": [...], "cidrs": [...] }`; the CLI splits `allow` into
these two lists for you.

## Fixed IP addresses

To have the sandbox's traffic leave from a fixed set of IP addresses, for
example so a customer can allowlist your agent, set `fixed_ips` to a region:

```toml
[egress]
fixed_ips = "au"
```

All of the sandbox's outbound traffic then leaves from that region's
addresses. A region can have more than one; successive tool calls take turns
between them, so allowlist every address the region lists. The regions and
their addresses are public:

```bash
curl https://managedagents.opencomputer.dev/v1/egress-ips
```

```json
{ "regions": { "au": { "ipv4": ["209.71.97.179", "209.71.110.167"] }, ... } }
```

* `fixed_ips` works with or without `allow`. With both, the sandbox reaches
  only the allowed hosts, and reaches them from the fixed addresses.
* If the region's addresses are unreachable, the sandbox has no network rather
  than falling back to other addresses.
* The region of `fixed_ips` is independent of the agent's `region`; pick the
  same one to keep latency down.

An unknown region stops the deploy, and the API answers `400 invalid_fixed_ips`
to `"fixedIps": "<region>"` on `POST /v1/deployments`.

## Changing the list

A change applies to sandboxes started after the deploy. A sandbox that is
already running keeps the list it started with until it stops. Each agent in a
project has its own `opencomputer.toml`, so agents in one project can have
different lists.

The list covers the agent's sandbox. Model calls, and MCP servers the agent
connects to, are made by OpenComputer outside the sandbox and are not held to
it.