How do I restrict which sites my AI coding agent can reach on the network?

What should I check, step by step?

1. List the hosts the task needs (package registry, git host, your API, model provider) and allow only those; leave broad domains such as all of github.com off unless the task needs them, because an allowed domain is also a place data can be sent.

2. Claude Code: set sandbox.enabled, add network.allowedDomains, and set strictAllowlist (user, managed or --settings) so unlisted hosts are refused instead of prompted. Set allowUnsandboxedCommands to false and failIfUnavailable to true so commands can't fall back to running outside the sandbox.
3. Claude Code for a team: put the sandbox keys in managed settings with allowManagedDomainsOnly, so only the managed allowlist counts and a repository's .claude/settings.json can't widen it.
4. Codex CLI: keep the default workspace-write sandbox with network_access off. If a task needs the network, turn on network_access together with features.network_proxy and domain allow rules; without the proxy, enabled network access is unrestricted.
5. GitHub Copilot cloud agent: keep the firewall enabled, review the recommended allowlist, add only the custom hosts you need, and as an organization owner consider turning off repository custom rules.
6. Block cloud metadata and private ranges: Claude Code's sandbox proxy refuses hostnames that resolve only to local addresses such as 169.254.169.254, and Codex's proxy blocks loopback, link-local and private destinations by default; confirm the same for any custom setup.
7. Cover what the agent's filter doesn't: MCP servers, hooks and other helper processes run outside these filters, so give them their own network limits or run the whole agent in a container or VM with an egress firewall.
8. Test it: from inside the agent, try a host that isn't allowed (Claude Code's docs suggest curl --noproxy '*' https://example.com) and confirm it fails, and watch the blocked-host warnings the tools report.

What each agent filters, and what it doesn't

Claude Code: the sandbox covers Bash, PowerShell and Monitor commands and the processes they start. Its docs say the file and web tools, command hooks, local MCP servers and other helper processes run outside it, and WebFetch follows permission rules instead of allowedDomains. On Linux and WSL2 sandboxed commands run in a separate network namespace; on macOS Seatbelt blocks connections other than the one to the sandbox proxy.

• Codex: the network proxy filters scripts, programs and child processes in the local command sandbox. Its docs say it does not filter web search, app or connector tool calls, MCP server connections, browser or Computer Use activity, cloud tasks, or the client's own model and authentication requests.
• GitHub Copilot cloud agent: the firewall applies only to processes the agent starts through its Bash tool, not directly to MCP server processes or configured setup steps, and only inside the runner or sandbox where Copilot works. GitHub says sophisticated attacks may bypass it and that it is not a comprehensive security solution.

Why hostname allowlists are not the whole answer

The built-in proxies decide from the hostname the client asks for. Claude Code's docs warn that because its proxy does not inspect TLS by default, code inside the sandbox could use domain fronting or similar techniques to reach hosts outside the allowlist, and that allowing broad domains such as github.com creates paths for data exfiltration.

• Codex's docs say its DNS check reduces DNS rebinding risk but does not eliminate it, and recommend enforcing egress controls at a lower layer too if hostile DNS is in scope. Anthropic's reference dev container does that with an init-firewall.sh script that limits the container's outbound traffic.