Egress allowlist

Beta — the MCP Gateway is open source and on npm: npx -y @mcp-rating/gateway. Source →

A server that can phone home is a server that can exfiltrate. Under container isolation (L2), the Gateway can limit which hosts a server reaches. At the default level (L1), the network is not restricted.

How it works

  • Each server's capability manifest sets a network mode: none, allowlist or all.
  • none starts the container with no network at all. This is the only mode that stops a determined server.
  • allowlist routes the container's HTTP(S) traffic through an egress proxy, which refuses hosts not on the list and records the attempt in the audit trail.

What an allowlist does not stop

The proxy works because well-behaved HTTP clients (Node's fetch, axios, Python requests) honour HTTP_PROXY/HTTPS_PROXY. A program that opens raw sockets, or a binary that ignores those variables, is not filtered. Treat an allowlist as a guard rail against honest code. For untrusted code, use none.

Example manifest

{
  "network": { "mode": "allowlist", "allow": ["api.github.com", "github.com"] }
}

Under L2, a GitHub server's HTTP requests can reach GitHub and nothing else. A request to evil.example.com is refused and logged as an egress_blocked event.

See also