---
title: Restrict sandbox egress
description: Limit which hosts the sandbox reaches, and see what was blocked.
---
> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reeval.ai/llms.txt
> Use this file to discover all available pages before exploring further.

The `egress` option sets which hosts the sandbox can reach. The default is `'proxy'`: any host over HTTP and HTTPS, through the egress gateway, which records each request. Set `'deny-all'` to block every host except automatic hosts, or `{ allow: [...] }` to allow selected hosts in addition to them. Brokered harness credentials and secrets with `hosts` stay on the host either way, but a secret without `hosts` is in the sandbox as its real value. For more information, see [Secrets](/configuration/environments/secrets#keep-api-keys-on-the-host).

## Block non-automatic hosts

In the `evals/egress.eval.ts` file, set `egress` to `'deny-all'` on an environment:

```ts title="evals/egress.eval.ts"
import { defineEnvironment, evaluate, expect } from '{{ pkg }}'

const offline = defineEnvironment('offline', {
  files: {
    'src/user.ts': `import type { Request } from 'express'
export const getUserId = (req: Request) => req.params.id
`,
  },
  egress: 'deny-all',
})

evaluate(
  'adds a test without installing anything',
  { environment: offline },
  async (c) => {
    await c.send('Add a Vitest test for getUserId in src/user.test.ts.')
    await expect(c, 'writes the test').toHaveFile('src/user.test.ts')
  },
)
```

A restricted policy still lets through the hosts an attempt can't run without: the harness's own API, the `hosts` of each brokered secret, and each `http` or `sse` MCP server. reeval adds these automatic hosts to `'deny-all'` and to every allow list, and the plan prints them:

```bash
npx reeval run --dry-run
```

The `notes` column shows each evaluation's policy and its automatic hosts:

```text
egress: deny-all + auto: api.anthropic.com, *.anthropic.com
```

An evaluation or group's `egress` option overrides the environment's, which overrides the one in the `reeval.config.ts` file or a profile. A blocked request never fails the attempt on its own. The agent gets a refusal, and the assertions decide what that means.

## Read blocked requests

Run the evaluation to create a record.

```bash
npx reeval run
```

Each attempt's record holds its policy, the hosts it contacted, and the hosts the gateway refused. Print the record of the latest run and pick out the `egress` field of each attempt:

```bash
npx reeval show --json | jq '.evals[].attempts[].egress'
```

A refused request names the host and why it was blocked:

```json
{
  "policy": "deny-all",
  "allowed": ["api.anthropic.com", "*.anthropic.com"],
  "recorded": true,
  "contacted": [
    { "host": "api.anthropic.com", "port": 443, "connections": 3,
      "sent": 180882, "received": 25526 }
  ],
  "blocked": [
    { "host": "example.com", "port": 443, "connections": 1,
      "reason": "example.com isn't in the allowlist" }
  ],
  "expectedBlocked": []
}
```

The `allowed` list is every host the policy let through, the `allow` hosts and the automatic ones; it is `null` under `'proxy'` and `'allow-all'`. Hosts the harness's CLI always tries and never needs, such as its telemetry, are recorded in `expectedBlocked`; other refused requests remain in `blocked`. When you run `npx reeval run -v`, each blocked request also prints a `gateway` line as it happens. For more information, see [Debugging](/results/inspection/debugging).

## Choose another policy

Pass `{ allow: [...DEFAULT_EGRESS_ALLOW, 'example.com'] }` when the agent needs a few more hosts and still installs packages. Pass `'allow-all'` on the evaluations that need raw TCP or UDP, such as SSH, not in the `reeval.config.ts` file. For runnable projects, see [`with-egress-allowlist`](https://github.com/invertase/reeval/tree/main/examples/with-egress-allowlist) and [`with-egress-allow-all`](https://github.com/invertase/reeval/tree/main/examples/with-egress-allow-all). For each policy's rules, see [`egress`](/reference/options#egress).

## Reference

For more information about the `egress` option's shape and where it is accepted, see [Options](/reference/options#egress). For more information about the `egress` record's fields, see [Run record](/reference/run-record). For more information about the allow-list constant, see [`DEFAULT_EGRESS_ALLOW`](/reference/authoring-api#defaultegressallow).

For more information about egress enforcement, see [Sandbox](/reference/glossary#sandbox). For a runnable project, see [`with-egress-deny-all`](https://github.com/invertase/reeval/tree/main/examples/with-egress-deny-all).