Module net 

Outbound-request policy: which URLs an agent-driven fetch may reach.

Agents fetch URLs the model chose, and the model chose them from context an attacker can influence - search results, a page fetched a moment ago, a task description pasted from an issue. Handing such a URL straight to an HTTP client turns the agent into a confused deputy sitting inside the user’s network: http://169.254.169.254/latest/meta-data/iam/security-credentials/ returns cloud credentials, http://127.0.0.1:3000/api/agents is the user’s own Leviath API, and http://192.168.1.1/ is their router.

check_url is the gate. It runs before the request and again on every redirect hop, because a public URL that answers 302 Location: http://169.254.169.254/ reaches exactly the same place.

What this does not cover

A hostname is resolved here and then resolved again by the HTTP client when it connects. A DNS entry with a very short TTL that answers publicly the first time and privately the second slips through that window - classic DNS rebinding. Closing it needs a custom connector that dials the exact address this module approved, which the shared blocking client cannot express today. The check still stops every direct attempt (literal IPs, hostnames that resolve privately, and redirects), which is the whole of the reachable surface for a model that is picking URLs rather than running an attack.

Structs

ClientTimeouts

The floor every outbound HTTP client in the workspace gets.

Enums

UrlRejection

Why a URL was refused. Rendered into the tool result the model sees, so it says what to do differently rather than just failing.

Functions

check_url

Check one URL against the outbound policy.

checked_client

client

A client with the shared floor applied, built.

client_builder

A reqwest client builder carrying the shared timeout floor and a redirect cap.

is_restricted_addr

Whether addr is outside the public internet, and so off-limits to a fetch whose URL an agent chose.