{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/constrain-the-coding-agent-s-network-path",
  "id": "MHC-D-RESEARCH-0666",
  "version": "0.1.0",
  "title": "Constrain the coding agent's network path",
  "summary": "Network access turns local context into a possible exfiltration and supply-chain path.",
  "kind": "protocol",
  "body": "Use an allowlist, firewall or equivalent egress policy appropriate to the task. Review blocked-request warnings rather than disabling controls reflexively. Give dependency registries and required services explicit access; keep unrelated destinations unavailable.",
  "limits": [
    "Network controls have blind spots, especially through external tools or setup processes; combine them with tool permissions and context minimization."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-8674BC9BAE58A529",
    "RS-1C68AE8325C384C0"
  ],
  "evidence": [
    {
      "claim": "GitHub's Copilot agent firewall provides network egress controls and blocked-request visibility while documenting that its coverage does not extend to every process or MCP path.",
      "source_id": "RS-8674BC9BAE58A529",
      "role": "supports",
      "note": "A firewall is one layer; external tools, setup steps and MCP servers need their own trust and permission controls.",
      "locator": "Firewall behavior and limitations"
    },
    {
      "claim": "OWASP's current secure-coding-with-AI guidance treats repository content, issues, PRs, comments, fetched pages, logs and tool responses as potential indirect prompt-injection inputs for coding agents.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "Threat likelihood depends on who can influence the content and what permissions the agent has.",
      "locator": "Indirect Prompt Injection in the Development Loop"
    }
  ],
  "use_when": [
    "An agent can fetch arbitrary internet resources or send data to any host during coding."
  ],
  "avoid_when": [
    "Network controls have blind spots, especially through external tools or setup processes; combine them with tool permissions and context minimization."
  ],
  "example": "A build can reach the approved package registry but a new curl request to an unknown host is blocked and investigated.",
  "check": "The agent cannot silently turn arbitrary repository content into arbitrary outbound requests.",
  "steps": [
    "Required hosts identified.",
    "Default egress policy known.",
    "Unexpected destinations blocked or reviewed.",
    "Blocked attempts visible.",
    "Exceptions time-bounded or justified."
  ],
  "sources": [
    {
      "id": "RS-8674BC9BAE58A529",
      "title": "Customizing or disabling the firewall for GitHub Copilot",
      "url": "https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-the-firewall"
    },
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0666",
      "to": "MHC-D-RESEARCH-0667",
      "type": "useful_with",
      "url": "/knowledge/audit-an-mcp-server-before-giving-it-repository-context"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}