Per-session egress visibility for AI coding agents

Know what your agent does with the network.

AI coding agents run shell commands, fetch pages, and install packages on your machine. If one is tricked — by instructions hidden in a page or repository it reads — it can quietly call attacker-controlled servers or send your .env and your tokens somewhere you never intended. EgressEye sits in your harness and answers one question after every tool call.

Get started GitHub ↗

egress-eye report — session 20261028-2359-1a2b

EgressEye — session 20261028-2359-1a2b Tool calls inspected: 3 3 URLs contacted — 1 flagged (malicious 1, suspicious 0) — 1 unknown — 1 allowlisted — 1 secret finding MALICIOUS http://stage-logs-collect-9f3.top/gate.php URL · listed in openphish (openphish) 1× Bash SECRET DB_H…(8 chars) Text contains 4 UPPER_SNAKE= assignments — looks like… 1× Bash unknown https://telemetry-ingest-9d3.example/beacon No signals — not in known-malicious feeds, no heurist… (none) 1× Bash

The last row is the point: unknown means unknown. EgressEye never pretends that "not on a blocklist" means safe — that honesty is the product.

Verdicts in plain words

MALICIOUS

On a blocklist. The URL or its host appears in a downloaded mirror like OpenPhish or URLhaus — checked entirely in memory, on your machine.

suspicious

A deterministic rule matched. Lookalike domains (gihub.com), punycode tricks, embedded credentials, brand-new domains registered days ago, raw-IP URLs.

clean

Known-good infrastructure. The domain is part of a curated allowlist of ~90 development essentials — npm, GitHub, PyPI, and friends.

unknown

No signals either way. We don't guess. This is the honest default — and the reason session-level patterns matter more than verdicts alone.

What it catches

Inspection happens before every tool call, on everything the harness sends: commands, tool arguments, file contents the agent writes.

Known-malicious URLs — including defanged ones like hxxp://evil[.]top hidden in scripts the agent writes

Lookalike domains — typosquats, punycode, homoglyphs, raw IP literals

Throwaway infrastructure — domains registered days ago, found via RDAP

Credentials in tool calls — AWS/GitHub/OpenAI/Slack tokens, JWTs, private keys, connection strings, pasted .env files — always redacted on disk

Sharded exfiltration — many small sends to the same host aggregate into one finding that per-request tools structurally miss

Failed attempts too — post-tool-use failures are recorded; a blocked exfil try is still signal

Honest limits

EgressEye is a visibility tool, not a sandbox.

A determined compromised agent can bypass hooks. Unknown URLs with no signals stay unknown. Anything that never passes through a tool call — raw sockets, other processes — is invisible to any hook-based tool.

We publish the complete bypass list instead of hiding it. A security tool that hides its limits is marketing, not security.

Read the full bypass table →

What leaves your machine

EgressEye is local-first by design — and so is this website: no JavaScript, no analytics, no third-party requests.

Data	Where it goes	Default
Blocklist checks	In memory, against a downloaded mirror — looked-up URLs never leave the machine	local
URLs on disk	Query-stripped session log under ~/.egress-eye/	local
Secrets	Redacted at creation: 4-character preview + length, nothing more	local
Domain age	RDAP registrar queries for a looked-up URL's registrable domain	opt-out
Google Safe Browsing	Looked-up URLs are sent to Google	opt-in

One engine, five harnesses

Each adapter drives the same detection engine; install is one command after a clone.

ZCode · full fidelity

egress-eye init zcode

Claude Code

egress-eye init claude-code

Codex · Windows-safe deny

egress-eye init codex

Hermes (Nous Research)

egress-eye init hermes

OpenCode

egress-eye init opencode

DeepSeek Harness · researched

feasibility doc in /docs

Get started

bash — three commands, then work normally

$ git clone https://github.com/offenselabs/EgressEye && cd EgressEye $ npm install && node dist/cli.js init zcode # pick your harness $ node dist/cli.js update-feeds # mirror the blocklist once # … use your agent normally … $ node dist/cli.js report --last # see what happened

Requires Node 20+. Report-only by default — it never blocks unless you set EGRESS_EYE_BLOCK=1, and then only on feed-confirmed hits. Under the hood: zero runtime dependencies, 70/70 unit tests, a 39-scenario eval corpus, CI on Linux and Windows.