Use case · Protect
My agent sent our code to a paste site in a URL. Block paste sites, or allow only the hosts you list.
Protect checks the host in each fetch and shell command before it runs, and each host a sandbox program connects to. It refuses 19 known paste and drop sites. Turn on "block other sites" and the gateway refuses each host a call names that is not on your list.
The agent fetches a paste site with your code in the URL.
19 hosts and their subdomains, such as pastebin.com, transfer.sh, 0x0.st and webhook.site. On in Balanced and Locked down.
WebFetch https://pastebin.com/raw/x
host: pastebin.com · rule: Known paste and drop sitesThe paste site hides inside another URL.
Protect reads nested URLs and refuses the call on the inner host.
curl https://r.jina.ai/https://pastebin.com/x
inner host: pastebin.comHosts are also found in git remotes, nc, ssh, openssl and /dev/tcp.
A site nobody put on the list. Other sites: block.
Every host a call names must match an allow entry.
Only approved sites are allowed, and example.com is not on the list
The answer from a real probe under Locked down.
A script hides the host in code. The decoded host is pastebin.com.
Code your agent runs in the gateway sandbox. Protect checks each host the program really connects to, against your block entries.
fetch(atob(x))
connects to: pastebin.comYour own dev server, while other sites are blocked.
Local calls run, so tests against your app still work.
curl http://localhost/health
A host on your list. Allow entry: github.com and subdomains.
The host matches an allow entry, so the clone runs. evilgithub.com never matches github.com.
git clone https://github.com/acme/app
A URL can carry your code out. One call is enough.
A web fetch or a curl looks like normal work, and it runs at once.
A host such as pastebin.com or webhook.site takes whatever the agent sends.
It can sit inside another URL, in a git remote, or in a script that builds it in code. Protect reads the inner host: curl https://r.jina.ai/https://pastebin.com/x is refused on pastebin.com.
Every host is checked. Before the call runs.
- 01Pick a preset or write Sites rules
Balanced and Locked down block the paste sites. Add a Sites rule by host, by host and subdomains, or by IP range, with an optional port.
- 02Turn on "block other sites"
Locked down does this for you. Then every host a call names must be on your allowlist (an allow entry). localhost stays open.
- 03Protect reads each call
It finds hosts in commands, web fetches, tool-server inputs and nested URLs. A blocked call never runs, and the agent reads why.
curl r.jina.ai/https://pastebin.com/x.- Finds the inner host: pastebin.com
- Matches "Known paste and drop sites"
- Writes the block to the decision log, with the host and no command text
Tested on production. With the limits written down.
Where Protect checks the host
| Where the call runs | What Protect does | Limit |
|---|---|---|
| Shell commands and web fetches | Reads hosts in curl, git remotes, nc, ssh, openssl, /dev/tcp and nested URLs | A host built at run time is not read; with "block other sites" on, it is refused |
Gateway sandbox (context-mode-run-code) | Checks each host the program really connects to, so fetch(atob(x)) to a blocked host is caught | Gets your block entries only; "block other sites" is decided at the gateway |
Local scripts (context-mode-run-local) | Reads the code first; a guard in the script checks URLs against your block entries | The guard is advisory: a hostile program can get around it |
| Tool servers | Decides which servers and tools the agent may call, and reads hosts in their inputs | A server's own network traffic is not controlled |
Without "block other sites", the paste-site rule slows a leak and does not stop it. Data sent in a query string or DNS lookup is not caught, and pushes to unknown remotes are not covered yet. Method and sources →
What this uses.
Rules for every tool call, checked before your client runs it. In every plan; off until you turn it on.
Sites rules, the presets, where each check runs, and the limits.
How we tried to get past the rules, and the 126 checks.
Start free. On Team, one policy covers every member, and an agent cannot loosen it.
Related: Block .env and secrets · Secure coding agents · For security teams
Block paste sites. Allow only your list.
npx @context-mode/cli connects your agents. 1,000 requests free, no card.