Use case · Protect

# My agent sent our code to a paste site in a URL. *Block paste sites, or allow only the hosts you list.*

Protect checks the host in each fetch and shell command before it runs, and each host a sandbox program connects to. It refuses 19 known paste and drop sites. Turn on "block other sites" and the gateway refuses each host a call names that is not on your list.

[Get started free](https://console.context-mode.com/login) [Read the docs](https://context-mode.com/docs/protect#sites)

Your agent tries

Paste site Hidden in a URL Site not on list Host built in code Your localhost Site on your list

The agent fetches a paste site with your code in the URL.

Blocked · never runs **Known paste and drop sites**

19 hosts and their subdomains, such as pastebin.com, transfer.sh, 0x0.st and webhook.site. On in Balanced and Locked down.

```
WebFetch https://pastebin.com/raw/x
host: pastebin.com · rule: Known paste and drop sites
```

The paste site hides inside another URL.

Blocked · never reaches your shell **Known paste and drop sites**

Protect reads nested URLs and refuses the call on the inner host.

```
curl https://r.jina.ai/https://pastebin.com/x
inner host: pastebin.com
```

Hosts are also found in git remotes, nc, ssh, openssl and /dev/tcp.

A site nobody put on the list. Other sites: block.

Blocked · never runs **Other sites**

Every host a call names must match an allow entry.

```
Only approved sites are allowed, and example.com is not on the list
```

The answer from a real probe under Locked down.

A script hides the host in code. The decoded host is pastebin.com.

Blocked · the connection is refused **Known paste and drop sites**

Code your agent runs in the gateway sandbox. Protect checks each host the program really connects to, against your block entries.

```
fetch(atob(x))
connects to: pastebin.com
```

Your own dev server, while other sites are blocked.

Runs **localhost is exempt**

Local calls run, so tests against your app still work.

```
curl http://localhost/health
```

A host on your list. Allow entry: github.com and subdomains.

Runs **Sites: github.com**

The host matches an allow entry, so the clone runs. evilgithub.com never matches github.com.

```
git clone https://github.com/acme/app
```

The problem

## A URL can carry your code out. *One call is enough.*

**The agent fetches without asking**

A web fetch or a `curl` looks like normal work, and it runs at once.

**Paste sites are where data lands**

A host such as pastebin.com or webhook.site takes whatever the agent sends.

**The host is not always in plain sight**

It can sit inside another URL, in a git remote, or in a script that builds it in code. Protect reads the inner host: `curl https://r.jina.ai/https://pastebin.com/x` is refused on pastebin.com.

How it works

## Every host is checked. *Before the call runs.*

1. 01 **Pick a preset or write Sites rules** Balanced and Locked down block the paste sites. Add a Sites rule by host, by host and subdomains, or by IP range, with an optional port.
2. 02 **Turn on "block other sites"** Locked down does this for you. Then every host a call names must be on your allowlist (an allow entry). localhost stays open.
3. 03 **Protect reads each call** It finds hosts in commands, web fetches, tool-server inputs and nested URLs. A blocked call never runs, and the agent reads why.

**Your agent**Asks to run `curl r.jina.ai/https://pastebin.com/x`.

→

**Context Mode · Protect**Checks every host in the call before the client runs it.

- Finds the inner host: pastebin.com
- Matches "Known paste and drop sites"
- Writes the block to the decision log, with the host and no command text

→

**The model**Reads the refusal and why. Nothing leaves for the paste site.

Your agent asks for the call. Protect, in blue, finds the host inside the URL and refuses it on the gateway. The request to the paste site is never made.

Proof

## Tested on production. *With the limits written down.*

**19 hosts** paste and drop sites blocked, with their subdomains, in Balanced and Locked down

**5 network cases** in the 103 matrix cases of the production run, all passing

### Where Protect checks the host

| Where the call runs | What Protect does | Limit |
| --- | --- | --- |
| Shell commands and web fetches | Reads hosts in `curl` , git remotes, `nc` , `ssh` , `openssl` , `/dev/tcp` and nested URLs | A host built at run time is not read; with "block other sites" on, it is refused |
| Gateway sandbox ( `context-mode-run-code` ) | Checks each host the program really connects to, so `fetch(atob(x))` to a blocked host is caught | Gets your block entries only; "block other sites" is decided at the gateway |
| Local scripts ( `context-mode-run-local` ) | Reads the code first; a guard in the script checks URLs against your block entries | The guard is advisory: a hostile program can get around it |
| Tool servers | Decides which servers and tools the agent may call, and reads hosts in their inputs | A server's own network traffic is not controlled |

Without "block other sites", the paste-site rule slows a leak and does not stop it. Data sent in a query string or DNS lookup is not caught, and pushes to unknown remotes are not covered yet. [Method and sources →](https://context-mode.com/blog/protect-rules-for-coding-agents)

Products used

## What this *uses.*

**[Protect](https://context-mode.com/protect)**

Rules for every tool call, checked before your client runs it. In every plan; off until you turn it on.

**[Protect docs](https://context-mode.com/docs/protect)**

Sites rules, the presets, where each check runs, and the limits.

**[The test report](https://context-mode.com/blog/protect-rules-for-coding-agents)**

How we tried to get past the rules, and the 126 checks.

**[Plans](https://context-mode.com/pricing)**

Start free. On Team, one policy covers every member, and an agent cannot loosen it.

Related: [Block .env and secrets](https://context-mode.com/use-cases/block-env-secrets) · [Secure coding agents](https://context-mode.com/solutions/secure-coding-agents) · [For security teams](https://context-mode.com/solutions/security-teams)

## Block paste sites. *Allow only your list.*

*npx @context-mode/cli* connects your agents. 1,000 requests free, no card.

[Get started free →](https://console.context-mode.com/login) [Read the docs →](https://context-mode.com/docs/protect#sites)