Rollcage

Control where your AI agents can send data

An agent that can read your code and reach the internet can send one to the other. The network guard checks the sites in every tool call, and a connection log shows where your agents' processes actually connect.

Why it matters

Agents read web pages, issues, READMEs and dependency code, and any of those can carry instructions written for the agent instead of for you. This is prompt injection, and the usual goal is to get the agent to upload something: a .env file, a database dump, your source. Closing the easy upload routes removes most of the payoff.

What is checked

  • URLs passed to the agent's fetch and web tools.
  • Shell commands that talk to the network: curl, wget, ssh, scp and nc.

The check runs in the same hook as the secrets and command Guard, for Claude Code, Codex CLI, Cursor and Gemini CLI.

Blocked by default

Sites that exist to move data somewhere anonymous: paste sites such as pastebin.com and termbin.com, file drops such as transfer.sh and file.io, request catchers such as webhook.site, and tunnels such as ngrok and trycloudflare.com. You can add and remove sites.

Allowed sites only

For stricter control, switch to allowed-sites-only mode. The list starts with the places development needs, such as GitHub, npm, PyPI, crates.io and the model providers, and the agent has to ask before reaching anything else.

The connection log

Separately from the hook, Rollcage samples the open sockets of every agent process and its helpers every few seconds and keeps a 30-day log of the addresses, per agent. It answers the question "what did that MCP server just connect to?"

The log is observation, not a firewall. Very short connections can be missed, and host names are best-effort, from known hosts and reverse DNS. Blocking happens in the hook, which sees the tool calls an agent makes but not connections opened by a program the agent wrote and ran. For hard network isolation, run the agent in a sandbox as well.

Questions

Is this a firewall?

No. It's a check on the agent's tool calls plus a log of connections. It stops the common routes, such as curl uploads and fetches to paste sites, without a network extension or a VPN profile.

Does the connection log send anything off my Mac?

No. The log stays on your Mac. The only network traffic it causes is ordinary DNS lookups to put names to addresses.

Which agents does it cover?

Blocking works with Claude Code, Codex CLI, Cursor and Gemini CLI. The connection log covers every detected agent, including Aider, OpenCode, Goose and Amp.

Keep reading