Egress Leash: deny-by-default network jail for agent sandboxes, now with escape logs

The core of Egress Leash is already common infrastructure. That core is a proxy outside the sandbox that swaps real keys for scoped ones and enforces an egress allowlist. Vercel, Modal, Docker, LangSmith, Blaxel and Tencent CubeSandbox all ship it. Open-source versions exist in iron-proxy, Anthropic's sandbox-runtime and Pipelock. Vercel has also integrated it directly with Harbor, the Key Broker's named target customer. Capped keys that expire per run are a native feature of OpenRouter's management API and are offered by Exo, OrcaRouter and agentgateway. So the Key Broker on its own is a thin wrapper that harness maintainers can script in an afternoon. The one part I found nobody offering is alerting on key use from unexpected call sites, but that feature is narrow. Write Hold is less covered but not empty. Pipelock offers approval prompts, signed receipts and replay. Onyx describes a mitmproxy design with ALWAYS/ASK/DENY policies. I found no packaged rule pack aimed at indie browser and computer-use agents that is method-aware and category-based, for example holding POSTs to .gov, police, payment and form endpoints while allowing GETs. A curated, maintained ruleset of that kind is a plausible niche. It is easy to copy and hard to charge indie developers for. The Sandbox Violations Board is the clearest white space. Searches turned up incident write-ups, such as the OpenAI ExploitGym and Hugging Face breakout, and security checklists, but no public leaderboard ranking models on attempts to misuse keys or get around egress rules. It needs a large installed base of logs to be credible, and those logs would have to come from the open-source proxy. A new entrant's realistic path is probably to give the proxy away free and portable across sandbox providers. Most current options only work on their own platform, and iron-proxy only supports Docker. The aim would be to collect the data for the violations board and sell curated rule packs or a hosted dashboard. Charging agent teams for the proxy itself is weak when their sandbox providers already bundle it. I ran 9 searches, so this list probably isn't complete. A few sources are second-hand, including the CubeSandbox write-up, a Docker workshop page on collabnix rather than Docker's own docs, and the Onyx design.

• Vercel Sandbox firewall (credential brokering)

  Egress firewall outside the VM that terminates TLS and adds secrets to matching outbound requests, so keys never enter the sandbox. Vercel has an official Harbor/Terminal-Bench integration that uses it, which goes straight at the Key Broker's target customer. Credential transforms require Pro or Enterprise.

• Vercel Sandbox x Harbor integration

  Harbor tasks get per-task network policies enforced at the sandbox firewall, plus optional credential injection. This covers much of the Key Broker pitch for Harbor users.

• Modal Sandbox Secret Injection

  Outbound Policy adds auth headers to HTTPS requests for specific domains, with the swap happening outside the sandbox. Harbor runs on Modal.

• Docker Sandboxes egress proxy

  Every Docker sandbox routes traffic through an egress proxy that injects credentials and enforces allowed domains.

• LangSmith agent sandbox auth proxy

  LangChain's auth proxy injects credentials and controls network access for LangSmith sandboxes.

• Blaxel sandbox egress control

  Outbound allowlisting with server-side injection of auth headers for agent sandboxes.

• Tencent CubeSandbox Credential Vault

  Open-source sandbox whose CubeEgress proxy adds host-held keys to outbound HTTPS. Policies live in the control plane. This description comes from a third-party write-up, not the project's own docs.

• iron-proxy (Hermes Agent)

  Open-source host daemon from Nous Research's Hermes Agent. It terminates TLS, swaps a sandbox proxy token for the real credential and enforces an upstream allowlist. Only the Docker backend is wired up so far; Modal, Daytona, SSH and Singularity are not.

• Anthropic sandbox-runtime (srt)

  Apache-2.0 sandbox used by Claude Code. Host-side HTTP and SOCKS5 proxies enforce domain allow and deny lists. It does no key swapping and has no per-method write rules.

• Pipelock

  Open-source (Apache 2.0 core) agent firewall and egress proxy. It scans HTTP, MCP, A2A and WebSocket traffic for exfiltration and SSRF, emits signed action receipts, offers human approval prompts and has replay features in its dashboard. This is the closest overlap with Write Hold.

• Onyx Craft egress proxy

  Described as a mitmproxy-based egress gateway with per-action ALWAYS/ASK/DENY policies, where risky actions pause for approval before the credential is attached. This is essentially the Write Hold design.

• OpenRouter management (provisioning) API keys

  Native API for creating keys programmatically with credit limits and disabling them instantly. A harness can already mint a capped key per run and revoke it afterwards with a few lines of code.

• Exo LLM gateway

  Gives agent pods short-lived virtual keys instead of real provider keys, with session_budget_usd capping spend per minted key, meaning per run.

• OrcaRouter

  Gateway enforces a spend cap and expiry on each key, plus a separate per-run cost circuit breaker.

• agentgateway

  Open-source gateway with token budgets per API key or user over a time window.

Checked 2026-10-11