Egress Leash: deny-by-default network jail for agent sandboxes, now with escape logs

Open-source outbound proxy that blocks agent network escapes and logs them; agent startups pay for hosted logs.