Egress Ledger: see and block every network call your local agent's tools make

The basic idea of an egress proxy that understands agent traffic is already covered by free open-source tools: Pipelock, Claw Patrol and agentwall. OpenClaw and NVIDIA's NemoClaw also have built-in hooks or sandboxing for it. So a plain allowlist proxy has no edge. The opening that remains is a polished desktop app, like Little Snitch for agents, that any OpenClaw-style user can install in one step. It would link each outbound host to the specific tool call that caused it, hold unknown domains for one-click approval, and work for people who don't write config files. Today's tools are aimed at developers or production systems, are early alpha, or only run on Linux. The Privacy Receipt has a real but thin gap. Pipelock already produces signed evidence, but nobody turns it into a plain-English weekly report that university or small-office compliance staff can file, so it should be sold as part of the proxy, not as a separate product. The Trace Replay Pack looks unclaimed, but it rests on one public Cohere trace, so it works best as a free tool that draws people to the proxy. The main risk is that Pipelock, Claw Patrol or OpenClaw itself adds per-tool approval and a nicer interface within months. Any lead would come from user experience and distribution, not technology.

• Pipelock (luckyPipewrench)

  Open-source egress firewall for agent HTTP, WebSocket and MCP traffic. It scans for leaked secrets and personal data, checks tool descriptions for tampering, and issues receipts signed outside the agent process. It overlaps Egress Ledger and Privacy Receipt directly. Its listings don't mention per-tool allowlists or a human approval step.

• Claw Patrol (Deno)

  Open-source (MIT, alpha) proxy that sits in front of OpenClaw. It inspects traffic byte by byte, enforces rules kept in config files, injects credentials so agents never see them, and holds risky actions for approval by a person in Slack or an AI judge. It is aimed at teams running agents against production systems, not desktop users.

• agentwall

  Open-source proxy with deny, approve, redact and allow verdicts. It ties each connection to the process that opened it, not to the tool call, and only runs on Linux.

• OpenClaw network proxy setting

  OpenClaw can send all its traffic through a proxy the user supplies and says that is where allowlists should be enforced. It doesn't ship a proxy itself, which leaves an obvious slot for a third-party product.

• NVIDIA NemoClaw

  Runs OpenClaw in a sandbox that blocks all outbound connections except endpoints listed in its policy files. It's a big-company deny-by-default option, but it has no per-tool ledger or one-click approval.

• OrcaRouter MCP gateway

  Hosted MCP gateway that checks every tool call against a default-deny allowlist and supports host and IP rules for where each tool may connect. It is a gateway service, not a local desktop proxy.

• Cohere Qwen3.8 trace disclosure

  The October 2026 report behind this idea. It released a single trace on Hugging Face and recommends blocking outbound traffic by default and enforcing policy at the tool call. I found no product that replays such traces against your own model and setup.

Checked 2026-10-27