0 Fork 0

Files

T

yinyues2 c64ed98eb1 claude-egress-guard 1.0.0

Fail-closed egress gate for Claude Code on Linux, packaged as an agent skill.

- binary-level gate at /usr/local/bin/claude and /usr/bin/claude with the real
  binary pinned under /opt/claude-real, so cron, Python, systemd and absolute
  paths are covered
- exit address and country checked before every start; mismatch or timeout
  refuses with exit 77 and never falls back to a direct connection
- optional kernel jail (systemd scope, IPAddressDeny=any) for the whole process
  tree, with loopback, proxy upstream, DNS resolvers and operator CIDRs allowed
- self-heal after package updates that rewrite /usr/bin/claude
- installer with dry-run, backups and uninstall; verify/verify --deep/status/drill
- sandboxed self-test suite, shellcheck and leak scanner in CI

2026-10-27 01:19:22 +08:00

2.2 KiB

Raw Permalink Blame History

Privacy

Short version

This project collects nothing. There is no telemetry, no analytics, no crash reporting, no update check, and no network call that is not the operator's own proxy probe.

What stays on your host

Everything. The installer writes only:

/etc/claude-egress-guard.conf — proxy URL, expected exit address, country, allow list. Mode 0600, root-owned.
/usr/local/{bin,sbin,lib} — the gate, the checker, the CLI.
/opt/claude-real/claude — a symlink to the package binary.
/var/lib/claude-egress-guard/backup/ — copies of whatever the installer replaced.

No file leaves the host. No file is uploaded by any component. The backslash backup directory can contain a proxy URL with credentials if your proxy endpoint embeds them — treat it as sensitive and remove it with uninstall when done.

Network calls

The only outbound requests are made by the host, through the proxy you configure, and only to the endpoints in your config:

TRACE_URL — default https://www.cloudflare.com/cdn-cgi/trace, a generic CDN edge trace used to read the public exit address. It does not reach any AI provider.
FALLBACK_URL — default https://ipinfo.io/json, used only when the trace endpoint fails.

Both are plain GETs. They send no identifiers, no account data, and no request bodies. You can point them at any equivalent endpoint.

claude-egress-guard verify --deep additionally requests https://example.com/ twice: once directly (it must fail, which proves the jail blocks egress) and once through the proxy (it must succeed). Both requests are made by the host you run it on, carry no identifiers, and go to a reserved documentation hostname.

This repository and CI

The repository contains no operator data. Examples use documentation address space (RFC 5737) and example.com.
CI runs shellcheck, the sandboxed self-test and a leak scan. It has no access to any deployment and holds no secrets beyond the default GITHUB_TOKEN with read-only permissions.

Filing an issue

Redact before posting:

public IP addresses (replace with 203.0.113.x),
proxy URLs and credentials,
hostnames and account identifiers,
full config files.

Paste the verify summary and the failing line only.

2.2 KiB Raw Permalink Blame History