{"id":"6544fe4a-46e4-4806-b6d3-f24ae37b7043","task":"Configure sandbox network egress with a firewall NetworkPolicy — deny all traffic, allow only specific domains, or allow/deny specific subnets — including credential-brokered transformation and forwarding rules.","domain":"vercel.com","steps":["Set the base mode at creation: `Sandbox.create({ networkPolicy: 'allow-all' })` (default, permits all egress) or `Sandbox.create({ networkPolicy: 'deny-all' })` (blocks all egress including DNS resolution). Docs: https://vercel.com/docs/sandbox/sdk-reference#networkpolicy-class","Restrict to specific domains: `networkPolicy: { allow: ['ai-gateway.vercel.sh', 'google.com'] }`. Matching is SNI-based (TLS only): exact match unless the domain uses a wildcard segment (`www.*.com` matches one segment; `*.google.com` matches any subdomain but not the bare `google.com`).","Allow/deny specific IP ranges alongside domain rules: `networkPolicy: { allow: [...], subnets: { allow: ['10.0.0.0/8'] } }` or `{ subnets: { deny: ['10.0.0.0/8'] } }` — `subnets.deny` always takes precedence over `subnets.allow` and domain-based `allow` entries.","To inject credentials into brokered requests without exposing secrets to the sandbox, define a `transform` rule with headers: `{ allow: { 'ai-gateway.vercel.sh': [{ transform: [{ headers: { 'x-api-key': 'secret-key' } }] }] } }` (Pro/Enterprise only — this intercepts TLS to alter requests).","Update an already-running sandbox's policy: `await sandbox.update({ networkPolicy: 'deny-all' })` (applies to current and future sessions); the older `sandbox.updateNetworkPolicy()` method still works but is deprecated in favor of `update()`.","From the CLI, use flags on `sandbox create`: `--network-policy deny-all`, `--allowed-domain <domain>`, `--allowed-cidr <cidr>`, `--denied-cidr <cidr>`."],"gotchas":["Transformation (transform) and forwarding (forwardURL) rules require additional plan permissions (Pro/Enterprise) — plain domain allow lists do not intercept encryption, but adding transform/forwardURL rules does, which is why they are permission-gated.","`deny-all` blocks even DNS resolution, not just HTTP(S) — code that depends on DNS lookups will fail entirely, not just fail to connect.","Only TLS (SNI-based) traffic is currently supported for domain matching; plain HTTP or non-TLS protocols cannot be domain-filtered this way — use `subnets.allow`/`subnets.deny` for non-TLS traffic instead.","When encryption is intercepted for `transform`/`forwardURL` rules, requests from custom Docker containers running inside the sandbox will fail TLS verification unless you install the sandbox's per-sandbox proxy CA certificate into the container's own trust store."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T01:32:39.349Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T01:32:39.349Z"},"url":"https://mcp.waymark.network/r/6544fe4a-46e4-4806-b6d3-f24ae37b7043"}