Lock Down Which Hosts Your Claude Code Agents Can Reach: sandbox.network.strictAllowlist

TL;DR: Set sandbox.network.strictAllowlist: true in settings.json and sandboxed bash will silently deny any non-allowlisted host — no prompt, no approval loop, just a hard block at the network layer.

Shipped in Claude Code v2.1.219 (July 24), this setting closes a gap that's been quietly painful for teams running agents in CI: unexpected outbound connections either blocked the pipeline on a confirmation prompt or slipped through undetected. Now there's a third option — fail fast, silently, at the network layer.

The problem it solves

When strictAllowlist is off (the default), a sandboxed curl, pip install, or npm install to an unlisted host either:

• Prompts the user to approve — which hangs an unattended agent
• Succeeds, because the sandbox uses a soft allowlist by default

Neither is what you want in a CI pipeline or a fully autonomous agent run.

Configure it in 60 seconds

// .claude/settings.json
{
  "sandbox": {
    "network": {
      "strictAllowlist": true,
      "allowedDomains": [
        "api.github.com",
        "registry.npmjs.org",
        "files.pythonhosted.org",
        "pypi.org",
        "*.anthropic.com",
        "*.amazonaws.com"
      ]
    }
  }
}

What changes immediately:

• Any host not in allowedDomains → immediate connection refusal (no prompt, no log noise)
• The agent sees ECONNREFUSED or DNS failure, handles it as a tool error, and moves on
• CI pipelines no longer hang waiting for an approval that will never come

Build your allowlist

Start with the minimal set your workflows need, then expand as the agent hits blocks. Common additions:

Purpose	Domain
npm packages	registry.npmjs.org
PyPI packages	pypi.org, files.pythonhosted.org
GitHub API	api.github.com
Maven / Gradle	repo1.maven.org, plugins.gradle.org
Docker Hub	registry-1.docker.io
Your artifact store	*.s3.amazonaws.com or your CDN

When to keep it off

In local interactive sessions where you want Claude to pull documentation or hit arbitrary APIs, leave strictAllowlist: false (the default). Turn it on project-wide for CI deployments, or in an org-level settings.json to enforce egress control across all agents in your organization.

Sources: Claude Code changelog v2.1.219 · Claude Code sandboxing docs · Claude Code security docs