Generate deniedTools and network.allow rules to block agent CLI and HTTP access.
npx skills add https://github.com/brwse/earl --skill secure-agent
Please help me install this Agent Skill. Skill: secure-agent Source: https://github.com/brwse/earl/tree/main/skills/development/secure-agent Command: npx skills add https://github.com/brwse/earl --skill secure-agent
Prevents AI agents from bypassing Earl by blocking direct CLI/HTTP access and restricting outbound network destinations, turning advisory guidance into enforceable platform-level controls.
Apply secure-agent to generate a proposed deniedTools array and corresponding Earl network.allow rules from your current templates and prompt me for approval before applying them.
High-intent search queries and answers about installing and using this skill.
To block Claude Code from using curl or gh directly, you can generate a deniedTools array and merge it into your platform config, preventing the agent from executing direct CLI commands and forcing traffic through your managed templates.
Network egress rules for MCP-capable agents are network.allow entries in Earl's config that restrict which external hosts templates may contact, turning advisory guidance into enforceable platform-level controls to prevent unauthorized outbound network destinations.
You can restrict outbound network destinations by creating network.allow rules in Earl's config and verifying enforcement by running earl doctor and testing denied commands to ensure agents cannot reach unauthorized hosts.
secure-agent works with Cursor and Windsurf in addition to Claude Code, applying platform-level tool restrictions and network egress rules to any MCP-capable agent project using Earl to block direct CLI or unrestricted HTTP calls.
To safely merge deniedTools into .claude/settings.json, the tool merges the array without overwriting unrelated settings and avoids duplicate entries, requiring explicit user approval before writing any changes to the config file.
Blocking direct HTTP calls is necessary because AI agents can accidentally or habitually bypass Earl by using tools like curl or stripe directly, and applying platform-level deniedTools turns advisory guidance into enforceable controls.
brwseInstall and configure the Earl CLI for agent API access.
mathematic-incConfigures agent permissions and restricts network access via NACL rules.
mathematic-incScan codebases and replace raw API/CLI calls with Earl templates.
LSDIPPOLLCConfigure Copilot permission boundaries for agent tools and PreToolUse hooks.
