Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
☄️ go-out - A Golang egress buster.
Simple plug-and-play Github Action to block unauthorized outbound traffic (egress) in your Github workflows
PowerShell scripts/GUI tools for the enterprise to harden Windows Defender Firewall via group policy (GPO). These can be used to enforce network level application whitelisting and strengthen the security posture of devices to defend against attacks such as software supply chain and can be used with privileged access workstations (PAW).
Find what egress ports are allowed
Secure GitHub actions with 1 line of code
Secure-by-default OpenClaw on Ubuntu, with a verifiable security report
Container Egress Traffic Filter with a GitHub Actions wrapper.
tethered — Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.
[Azure Blueprint] Learn how to deploy Azure Managed Hub-Spoke using Virtual WAN and Calico Networking
Run any project or coding agent in a sandboxed, egress-firewalled, non-root container. Drop in a config, run sluice.
Deploy a firewall that should allow or drop traffic based on customisable rules
Lightweight egress guard for servers.
Network simulation and security testing platform with 13 supported protocols, red team arsenal, active defense and traffic simulators
Linux eBPF network kill switch for vpn apps an beyond
Disposable, hardened Docker sandbox for running untrusted code & deploying safely — read-only root, dropped Linux capabilities, and a whitelist egress proxy so malicious deps can't read your keys or phone home.
Guardrails to stop data exfiltration from AI coding agents
Hierarchical Claude Code containers with one curated egress bridge: a root control plane, a sealed node tree, per-node live internet/GitHub switches, and desktop-app SSH access.
Agent-specific network egress guardrail. Wraps untrusted LLM agent runtimes so they can't exfiltrate data or hold real secrets — the only route out is a default-deny proxy that swaps placeholder tokens for real secrets at the edge.
Add a description, image, and links to the egress-filtering topic page so that developers can more easily learn about it.
To associate your repository with the egress-filtering topic, visit your repo's landing page and select "manage topics."