.NET: Semantic Kernel

using System.ComponentModel;
using System.Net;
using Microsoft.SemanticKernel;

public sealed class SecurdHeldException(string msg) : Exception(msg);

public static class SecurdGuard
{
    static readonly HashSet<string> BlockAddrs =
        (Environment.GetEnvironmentVariable("SECURD_BLOCK_ADDRS") ?? "")
        .Split(',', StringSplitOptions.RemoveEmptyEntries).ToHashSet();

    public static async Task CheckAsync(string host, string agentRole)
    {
        IPAddress[] answers;
        try { answers = await Dns.GetHostAddressesAsync(host); }
        catch { throw new SecurdHeldException($"{host} did not resolve inside {agentRole}"); }
        if (answers.Any(a => BlockAddrs.Contains(a.ToString())))
            throw new SecurdHeldException($"{host} is held or blocked for {agentRole}");
    }
}

public sealed class WebPlugin(HttpClient http)
{
    [KernelFunction, Description("Fetch an approved URL")]
    public async Task<string> Fetch(string url)
    {
        var host = new Uri(url).Host;
        try { await SecurdGuard.CheckAsync(host, "ops-agent"); }
        catch (SecurdHeldException e) { return "BLOCKED: " + e.Message; }
        return await http.GetStringAsync(url);
    }
}