Python: CrewAI

# securd_guard.py
# Held and blocked names resolve to the policy's block page address.
# Put that address (from the console, Sites > your site) in SECURD_BLOCK_ADDRS.
import os
import socket
import logging

SECURD_BLOCK_ADDRS = {a for a in os.getenv("SECURD_BLOCK_ADDRS", "").split(",") if a}
log = logging.getLogger("securd")


class SecurdHeld(Exception):
    """Destination is held at the Greywall or blocked by the policy for this agent role."""


def securd_guard(hostname: str, agent_role: str) -> None:
    try:
        answers = {info[4][0] for info in socket.getaddrinfo(hostname, 443)}
    except socket.gaierror as exc:
        log.warning("securd.unresolved", extra={"agent_role": agent_role, "host": hostname})
        raise SecurdHeld(f"{hostname} did not resolve inside {agent_role}") from exc
    if answers & SECURD_BLOCK_ADDRS:
        log.warning("securd.held", extra={"agent_role": agent_role, "host": hostname})
        raise SecurdHeld(f"{hostname} is held or blocked for {agent_role}")

from urllib.parse import urlparse
import httpx
from crewai.tools import BaseTool
from securd_guard import securd_guard, SecurdHeld

class GuardedHttpTool(BaseTool):
    name: str = "http_get"
    description: str = "GET a URL this crew is approved to reach."
    agent_role: str = "sales-crew"

    def _run(self, url: str) -> str:
        host = urlparse(url).hostname or ""
        try:
            securd_guard(host, self.agent_role)
        except SecurdHeld as held:
            return f"BLOCKED: {held}"
        return httpx.get(url, timeout=20).text[:8000]