Control where your agents connect
Inventory every destination, approve the ones an agent needs.
Securd sees every outbound agent connection: MCP servers, model APIs, tools, data sources. Scope, approve or block each one without installing anything in the agent.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 14:02:11 | accept | research-agent | api.openai.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:11 | accept | research-agent | api.tavily.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:14 | greywall | research-agent | cdn-assets-sync.top | 10.40.2.17 | first seen, held 24h |
| 2026-09-15 14:02:14 | block | research-agent | dns.google | 10.40.2.17 | category: DoH provider |
| 2026-09-15 14:02:19 | threat | research-agent | update-check.pw | 10.40.2.17 | feed: c2-indicators |
| 2026-09-15 14:02:31 | accept | finance-agent | api.stripe.com | 10.40.3.8 | allow list |
An agent with open DNS has an open exit
Every tool call, model call and data fetch starts with a name lookup. Give an agent an unrestricted resolver and every prompt injection, poisoned tool description and compromised dependency has a road out. Blocklists cannot cover destinations that did not exist yesterday, and egress firewalls do not know which agent asked.
Agents choose their own destinations
A model decides what to fetch at runtime. The developer who wrote the agent did not approve that list and cannot see it.
Firewalls see addresses, not agents
An egress rule permits port 443 to the internet. It cannot say that the invoice agent may reach the ERP and nothing else.
In-agent controls switch off
Sandbox allowlists and proxy settings live inside the runtime. A flag, a config change or a jailbroken model turns them off.
One resolver policy per agent role
Point resolution at Securd
A pod dnsConfig, a container dns entry, a VPC option set, or a DoH virtual site for workstations and CI. Minutes, no code.
Watch the inventory fill
Within a day the policy shows every hostname the agent touched: model APIs, MCP servers, tools, data sources, and the ones you did not expect.
Set scope, turn on the hold
Approve what belongs. Block what does not. Set Greywall Mode to Enforce so new destinations wait for you. Every decision becomes an event.
What the policy gives you
Policy per agent role
Each policy carries its own allow list, block list, categories and first-seen baseline. Approvals for one agent never widen another.
Greywall hold
A name the policy has never resolved is held for the configured time. Approve it, block it, or let the policy decide when the hold expires.
Scope lists with provenance
Every list entry records its source, a reference and an optional expiry. Import vendor-documented templates for model providers, tools and MCP servers.
Threat feeds and categories
Bring your own feeds in STIX, CSV, TXT or JSON. Block the five security categories and the DoH provider category on every agent policy.
Events, not samples
Every resolution is logged with site, name, action, reason, categories and establishment rank. Forward over syslog, export CEF or JSON, or subscribe to webhooks.
API and change log
Create policies, approve held names and push verdicts with scoped API keys. Every configuration change is recorded with who, when and what, and can be rolled back.
The agent cannot turn it off
Policy is applied by the resolver, not by code the agent runs. A jailbroken agent, a poisoned MCP server or an operator running with approvals disabled gets the same answers as before. A held or blocked name resolves to the policy block page address, so application code can tell a hold from an outage and escalate instead of retrying.
- api.openai.com
- api.anthropic.com
- api.tavily.com
- api.smith.langchain.com
- pastebin.com
- transfer.sh
Questions teams ask
Does this replace my egress firewall?
No. Securd governs which named services each policy may resolve. The firewall governs addresses and ports. Keep it, restrict port 53 to the Securd resolvers, and feed it Securd events.
What does the agent see when a destination is held?
A DNS answer containing the policy block page address rather than a timeout. Code can compare the answer against that address. Reference guards for Python, TypeScript, Go, Java, .NET and Rust are in the developer library.
How is this different from a newly-seen-domains category?
Those categories are global and based on the vendor telemetry, and they allow by default once a domain ages. The Greywall baseline belongs to your policy, the hold is yours to set, and nothing ages into allow unless your policy says so.
Evaluate Agent DNS with your own agent traffic
Deploy one agent on one policy in Learn Only and review what it reached for.