basitalisandhu

MCP Egress — Development skill for Claude Code

Development community

Record every host an MCP server contacts, per tool, and fail CI on new ones.

How to install MCP Egress

This entry records only its repository, not the path inside it, so there is no exact command to give. Open basitalisandhu/mcp-egress and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MCP Egress does

Record every host an MCP server contacts, per tool, and fail CI on new ones. Runs a stdio MCP server behind an embedded CONNECT proxy, records host, port and tool for initialize, tools/list and sample calls, writes egress.json, prints Claude Code WebFetch rules and a sandbox allowlist, and warns when a server bypasses proxy variables.

Alternatives in Development

MCP Proxy — A bridge between Streamable HTTP and stdio MCP transports 2.4k ★
Obsidian MCP Server — Read, write, search, and surgically edit Obsidian vault notes, tags, and frontmatter via MCP 686 ★
Pubmed MCP Server — Search PubMed/Europe PMC, fetch articles and full text (PMC/EPMC/Unpaywall), citations, MeSH terms via MCP 150 ★

README

mcp-egress: record every host an MCP server contacts, per tool

Run a stdio MCP server behind a small recording proxy and get the exact set of hosts it contacts while you run `initialize`, `tools/list` and sample tool calls. Every host is attributed to the phase and the tool that reached it, written to `egress.json`, printed as a table, and printed again as two ready-to-paste blocks: Claude Code `WebFetch(domain:host)` permission rules and a sandbox allowed-domain list. Keep the file as a baseline and `--check` fails CI the day a tool starts talking to a host nobody declared.

[![CI](https://github.com/basitalisandhu/mcp-egress/actions/workflows/ci.yml/badge.svg)](https://github.com/basitalisandhu/mcp-egress/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](pyproject.toml)

Why

Tool calls reach hosts nobody declared. An MCP server's README says it talks to one API; the server is free to talk to anything, and a tool whose definition changed after you installed it can start sending data somewhere new without any visible change in behaviour. People are fighting this by hand: there is an open request to [auto-allowlist MCP server domains for code execution network egress](https://github.com/anthropics/claude-code/issues/70644) in Claude Code, and [eight open reports](https://github.com/anthropics/claude-code/issues/93562) that the sandbox egress allowlist is ignored or collapses to a built-in list. One security checklist for MCP puts it plainly: keep a per-server allowlist of outbound hosts, because [a new outbound host is the most reliable signal of a rug pull](https://corgea.com/learn/mcp-security-best-practices). An enterprise scorer reported in July 2026 that [184 popular MCP servers changed their tool definitions after publication](https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw).

Static scanners read the c