VibhorGautam

Egressmap — AI skill for Claude Code

AI community

See every server your AI coding agent talks to, live on a 3D globe.

How to install Egressmap

This entry records only its repository, not the path inside it, so there is no exact command to give. Open VibhorGautam/egressmap and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Egressmap does

See every server your AI coding agent talks to, live on a 3D globe. Block the ones you didn't allow.

Alternatives in AI

Hol Guard — Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, M 485 ★
Prismor — Self-hosted runtime control plane for AI agents 334 ★
Dsh Auto Review — Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns stru 155 ★

README

egressmap

See every server your AI coding agent talks to, live on a 3D globe. Anything you didn't allow gets blocked.

![egressmap demo](docs/demo.gif)

npx egressmap claude

That's it. Your agent runs exactly like before, and a dashboard opens on `127.0.0.1:7070` showing every connection it makes: where it goes, which process made it, how many bytes left your machine. When you quit, you get a summary in the terminal:

egressmap  claude  ran 45s
  ✗ webhook.site                       blocked x1  ← node setup.js
  ✓ registry.npmjs.org                 Toronto, CA          3 conn  6.8 KB up  83.5 KB down
  ✓ api.anthropic.com                  San Francisco, US    2 conn  1.3 MB up  29.3 KB down
  3 servers · 6 connections · 1 blocked

Tested with Claude Code and the tools it spawns (npm, curl, node). It should work with anything that respects the standard proxy variables, like Codex CLI, Gemini CLI or aider. If yours doesn't show up on the map, it's ignoring the proxy (see below).

npx egressmap codex
npx egressmap --allow api.stripe.com claude
npx egressmap --watch -- npm install      # observe only, block nothing

How it works

egressmap starts a small forward proxy on 127.0.0.1 and launches your command with HTTP_PROXY, HTTPS_PROXY and NODE_USE_ENV_PROXY=1 pointing at it. Child processes inherit them.
HTTPS goes through CONNECT tunnels. TLS is never intercepted, so egressmap sees the destination host and byte counts, never the content.
Every destination is checked against an allowlist. Hosts that aren't on it get a 403 and show up red.
Tunnels have to be TLS, and the server name in the TLS handshake has to match the host that was allowed, so an allowed host can't be used to front for a different site on the same IP. Only port 443 is open for tunnels and port 80 for plain HTTP unless you allow host:port.
A blocked hostname is never resolved. A subdomain can carry stolen data (c2VjcmV0.attacker.com), so o