# Hosts/IPs the container is allowed to reach outbound, one per line.
# Blank lines and lines starting with '#' are ignored. Mount this file at
# /etc/agent/egress-allowlist.txt; it takes precedence over
# $AGENT_ALLOWED_EGRESS. If neither is set, outbound traffic is denied.
#
# The documented default supports ChatGPT-account authentication and the
# `codex_apps` MCP integration, both of which need all three hosts.
api.openai.com
auth.openai.com
chatgpt.com
