Source URL: https://simonwillison.net/2025/Sep/19/httpjail/#atom-everything
Source: Simon Willison’s Weblog
Title: httpjail
Feedly Summary: httpjail
Here’s a promising new (experimental) project in the sandboxing space from Ammar Bandukwala at Coder. httpjail provides a Rust CLI tool for running an individual process against a custom configured HTTP proxy.
The initial goal is to help run coding agents like Claude Code and Codex CLI with extra rules governing how they interact with outside services. From Ammar’s blog post that introduces the new tool, Fine-grained HTTP filtering for Claude Code:
httpjail implements an HTTP(S) interceptor alongside process-level network isolation. Under default configuration, all DNS (udp:53) is permitted and all other non-HTTP(S) traffic is blocked.
httpjail rules are either JavaScript expressions or custom programs. This approach makes them far more flexible than traditional rule-oriented firewalls and avoids the learning curve of a DSL.
Block all HTTP requests other than the LLM API traffic itself:
$ httpjail –js “r.host === ‘api.anthropic.com’" — claude "build something great"
I tried it out using OpenAI’s Codex CLI instead and found this recipe worked:
brew upgrade rust
cargo install httpjail # Drops it in `~/.cargo/bin`
httpjail –js "r.host === ‘chatgpt.com’" — codex
Within that Codex instance the model ran fine but any attempts to access other URLs (e.g. telling it "Use curl to fetch simonwillison.net)" failed at the proxy layer.
This is still at a really early stage but there’s a lot I like about this project. Being able to use JavaScript to filter requests via the –js option is neat (it’s using V8 under the hood), and there’s also a –sh shellscript option which instead runs a shell program passing environment variables that can be used to determine if the request should be allowed.
At a basic level it works by running a proxy server and setting HTTP_PROXY and HTTPS_PROXY environment variables so well-behaving software knows how to route requests.
It can also add a bunch of other layers. On Linux it sets up nftables rules to explicitly deny additional network access. There’s also a –docker-run option which can launch a Docker container with the specified image but first locks that container down to only have network access to the httpjail proxy server.
It can intercept, filter and log HTTPS requests too by generating its own certificate and making that available to the underlying process.
I’m always interested in new approaches to sandboxing, and fine-grained network access is a particularly tricky problem to solve. This looks like a very promising step in that direction – I’m looking forward to seeing how this project continues to evolve.
Via Fine-grained HTTP filtering for Claude Code
Tags: http, javascript, proxies, sandboxing, security, v8, rust, claude-code, codex-cli
AI Summary and Description: Yes
Summary: The text discusses an experimental project called httpjail, which provides a Rust CLI tool aimed at enhancing process-level network isolation and filtering HTTP(S) traffic for coding agents like Claude Code and Codex CLI. It presents a novel approach to sandboxing and fine-grained network access control, making significant strides toward more secure interactions with external services.
Detailed Description:
The httpjail project, created by Ammar Bandukwala at Coder, focuses on improving security through enhanced sandboxing for applications, specifically for coding agents that utilize Large Language Models (LLMs) such as Claude Code and OpenAI’s Codex. The tool embodies several innovative features that will be particularly relevant for professionals in security, compliance, and software engineering.
– **Core Functionality**:
– httpjail acts as an HTTP(S) interceptor and provides process-level network isolation.
– The tool operates under default settings where all DNS traffic is allowed, but all other non-HTTP(S) traffic is denied.
– **Flexible Rules**:
– Users can create their filtering rules using JavaScript or custom programs, making the tool more adaptive compared to traditional firewalls that use static rules.
– An example command demonstrates the blocking of all HTTP requests except for those targeting specific LLM API endpoints.
– **Usage**:
– The author shares a practical experience by testing httpjail with OpenAI’s Codex CLI to filter HTTP requests, illustrating its functionality to block unwanted URLs.
– **Advanced Features**:
– It integrates with Linux systems through nftables, establishing explicit rules to deny additional network access.
– Users can run the tool in a Docker environment, allowing for isolated network access strictly to the httpjail proxy server.
– The tool is capable of intercepting and logging HTTPS requests by generating its SSL certificate for the intercepted traffic.
– **Implications for Security**:
– The project represents a promising development in sandboxing techniques, potentially improving the security posture of software that interacts with various web services.
– This approach may appeal significantly to developers and security professionals interested in protecting applications from unauthorized internet access, thereby reducing risks.
– **Future Prospects**:
– As the project is still in its early stages, there’s potential for further enhancements and developments that could solidify its utility and relevance in the realms of AI security and broader application security landscapes.
Overall, httpjail stands out as a significant tool that could shape how developers address network isolation and security, especially with the increasing reliance on AI and coding agents.