How OpenWork Manages and Enforces Outbound Access Controls for Enterprise Users

OpenWork enforces enterprise outbound access controls through a five-layer architecture that combines a declarative host manifest, runtime URL validation against RFC 1918 private ranges, a guarded fetch wrapper with redirect inspection, egress policy verification, and telemetry emission for every request.

OpenWork Den implements strict outbound access controls to prevent enterprise deployments from inadvertently contacting unauthorized external services or exposing internal infrastructure. Every HTTP request that leaves the backend undergoes multiple validation stages, from manifest-based host allowlisting to deep inspection of DNS-resolved IP addresses. This article examines the source code implementation in the different-ai/openwork repository to explain how these security boundaries are constructed and enforced.

The Five-Layer Security Architecture

The Den server processes outbound traffic through a defense-in-depth strategy comprising five distinct validation layers.

1. Declarative Host Manifest

The foundation of the policy is docs/enterprise/outbound-access.json, a JSON file serving as the single source of truth for allowed external hosts. Each entry defines the host, purpose, requirement level, and the effect if blocked:

{
  "host": "api.openai.com",
  "kind": "fetched",
  "components": ["renderer","server"],
  "purpose": "Direct OpenAI Realtime voice and image-generation calls when the user provides an OpenAI key.",
  "requirement": "opt-in",
  "blockedEffect": "Direct OpenAI voice or image features fail for users who configured OpenAI.",
  "override": null
}

Enterprise admins can modify this manifest via the Den UI, but the runtime guard checks every request against this baseline file before allowing network egress.

2. Runtime URL Validation

Before any external URL is stored or invoked, the system calls assertPublicUrl from ee/apps/den-api/src/capability-sources/url-guard.ts. This function implements the public-only rule:

• Rejects non-HTTPS URLs immediately
• Parses hostnames and blacklists private IP ranges (RFC 1918, link-local, loopback, multicast)
• Performs DNS resolution for domain names and verifies all resolved IPs are public
• Throws PrivateUrlError if any check fails

This prevents users from configuring MCP endpoints, OAuth clients, or tool-call URLs that point to internal infrastructure.

3. Guarded Fetch Wrapper

All outbound HTTP traffic routes through createGuardedFetch, exported from the same url-guard.ts file. This wrapper:

• Re-runs assertPublicUrl before each request and after every redirect
• Enforces HTTPS-only redirects; downgrades from HTTPS to HTTP abort with PrivateUrlError
• Disallows cross-origin redirects that would carry request bodies (protecting OAuth tokens and MCP arguments)
• Limits redirects to 5 hops maximum to prevent infinite loops

The MCP SDK throughout the Den codebase uses this wrapper exclusively to ensure consistent policy enforcement.

4. Egress Policy Enforcement

When a request is about to be transmitted, the Den loads OUTBOUND_ACCESS_MANIFEST in evals/packages/labs/src/egress.ts. The outboundManifestFromUnknown function consults this manifest to confirm the target host is explicitly allowed for the current tenant. If the host is missing or marked required-for-cloud without authorization, the request is blocked and returns a diagnostic message directing developers to the manifest file.

5. Telemetry and Fault Injection

For observability and testing, every outbound request emits an event with direction: "outbound" via packages/enterprise-mcp-mock-server/src/protocol/oauth-handler.ts. This allows the enterprise MCP mock server and egress lab tests to verify policy compliance and simulate fault conditions such as "blocked host" or "malformed-resource-metadata".

Implementation Examples

Validating User-Provided MCP Endpoints

When registering a new MCP server, enforce the public URL policy using the same guard internal to the Den:

import { assertPublicUrl } from "@/capability-sources/url-guard";

async function registerMcpEndpoint(rawUrl: string) {
  // Throws PrivateUrlError if URL is not HTTPS or resolves to private IP
  await assertPublicUrl(rawUrl);
  // Safe to persist
  await tenantConfig.set("mcpEndpoint", rawUrl);
}

Executing Outbound Requests Safely

Use the guarded fetch wrapper for all external API calls to ensure redirect safety and manifest compliance:

import { createGuardedFetch } from "@/capability-sources/url-guard";

const fetch = createGuardedFetch(); // Wraps global fetch

async function callExternalTool(url: string) {
  // Validates URL and all redirects automatically
  const response = await fetch(url, { method: "GET" });
  if (!response.ok) throw new Error(`Failed: ${response.status}`);
  return response.json();
}

Self-Hosted Override Configuration

For on-premises deployments requiring access to internal MCP servers, bypass the public URL restriction:

# Allow private IP addresses in self-hosted Den

export DEN_ALLOW_PRIVATE_MCP_URLS=1

When this environment variable is set, assertPublicUrl permits private addresses, useful for internal network integrations.

Summary

• Outbound access controls in OpenWork rely on a JSON manifest at docs/enterprise/outbound-access.json that defines all permissible external hosts.
• The assertPublicUrl function in ee/apps/den-api/src/capability-sources/url-guard.ts enforces HTTPS-only public endpoints by checking against RFC 1918 private ranges.
• createGuardedFetch provides a drop-in replacement for fetch that re-validates URLs during redirects and limits hops to 5.
• The egress policy engine in evals/packages/labs/src/egress.ts performs final allowlist verification before transmitting requests.
• Telemetry events emitted from packages/enterprise-mcp-mock-server/src/protocol/oauth-handler.ts enable testing and monitoring of policy adherence.

Frequently Asked Questions

What happens if a user attempts to connect an MCP server with a private IP address?

The assertPublicUrl function throws PrivateUrlError immediately upon validation. This error propagates to the user interface, preventing the configuration from being saved and blocking any attempt to enumerate internal infrastructure through the MCP connection.

How does OpenWork handle malicious redirects during outbound requests?

The createGuardedFetch wrapper re-applies assertPublicUrl validation after every redirect. If a redirect attempts to downgrade HTTPS to HTTP, targets a private IP, or exceeds 5 hops, the wrapper aborts the request and throws PrivateUrlError, preventing token or data exfiltration to attacker-controlled endpoints.

Can self-hosted enterprise deployments access internal MCP servers behind firewalls?

Yes. Setting the environment variable DEN_ALLOW_PRIVATE_MCP_URLS=1 disables the public-IP requirement in assertPublicUrl, allowing the Den to connect to RFC 1918 addresses and internal hostnames. This override applies only to the specific tenant configuration and does not affect the egress manifest validation layer.

Where is the canonical list of approved external endpoints maintained?

The single source of truth resides in docs/enterprise/outbound-access.json. This declarative manifest enumerates every permissible host, required components, and the business impact if access is blocked, ensuring enterprise admins have explicit control over their attack surface.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}