# Starter egress allowlist for groundcrew agent runs.
#
# Loaded by @clipboard-health/clearance via CLEARANCE_ALLOW_HOSTS_FILES.
# Add hosts in alphabetical order (numeric-aware: sa9 before sa10).
#
# Extend this file with hosts your project's agents need to reach
# (your VPN, internal staging domains, etc.). Wildcards (e.g. *.example.com)
# are supported.

# AI provider APIs
ab.chatgpt.com
api.anthropic.com
api.openai.com
auth.openai.com
chatgpt.com
claude.ai
console.anthropic.com
docs.anthropic.com
docs.claude.com
downloads.claude.ai
pi.dev
platform.claude.com

# Cursor (cursor-agent: composer, grok models). Wildcard covers the numbered API hosts
# (api2, api2direct, api3, repo42, ...) the CLI rotates through.
*.cursor.sh
cursor.com
www.cursor.com

# Hosted MCP servers + their auth/web hosts
api.linear.app
api.notion.com
api.slack.com
app.incident.io
developers.notion.com
developers.openai.com
linear.app
mcp-proxy.anthropic.com
mcp.datadoghq.com
mcp.devin.ai
mcp.incident.io
mcp.linear.app
mcp.notion.com
mcp.slack.com
slack.com

# Datadog (logs/metrics queries). No wildcard — blocks http-intake.logs.*.
api.datadoghq.com
app.datadoghq.com
datadoghq.com
docs.datadoghq.com

# GitHub + GHA artifact storage (Azure blobs)
api.github.com
cafe.github.com
codeload.github.com
github.com
productionresultssa0.blob.core.windows.net
productionresultssa1.blob.core.windows.net
productionresultssa2.blob.core.windows.net
productionresultssa3.blob.core.windows.net
productionresultssa4.blob.core.windows.net
productionresultssa5.blob.core.windows.net
productionresultssa6.blob.core.windows.net
productionresultssa7.blob.core.windows.net
productionresultssa8.blob.core.windows.net
productionresultssa9.blob.core.windows.net
productionresultssa10.blob.core.windows.net
productionresultssa11.blob.core.windows.net
productionresultssa12.blob.core.windows.net
productionresultssa13.blob.core.windows.net
productionresultssa14.blob.core.windows.net
productionresultssa15.blob.core.windows.net
productionresultssa16.blob.core.windows.net
productionresultssa17.blob.core.windows.net
productionresultssa18.blob.core.windows.net
productionresultssa19.blob.core.windows.net
raw.githubusercontent.com
release-assets.githubusercontent.com
results-receiver.actions.githubusercontent.com

# npm/Conda registries + package websites
api.npmjs.org
conda.anaconda.org
registry.npmjs.org
www.npmjs.com

# PyPI registry + package CDN (pip / uv). pypi.org serves the Simple index;
# files.pythonhosted.org serves the wheel/sdist artifacts. uv's managed-Python
# downloads come from github.com (already allowed above).
files.pythonhosted.org
pypi.org

# Google APIs
developers.google.com
www.googleapis.com

# Developer tooling
app.terraform.io
buf.build
cdn.playwright.dev
cloud.nx.app
fastdl.mongodb.org
formulae.brew.sh
hub.docker.com
index.docker.io
json.schemastore.org
mise-versions.jdx.dev
nx.dev
playwright.azureedge.net
registry.terraform.io
releases.hashicorp.com
sourcegraph.com
vitest.dev