What
- Bash, PowerShell, and Monitor tool calls can now include an
allowed_domainsfield listing hosts (plain domain, wildcard, or IP, each with an optional port) that a sandboxed command is allowed to reach. In auto mode this list is reviewed together with the command by the auto-mode classifier and applied for that one command; in any other mode it's ignored. - The list is checked against anti-spoofing rules that reject loopback/IPv4-mapped addresses and canonical-form mismatches.
- If a command carries an
allowed_domainslist but wouldn't actually run inside a confining sandbox, execution is now refused outright instead of silently running unconfined. When it does run sandboxed, the list is registered with the sandbox manager for the life of the process and unregistered on exit or error, via newregisterCommandNetworkLists/unregisterCommandNetworkListssandbox functions. - A new canned deny response short-circuits network classification for hosts not in the command's
allowed_domains, returning the message "not in this command's allowed_domains — re-run the command with this host listed if it needs it" instead of running the full classifier. - The whole capability is gated behind the
tengu_flickering_rainflag plus sandboxing being enabled, and applies to both Bash and PowerShell's input validation.
Why
This gives the model a way to ask for specific extra network access a sandboxed command needs (for example, to reach a particular API) without disabling sandbox network confinement altogether, while making sure the allowlist is only honored when a real sandbox is actually enforcing it.
Names in the bundleallowed_domains
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Use Claude Science on a corporate network touched a line naming allowed_domains after this was published.
Configuring a mirror removes the public package hosts from the sandbox's network allowlist and admits the mirror host in their place, so a misconfigured mirror fails with an error that names the mirror rather than falling back to the publi…claude-science/corporate-networks see the edit
Confirmed since
Anthropic's documentation has since written up allowed_domains, on Claude Code changelog.
* Added per-command `allowed_domains` to Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone; other hosts are refusedchangelog see the edit
Flag reading moved
The flag server now returns on for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns off for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns on for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns off for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns on for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns off for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns on for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns off for tengu_flickering_rain, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowed_domains, on Claude Code changelog.