[moss_dog]

I was looking into this earlier -- presumably you'd also need to allowlist Claude itself (whatever endpoints it hits to run inference etc). VM firewall gets a little trickier with Claude's web search tool, too.

The solution I landed on recently was to locally modify the Chrome devtools MCP to launch the browser instance with strict network restrictions. I believe the implementation used `--host-resolver-rules`, blocking all URLs by default with an environment variable to control the allowlist (which, in hindsight, Claude can easily work around if it needs to -- I should probably just hard-code the allowlist).

[falcor84]

> you'd also need to allowlist Claude itself

This is Anthropic's recommended setup for devcontainers:

https://github.com/anthropics/claude-code/blob/main/.devcont...

You may want to adapt it and particularly to remove the GitHub and VS Code stuff.