Agent Firewall module

[bpmct]

A discussion dedicated to the Agent Firewall module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 25	20 / 20	0 / 20	8 / 10	61 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for multiple major modes: automated task with coder_script, coder_app integration, inline config override, external config file path, and integration with Claude Code and Codex modules. Each has sensible defaults.
Coder-context framing	8	1	Opening line mentions "network isolation in Coder workspaces" and links to Coder docs, but does not explain what agent-firewall adds on top of Coder or show where Coder fits in the flow. The module description is minimal.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	10	README documents agent-firewall (network isolation/policy enforcement) extensively with config examples and integration patterns. The module IS the agent firewall implementation for Coder.
Dashboard entry point	5	5	README includes a documented coder_app example showing Claude Code integration with agent-firewall wrapper in the command.
Session continuity	5	5	The coder_app example explicitly uses tmux for session persistence: exec tmux new-session -A -s claude-code with the -A flag for attach-or-create behavior, enabling session resumption.
Managed configuration	5	0	No documented support for managed MCP, settings, policies, or workdir config. The module manages agent-firewall config but not agent/MCP configuration.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. All inputs are configuration paths, version strings, and boolean flags. README examples contain no secrets.
Non-hardcoded auth path	4	4	Module does not handle authentication credentials. Agent-firewall operates on network policy, not auth tokens. N/A concern treated as satisfied.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL for agent-firewall. When use_agent_firewall_directly=true, the install script hardcodes https://raw.githubusercontent.com/coder/boundary/main/install.sh. When compile_agent_firewall_from_source=true, it hardcodes https://github.com/coder/boundary.git. No URL override variable exists.
Bring-your-own binary	5	0	No documented way to skip installation when agent-firewall is pre-baked. The default mode uses coder agent-firewall subcommand (no install), but this requires the Coder binary to have the feature, not a pre-installed agent-firewall binary. No skip-install flag or documentation for using a pre-existing binary.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Install script contacts github.com and raw.githubusercontent.com, but these are only visible in source code, not documented in a network/offline/air-gapped section.
Runs without sudo	2	0	install.sh.tftpl line 88 uses sudo cp and line 89 uses sudo chmod when compiling from source or using direct install. No documented non-sudo path. Core functionality requires sudo in these modes.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (latest version, coder subcommand mode, default module directory). Validation exists for mutually exclusive config inputs (agent_firewall_config vs agent_firewall_config_path).
Test coverage	4	2	.tftest.hcl covers business logic (outputs, config modes, mutual exclusion validation). main.test.ts provides end-to-end tests for installation, config writing, wrapper execution, and idempotency. However, tests skip the two installation modes that require network access (compile from source, direct install), leaving significant code paths untested.

Overall — 61 / 100

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.