.NET API
TraconEgressOptions
Tracon.Abstractions.dllShared rules for the target address of outbound network requests.
public sealed class TraconEgressOptionsInheritance
Section titled “Inheritance”Inherited Members
Section titled “Inherited Members”object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
Remarks
Section titled “Remarks”Read from the Tracon:Egress configuration section. Tracon
sends outbound requests from three surfaces — webhook delivery, MCP server
connections and model provider calls — and this option governs all three,
so an operator reasons about one setting instead of three.
TraconEgressOptions.AllowPrivateNetworkTargets is a security boundary, not a
convenience default — the same reason as
TraconTenantProviderOptions.AllowedConfigurationPrefix.
Without it, an administrator could point an MCP server or a tenant’s
provider endpoint at the cloud metadata address
(169.254.169.254), which often hands out unauthenticated temporary
credentials.
Constructors
Section titled “Constructors”TraconEgressOptions()
Section titled “ TraconEgressOptions()”public TraconEgressOptions()Fields
Section titled “Fields”SectionName
Section titled “ SectionName”Gets the configuration section name.
public const string SectionName = "Tracon:Egress"Field Value
Section titled “Field Value”Properties
Section titled “Properties”AllowPrivateNetworkTargets
Section titled “ AllowPrivateNetworkTargets”Gets or sets whether outbound requests to private network addresses are allowed. Disabled by default.
public bool AllowPrivateNetworkTargets { get; set; }Property Value
Section titled “Property Value”Remarks
Section titled “Remarks”Enabling this opens an SSRF surface: the server becomes able to reach any service on the internal network, including the cloud metadata endpoint. Enable it only deliberately, on a closed network — for example when the MCP servers really do run inside the private network.