TraconEgressOptions

Namespace Tracon · Assembly Tracon.Abstractions.dll

Shared rules for the target address of outbound network requests.

public sealed class TraconEgressOptions

Inheritance

object ← TraconEgressOptions

Inherited Members

object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

Read from the Tracon:Egress configuration section. Tracon sends outbound requests from three surfaces — webhook delivery, MCP server connections and model provider calls — and this option governs all three, so an operator reasons about one setting instead of three.

TraconEgressOptions.AllowPrivateNetworkTargets is a security boundary, not a convenience default — the same reason as TraconTenantProviderOptions.AllowedConfigurationPrefix. Without it, an administrator could point an MCP server or a tenant’s provider endpoint at the cloud metadata address (169.254.169.254), which often hands out unauthenticated temporary credentials.

Constructors

TraconEgressOptions()

public TraconEgressOptions()

Fields

SectionName

Gets the configuration section name.

public const string SectionName = "Tracon:Egress"

Field Value

string

Properties

AllowPrivateNetworkTargets

Gets or sets whether outbound requests to private network addresses are allowed. Disabled by default.

public bool AllowPrivateNetworkTargets { get; set; }

Property Value

bool

Remarks

Enabling this opens an SSRF surface: the server becomes able to reach any service on the internal network, including the cloud metadata endpoint. Enable it only deliberately, on a closed network — for example when the MCP servers really do run inside the private network.