# TraconEgressOptions

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.traconegressoptions/
> Summary: TraconEgressOptions: Shared rules for the target address of outbound network requests.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

Shared rules for the target address of outbound network requests.

```csharp
public sealed class TraconEgressOptions
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.traconegressoptions/">TraconEgressOptions</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

Read from the `Tracon:Egress` configuration section. Tracon
sends outbound requests from three surfaces — webhook delivery, MCP server
connections and model provider calls — and this option governs all three,
so an operator reasons about one setting instead of three.

[TraconEgressOptions.AllowPrivateNetworkTargets](/api/tracon.traconegressoptions/#Tracon_TraconEgressOptions_AllowPrivateNetworkTargets) is a security boundary, not a
convenience default — the same reason as
[TraconTenantProviderOptions.AllowedConfigurationPrefix](/api/tracon.tracontenantprovideroptions/#Tracon_TraconTenantProviderOptions_AllowedConfigurationPrefix).
Without it, an administrator could point an MCP server or a tenant's
provider endpoint at the cloud metadata address
(`169.254.169.254`), which often hands out unauthenticated temporary
credentials.

## Constructors

### <a id="Tracon_TraconEgressOptions__ctor"></a> TraconEgressOptions\(\)

```csharp
public TraconEgressOptions()
```

## Fields

### <a id="Tracon_TraconEgressOptions_SectionName"></a> SectionName

Gets the configuration section name.

```csharp
public const string SectionName = "Tracon:Egress"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

## Properties

### <a id="Tracon_TraconEgressOptions_AllowPrivateNetworkTargets"></a> AllowPrivateNetworkTargets

Gets or sets whether outbound requests to private network addresses
are allowed. **Disabled by default.**

```csharp
public bool AllowPrivateNetworkTargets { get; set; }
```

#### Property Value

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)

#### Remarks

Enabling this opens an SSRF surface: the server becomes able to reach
any service on the internal network, including the cloud metadata
endpoint. Enable it only deliberately, on a closed network — for
example when the MCP servers really do run inside the private network.