Network Security

Nexus OS controls network access at multiple levels.

Network Policies

Three network modes are available:

Mode	Description	Use Case
`none`	No network access	Pure computation agents
`restricted`	Allowlist only	API-calling agents
`open`	Full access	Web scraping agents

Allowlist Configuration

agents:
  researcher:
    sandbox:
      network: restricted
      allowed_hosts:
        - "*.openai.com"
        - "api.anthropic.com"
        - "api.tavily.com"
      blocked_ports:
        - 22    # SSH
        - 3306  # MySQL

TLS Verification

All outbound HTTPS connections verify TLS certificates. Self-signed certificates are rejected unless explicitly allowed:

agents:
  internal-agent:
    sandbox:
      tls_verify: false  # Only for internal services

Rate Limiting

Network requests can be rate-limited per agent:

agents:
  scraper:
    sandbox:
      rate_limit: 10/s    # Max 10 requests per second
      burst_limit: 50     # Allow bursts up to 50

Dashboard Monitoring

The dashboard shows network activity per agent:

naos dashboard
# Navigate to Agents > [agent] > Network tab