To limit an AI agent to trusted websites, enforce an allowlist at every layer that can make network requests: the browser, web-search or fetch tools, and any shell or other execution environment. A browser allowlist alone is not a universal network boundary. Check redirects and page dependencies, then test the exact session configuration you plan to use.
What an allowlist controls—and what it may not
“Allowlist” can describe different controls: a rule on browser navigation, a filter on browser requests, a restriction on a particular web tool, or a network policy for the agent’s execution environment. They are not interchangeable. First identify every way the agent can reach the network, then apply a policy at each relevant enforcement point.
As an Amazon Associate I earn from qualifying purchases.
For example, Anthropic Managed Agents documents domain restrictions for its web_search and web_fetch tools. Those settings govern calls through those tools; they do not by themselves establish a network boundary for shell commands or other tools. See Anthropic’s web-tool domain restrictions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Similarly, VS Code documents that its domain lists do not filter sandboxed command traffic when sandbox network access is enabled. The effective behavior depends on the execution environment and platform, so configure and verify command egress separately. See VS Code’s agent sandbox documentation.
#1 Best Overall
- 【Instant Snap-on Magnetic Attachment】- The Patented Magnetic Privacy Screen – Protected by U.S. Patents 9,829,669 and D844,012. Simply place the privacy screen along the top of your MacBook and let the magnets attach along the top. No need for tricky placement, messy tape, or damaging adhesive. Easily remove and reattach when you need it.
- 【Filter Dimensions】: Width: 11 15/16" (304 mm), Height: 7 1/2" (190 mm), Diagonal: 14.1" (358.14 mm) - SightPro Blackout Privacy Filter is engineered to be compatible with Lenovo, HP, Dell, Acer, Asus, Samsung, and other laptop brands. Please verify your screen's width and height measurements before ordering. It's not recommended to make your selection based solely on your screen's diagonal size. [Not optimized for touchscreens.]
- 【Superior Privacy】- Our advanced multi-layered film filter blacks out your screen when viewing from the side, while maintaining a crystal clear screen straight-on. It also protects your eyes from harmful UV and blue light. [Note: It does not block visibility directly behind you, regardless of the distance.]
- 【Perfect for Travel and Open Workspaces】- The Laptop Privacy Screen Filter is the ideal solution for healthcare providers, mobile workers, commuters, students, and business travelers. Now you can stay compliant and safeguard sensitive corporate information while working in airplanes, subways, airports, and public areas.
- 【Package Contents】- Each package includes a magnetic privacy screen filter, magnetic stickers, a webcam privacy cover, a storage folder, and a cleaning cloth. Buy with confidence – located in the US, Sight Pro specializes in providing best-in-class privacy solutions to individuals, small businesses, corporations, government, and educational institutions. Our privacy screens are Section 889 and TAA compliant.
Set browser restrictions at the right layer
Choose a browser control that applies to the requests you intend to restrict, not just to the first URL the agent opens. The products below document different enforcement scopes; their settings are product- and version-specific, not a single universal browser standard.
| Control | Documented scope | Practical implication |
|---|---|---|
agent-browser --allowed-domains |
Page navigations and subresource requests. | Unlisted subresources are blocked and may break the site. Its documentation also rejects the allowlist in certain attach, profile, restore, and startup-argument configurations where equivalent containment cannot be installed before page scripts run. |
| Cloudflare Browser Run hostname guardrails | Hostname guardrails configured when creating a browser session. | Include hosts needed for redirects and page dependencies, then validate the resulting session behavior. The documentation was last updated September 26, 2026. |
| Cursor browser origin allowlist | Restricts automatic browser_navigate and MCP tool execution. |
Cursor documents that link navigation, server redirects, and JavaScript navigation can still reach a non-allowed origin, so the rule should not be treated as a complete destination boundary. |
A fresh, isolated browser context is a sound starting point when the tool supports it. Playwright documents non-persistent contexts; that is a useful isolation mechanism, but it is not itself a domain allowlist. Its documentation also notes that permission support varies among browsers and versions. See Playwright’s BrowserContext API.
Rank #2
- Filter Dimensions: Width: 11 15/16" (304 mm), Height: 7 1/2" (190 mm), Diagonal: 14.1" (358.14 mm) - SightPro Blackout Privacy Filter is engineered to be compatible with Lenovo, HP, Dell, Acer, Asus, Samsung, and other laptop brands. Please verify your screen's width and height measurements before ordering. It's not recommended to make your selection based solely on your screen's diagonal size. [Not optimized for touchscreens.]
- Two Attachment Options - Installs in minutes. Option 1 uses clear adhesive strips that securely attach to any screen. Option 2 uses slide mount tabs that easily stick to the display frame, allowing you to slide the filter on and off the screen as needed.
- Superior Privacy and Anti Glare - Our advanced multi-layered film filter blacks out your screen when viewing from the side, while maintaining a crystal clear screen straight-on. It also protects your eyes from harmful glare, UV, and blue light. [Note: It does not block visibility directly behind you, regardless of the distance.]
- Perfect for Travel and Open Workspaces - Our computer screen privacy filter is the ideal solution for healthcare providers, mobile workers, commuters, students, and business travelers. Now you can stay compliant and safeguard sensitive corporate information while working in airplanes, subways, airports and public areas.
- Package Contents - Each package includes one privacy screen shield filter, two sets of clear adhesive strips, two sets of slide mount tabs, and a microfiber cleaning cloth. Buy with confidence – located in the US, Sight Pro specializes in providing best-in-class privacy solutions to individuals, small businesses, corporations, government, and educational institutions. Our privacy screens are Section 889 and TAA compliant.
Account for redirects, links, and page dependencies
Check where navigation ends
Allowing a trusted starting domain does not guarantee that the final page remains on that domain. A server redirect, a link, or client-side navigation may take the browser elsewhere, and the handling differs by product. OpenAI’s January 28, 2026 article explains why checking only the first domain can be unsafe when it redirects to an attacker-controlled destination: Keeping your data safe when an AI agent clicks a link.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also consider what information the agent can access. A destination may log requested URLs, so sensitive values placed in a URL can be exposed to that destination. A domain allowlist does not prevent this form of disclosure.
Rank #3
- 【Instant Snap-on Magnetic Attachment】- The Patented Magnetic Privacy Screen – Protected by U.S. Patents 9,829,669 and D844,012. Simply place the privacy screen along the top of your MacBook and let the magnets attach along the top. No need for tricky placement, messy tape, or damaging adhesive. Easily remove and reattach when you need it.
- 【Filter Dimensions】: Width: 13.56" (344.5 mm), Height: 8.49" (215.6 mm), Diagonal: 16" (406 mm) - SightPro Blackout Privacy Filter is engineered to be compatible with Lenovo, HP, Dell, Acer, Asus, Samsung, and other laptop brands. Please verify your screen's width and height measurements before ordering. It's not recommended to make your selection based solely on your screen's diagonal size. [Not optimized for touchscreens.]
- 【Superior Privacy】- Our advanced multi-layered film filter blacks out your screen when viewing from the side, while maintaining a crystal clear screen straight-on. It also protects your eyes from harmful UV and blue light. [Note: It does not block visibility directly behind you, regardless of the distance.]
- 【Perfect for Travel and Open Workspaces】- The Laptop Privacy Screen Filter is the ideal solution for healthcare providers, mobile workers, commuters, students, and business travelers. Now you can stay compliant and safeguard sensitive corporate information while working in airplanes, subways, airports, and public areas.
- 【Package Contents】- Each package includes a magnetic privacy screen filter, magnetic stickers, a webcam privacy cover, a storage folder, and a cleaning cloth. Buy with confidence – located in the US, Sight Pro specializes in providing best-in-class privacy solutions to individuals, small businesses, corporations, government, and educational institutions. Our privacy screens are Section 889 and TAA compliant.
Permit only the dependencies the task needs
A page may rely on separate hosts for scripts, APIs, images, fonts, or other resources. A strict request filter can block those dependencies and impair the page; allowing every host the page contacts expands the permitted surface. Start with the task’s required sites and add dependency hosts only when they are necessary. In particular, do not assume that a page’s main hostname is the only one its functionality requires.
Apply the policy across the agent’s network paths
- Inventory network-capable tools. List browser navigation, web search and fetch, shell commands, plugins, and remote browser or execution services. Treat each path as a separate enforcement question.
- Choose an isolated browser session where possible. Prefer a fresh context over an attached or restored session when the tool’s documentation says those modes cannot install the same controls before page scripts run.
- Set a narrow browser host policy. Use the browser product’s documented request or session guardrail. Confirm what it covers: navigation, subresources, and any other request types relevant to the task.
- Add necessary dependency hosts deliberately. Include required API, script, image, font, or redirect hosts only after establishing that the task needs them.
- Restrict web tools independently. Configure domain controls on search or fetch tools that support them; do not assume those settings govern browser or shell traffic.
- Constrain shell and other egress separately. Apply the execution environment’s own network or sandbox policy, and verify behavior on the actual platform.
- Test the effective boundary. Try a direct disallowed navigation, an allowed host that redirects outward, an outside-origin link, client-side navigation, a blocked subresource, and a required API call. Record the final page and attempted outbound requests.
Validate the boundary without breaking the task
Test using the same browser product, session-start mode, and execution environment intended for deployment. A useful check distinguishes three outcomes: whether an outside destination can be reached, whether a required page dependency is blocked, and whether shell or web-tool traffic follows its own policy. Fix gaps at the layer responsible for that traffic rather than broadening a browser rule to compensate for unrelated egress.
Rank #4
- 【Filter Dimensions】: Width: 13 9/16" (345 mm), Height: 7 5/8" (194 mm), Diagonal: 15.6" (396.24 mm) - SightPro Blackout Privacy Filter is engineered to be compatible with Lenovo, HP, Dell, Acer, Asus, Samsung, and other laptop brands. Please verify your screen's width and height measurements before ordering. It's not recommended to make your selection based solely on your screen's diagonal size. [Not optimized for touchscreens.]
- 【Two Attachment Options】- Installs in minutes. Option 1 uses clear adhesive strips that securely attach to any screen. Option 2 uses slide mount tabs that easily stick to the display frame, allowing you to slide the filter on and off the screen as needed.
- 【Superior Privacy and Reduce Glare】- Our advanced multi-layered film filter blacks out your screen when viewing from the side, while maintaining a crystal clear screen straight-on. It also protects your eyes from harmful glare, UV, and blue light. [Note: It does not block visibility directly behind you, regardless of the distance.]
- 【Perfect for Travel and Open Workspaces】- Our computer screen privacy filter is the ideal solution for healthcare providers, mobile workers, commuters, students, and business travelers. Now you can stay compliant and safeguard sensitive corporate information while working in airplanes, subways, airports and public areas.
- 【Package Contents】- Each package includes one privacy screen shield filter, two sets of clear adhesive strips, two sets of slide mount tabs, and a microfiber cleaning cloth. Buy with confidence – located in the US, Sight Pro specializes in providing best-in-class privacy solutions to individuals, small businesses, corporations, government, and educational institutions. Our privacy screens are Section 889 and TAA compliant.
Revisit the host list when the task or target site changes. A narrow policy can fail closed in ways that break legitimate page functions; a broad policy can permit more destinations than the task requires. Product behavior can also change, so consult the current documentation for the exact tool, version, browser, and hosting environment.
Quick Recap
Best Value
- Compatible Models: Width: 13 9/16" (13.5 inch/344 mm), Height: 7 5/8" (7.6 inch/194 mm), Diagonal: 15.6" (396.24 mm) widescreen laptops which have a 16:9 aspect ratio. Not touchscreen compatible !!! Not fit for 16:10.Do NOT rely solely on your laptop’s diagonal size when ordering. Use a ruler to measure your screen’s visible area (excluding the black bezels). If the width reads 344mm and height reads 194mm, this filter is a perfect match for your device.
- Keep Information Privacy: Effective "black out" privacy from side views outside the 60-degree viewing angle. Designed for optical clarity when viewing from the front, a person not at the front of the screen can only see the dark side of the screen, so it protects buisness secrets and personal privacy
- Eye and Screen Protection: Privacy filter does not only protect your private life but also protects your eyes by blocking 30% of blue light , blocking the harmful blue light between 380 - 495nm, it filters out the blue light and relieves eye strain. Our laptop privacy screen also helps keep your screen safe from dust and scratches
- Perfect For Open Workspaces: Great for maintaining screen privacy in high traffic areas such as open work spaces, airports, airplanes, commuter trains, coffee shops and other public places, etc
- Easy Installation: Choose between 2 simple Options; Slide-On/Off or Mounted. Not touchscreen compatible
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
