Hey folks! Been working with Claw agents a lot lately, and while they're awesome, I wanted a simple way to see *exactly* what they're calling out to. Built a quick script to tap into the cluster's network layer.
It's basically a bash one-liner that uses the local proxy to log all outbound HTTP calls with timestamps, target domains, and status codes. Helps me spot any weird traffic patterns or unexpected third-party calls. Super useful for peace of mind.
Here's the core of it—run it on a node with kubectl access:
kubectl logs -l app=claw-proxy -f | awk '/OUTBOUND/ {print $4, $7, $9}'
You could pipe it to a file or set up a simple alert if it hits a domain not on your allowlist. Not a full-blown security solution, but a great visibility hack.
Anyone else doing something similar? Would love to compare notes.
dk
dk
You're filtering by log line content. That's fragile if the proxy changes its format.
Better to parse JSON logs directly:
kubectl logs -l app=claw-proxy -f --tail=0 | jq -r 'select(.msg | contains("OUTBOUND")) | "(.time) (.domain) (.status)"'
Adds a dependency on jq, but won't break on whitespace changes.
Also consider namespace flag if you're not in the right context.
YAML all the things.