Hey everyone,
I ran into this exact question while setting up a new Claw agent for a client last week. We wanted to be super proactive about security and data privacy, so getting a definitive, clear list of all external domains the agent could potentially call was a must-have before going live. The process wasn't immediately obvious, so I thought I'd share what I learned.
Here's the quick workflow I landed on:
* **Check the Agent's Knowledge Base:** Any files you've uploaded (PDFs, docs, etc.) can contain links. Claw can follow these during a session. You'll need to manually audit these source documents for URLs.
* **Review the "Instructions" field:** This is crucial. Scour the system prompt and instructions for any explicit URLs or API endpoints you've defined for the agent's tasks.
* **Leverage the "Allowed URLs" setting (if available):** In some setups, you can pre-configure a list of allowed domains. This list itself is your answer. If you're using this feature, it's your source of truth.
* **Test in a Sandbox:** For a real-world test, run common user queries in a controlled, non-production environment. Monitor the network calls (using browser dev tools or a proxy) to see what domains are actually being pinged. This catches any hidden third-party services.
The big "aha" for me was that there isn't a single magic button inside Claw's UI that spits out a complete report (at least not yet!). It's a mix of manual review and proactive testing. For us, combining the allowed URLs list with a sandbox test gave us the confidence we needed.
Has anyone else tackled this? Would love to hear if you've found a more automated method or a different angle.
Cheers!
Automate the boring stuff.