> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/using-aikido-endpoint/firewall.md).

# Device Firewall

The Device Firewall lets you block specific domains so your connected devices can't reach them. Use it to keep developers away from risky package marketplaces, unapproved registries, and other sites you don't want on work machines.

<figure><img src="/files/b12stSanuIKKJktkIfp9" alt="The Firewall tab listing blocked domains with their user groups and reasons"><figcaption></figcaption></figure>

## How it works

Device Protection monitors network traffic on each device. When a device tries to reach a blocked domain, the request is stopped at the network level before it connects.

## Block a domain

1. Go to [Device Protection and open the Firewall tab](https://app.aikido.dev/endpoint-protection/firewall).
2. Select **Block Domain**.
3. Enter the domain you want to block (for example `clawhub.ai`).
4. Choose which **User Groups** the block applies to. Select **Match All** to apply it to every device, or pick a specific group such as Developers.
5. Optionally add a **Reason** so your team knows why the domain is blocked.
6. Save the block.

The domain now appears in the list and applies to the selected devices.

## Examples of domains to block

Common domains teams block, grouped by category.

{% tabs %}
{% tab title="npm mirrors" %}
Unofficial copies of the public npm registry. They let developers install packages outside your approved private registry, so packages skip the checks you rely on.

* `npmmirror.com` -- third-party mirror of the public npm registry
* `npm.taobao.org` -- the older Taobao npm mirror
* `r.cnpmjs.org` -- the cnpm mirror
* `mirrors.tencent.com` -- Tencent's public npm mirror
* `repo.huaweicloud.com` -- Huawei's public npm mirror
* `registry.yarnpkg.com` -- the Yarn registry, which proxies the public npm registry
  {% endtab %}

{% tab title="PyPI mirrors" %}
Unofficial copies of the Python Package Index (PyPI), the public registry for Python packages. Like npm mirrors, they let developers pull Python packages from outside your approved index.

* `mirrors.aliyun.com` -- Alibaba Cloud PyPI mirror
* `pypi.tuna.tsinghua.edu.cn` -- Tsinghua University PyPI mirror
* `pypi.doubanio.com` -- Douban PyPI mirror
* `pypi.mirrors.ustc.edu.cn` -- USTC PyPI mirror
* `mirrors.cloud.tencent.com` -- Tencent Cloud PyPI mirror
* `mirror.baidu.com` -- Baidu PyPI mirror
  {% endtab %}

{% tab title="Unvetted marketplaces" %}
Package and tool marketplaces you haven't reviewed. Anyone can publish to them, so they are a common source of malicious or low-quality software.

* `clawhub.ai` -- an unvetted package marketplace
* `smithery.ai` -- a marketplace for Model Context Protocol (MCP) servers, a way for AI tools to connect to external services
  {% endtab %}

{% tab title="Paste & file sharing" %}
Anonymous paste and file-sharing sites. Attackers, and malware running on a device, use them to move source code, secrets, or stolen data off the machine.

* `pastebin.com` -- anonymous text paste site
* `privatebin.net` -- encrypted paste site
* `hastebin.com` -- anonymous text paste site
* `transfer.sh` -- command-line file upload service
* `anonfiles.com` -- anonymous file host
* `gofile.io` -- anonymous file host
* `mega.nz` -- anonymous cloud storage
  {% endtab %}
  {% endtabs %}

## Manage blocked domains

* Use the **Search** bar to find a blocked domain by name.
* Use the **User Groups** filter to see the domains blocked for a specific group.
* Select the menu (the three dots) on any row to edit or remove a block.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/aikido-device-protection/using-aikido-endpoint/firewall.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.