Device Firewall

The Device Firewall lets you block specific domains so your connected devices can't reach them. Use it to keep developers away from risky package marketplaces, unapproved registries, and other sites you don't want on work machines.

How it works

Device Protection monitors network traffic on each device. When a device tries to reach a blocked domain, the request is stopped at the network level before it connects.

Block a domain

1. Go to Device Protection and open the Firewall tab.
2. Select Block Domain.
3. Enter the domain you want to block (for example clawhub.ai).
4. Choose which User Groups the block applies to. Select Match All to apply it to every device, or pick a specific group such as Developers.
5. Optionally add a Reason so your team knows why the domain is blocked.
6. Save the block.

The domain now appears in the list and applies to the selected devices.

Examples of domains to block

Common domains teams block, grouped by category.

npm mirrors

Unofficial copies of the public npm registry. They let developers install packages outside your approved private registry, so packages skip the checks you rely on.

• npmmirror.com -- third-party mirror of the public npm registry
• npm.taobao.org -- the older Taobao npm mirror
• r.cnpmjs.org -- the cnpm mirror
• mirrors.tencent.com -- Tencent's public npm mirror
• repo.huaweicloud.com -- Huawei's public npm mirror
• registry.yarnpkg.com -- the Yarn registry, which proxies the public npm registry

PyPI mirrors

Unofficial copies of the Python Package Index (PyPI), the public registry for Python packages. Like npm mirrors, they let developers pull Python packages from outside your approved index.

• mirrors.aliyun.com -- Alibaba Cloud PyPI mirror
• pypi.tuna.tsinghua.edu.cn -- Tsinghua University PyPI mirror
• pypi.doubanio.com -- Douban PyPI mirror
• pypi.mirrors.ustc.edu.cn -- USTC PyPI mirror
• mirrors.cloud.tencent.com -- Tencent Cloud PyPI mirror
• mirror.baidu.com -- Baidu PyPI mirror

Unvetted marketplaces

Package and tool marketplaces you haven't reviewed. Anyone can publish to them, so they are a common source of malicious or low-quality software.

• clawhub.ai -- an unvetted package marketplace
• smithery.ai -- a marketplace for Model Context Protocol (MCP) servers, a way for AI tools to connect to external services

Paste & file sharing

Anonymous paste and file-sharing sites. Attackers, and malware running on a device, use them to move source code, secrets, or stolen data off the machine.

• pastebin.com -- anonymous text paste site
• privatebin.net -- encrypted paste site
• hastebin.com -- anonymous text paste site
• transfer.sh -- command-line file upload service
• anonfiles.com -- anonymous file host
• gofile.io -- anonymous file host
• mega.nz -- anonymous cloud storage

Manage blocked domains

• Use the Search bar to find a blocked domain by name.
• Use the User Groups filter to see the domains blocked for a specific group.
• Select the menu (the three dots) on any row to edit or remove a block.