Write Network Rules

Overview

Network rules select which traffic Formal Endpoint intercepts with Transparent Mode. Intercepted traffic undergoes evaluation and logging. A TCP connection is intercepted when an active network rule matches. All the stages within the CEL condition block (pre_tcp, pre_tls and post_tls) must evaluate to true. Create rules in the at Network Rules. New rules default to Draft. Set a rule to Active before it intercepts traffic.

Rule structure

{
  "condition": {
    "pre_tcp": "<CEL_CONDITION>",
    "pre_tls": "<CEL_CONDITION>",
    "post_tls": "<CEL_CONDITION>"
  },
  "outputs": {
    "forward_to_connector": true,
    "resource_name": "my_resource"
  }
}

pre_tcp applies on macOS only. On Linux, pre_tcp is ignored. outputs is optional. Use it when the Formal Endpoint should forward traffic to the instead of evaluating policies locally.

Output	Type	Description
`forward_to_connector`	boolean	Forward HTTP, MCP, and LLM traffic to the . Formal does not evaluate that traffic on the Endpoint.
`resource_name`	string	Forward using this Formal hostname and port, even if the request technology does not match.

SSH ignores outputs. The Endpoint always connects SSH to the original destination, even when resource_name names an SSH resource. See SSH in Transparent Mode.

`pre_tcp` conditions

pre_tcp runs in the macOS Network Extension. It sees the connecting process, its ancestors, and the destination hostname and port. hostname comes from macOS flow metadata, falling back to the destination IP address. A matching pre_tcp condition does not intercept traffic by itself. Formal logs the flow and evaluates policy only when pre_tls and post_tls are also true. See Network rule inputs for the fields each stage can read. On macOS, this rule diverts traffic from a known agent or its children. It then intercepts MCP and LLM.

{
  "condition": {
    "pre_tcp": process.is_agent || process.has_agent_ancestor,
    "pre_tls": true,
    "post_tls": technology in ["mcp", "llm"]
  }
}

Use hostname and port in pre_tcp to filter destinations before diverting traffic. Put other destination checks in pre_tls. If other rules should see different processes, give each rule its own pre_tcp condition. Formal diverts a flow when any one of those conditions matches. Traffic from a process that matches no pre_tcp condition does not appear in Logs.

`pre_tls` conditions

pre_tls sees TCP flow metadata that Formal can collect without talking to the client process. That includes the destination hostname and port, the Unix process that opened the connection and its ancestors, and the user identity. If any pre_tls rule matches a TLS flow, Formal terminates TLS so it can inspect and forward plaintext. A TLS flow begins with a TCP ClientHello. Flows that do not start with a ClientHello, such as SSH, skip TLS termination. post_tls then classifies them from their first bytes. Exclude applications that do not trust the Formal certificate from pre_tls. This includes clients that do not use the system CA store, such as some Python scripts. Otherwise those clients raise CA trust errors.

`post_tls` conditions

post_tls receives the same inputs as pre_tls. Formal also classifies the plaintext wire protocol. You can include or exclude specific technologies. If pre_tls matches and no rule’s post_tls matches, Formal forwards the unchanged traffic. It does not log the flow or evaluate policy.

Process identity

On macOS, process.is_agent, the per-agent flags, process.has_agent_ancestor, and process.is_browser use code-signed process identity. On Linux, the agent flags match /proc comm of the installed binary. process.is_grok_bot, process.is_browser, and process.signing.* stay false on Linux. os is linux or macos. Every stage can read it.

Known agent identities

Formal recognizes these signed processes as agents. Each row requires an exact match for every listed identity field.

Agent	Code identifier	Bundle identifier	Team ID
Amp	`com.ampcode.amp.cli`	None	`PZT9BJUAA5`
Antigravity	`com.google.antigravity`	`com.google.antigravity`	`EQHXZ8M8AV`
Antigravity	`com.google.antigravity-ide`	`com.google.antigravity-ide`	`EQHXZ8M8AV`
Antigravity	`cli`	None	`EQHXZ8M8AV`
Claude Code	`com.anthropic.claude-code`	None	`Q6L2SF6YDW`
Claude Code	`com.anthropic.claude-code`	`com.anthropic.claude-code`	`Q6L2SF6YDW`
Claude Desktop	`com.anthropic.claudefordesktop`	`com.anthropic.claudefordesktop`	`Q6L2SF6YDW`
Codex	`codex`	None	`2DC432GLL2`
Codex	`codex`	`com.openai.codex.cli`	`2DC432GLL2`
Codex	`com.openai.codex.helper`	`com.openai.codex.helper`	`2DC432GLL2`
Cursor	`com.todesktop.230313mzl4w4u92`	None	`VDXQ22DGB9`
Cursor	`com.todesktop.230313mzl4w4u92`	`com.todesktop.230313mzl4w4u92`	`VDXQ22DGB9`
GitHub Copilot CLI	`copilot`	None	`VEKTX9H2N7`
GitHub Copilot for Xcode	`com.github.CopilotForXcode`	`com.github.CopilotForXcode`	`VEKTX9H2N7`
Crush	`crush`	None	`X3UBLT2DDB`
Devin	`devin`	None	`83Z2LHX6XW`
Grok	Any	`com.anysphere.sand`	`DCNK4UB866`
OpenCode	`ai.opencode.desktop`	`ai.opencode.desktop`	`5NZ4Q7NXJ4`
Amazon Q Developer	`q`	None	`94KV3E626L`
Windsurf	`com.exafunction.windsurf`	`com.exafunction.windsurf`	`83Z2LHX6XW`
Warp Agent CLI	`warp-tui-stable`	None	`2BBY89MBSN`

Any accepts every code identifier. None requires an empty bundle identifier. A process from another signing team is not recognized.

Examples

This starting rule intercepts MCP and LLM on macOS and Linux. It matches known agents on both. On Linux it also matches known LLM provider hostnames, and pre_tcp is ignored.

{
  "condition": {
    "pre_tcp": process.is_agent,
    "pre_tls": process.is_agent || (is_llm_hostname && os == "linux"),
    "post_tls": technology in ["mcp", "llm"]
  }
}

On macOS, this rule intercepts MCP and LLM traffic from a known agent.

{
  "condition": {
    "pre_tcp": os == "macos" && process.is_agent,
    "pre_tls": true,
    "post_tls": technology in ["mcp", "llm"]
  }
}

On macOS, this rule intercepts every flow from a known agent, including child processes it spawned. has_agent_ancestor is also true when the connecting process is the agent.

{
  "condition": {
    "pre_tcp": process.has_agent_ancestor,
    "pre_tls": true,
    "post_tls": true
  }
}

To limit that intercept to Codex Desktop, match the signed bundle ID on the process or an ancestor. See Restrict Codex Desktop to LLM and MCP. This rule intercepts AWS API traffic from the Claude Code CLI. It applies only to users in the Infra group.

{
  "condition": {
    "pre_tcp": process.ancestors.exists(p, p.signing.team_id == "Q6L2SF6YDW" && p.signing.bundle_identifier == "com.anthropic.claude-code"),
    "pre_tls": "Infra" in user.groups,
    "post_tls": technology == "aws"
  }
}

On Linux, this rule intercepts traffic to known model-provider hostnames.

{
  "condition": {
    "pre_tcp": os == "linux",
    "pre_tls": is_llm_hostname,
    "post_tls": technology in ["mcp", "llm"]
  }
}

This rule intercepts every flow whose destination hostname and port match a Formal resource.

{
  "condition": {
    "pre_tcp": true,
    "pre_tls": resource.name != "",
    "post_tls": true
  },
  "outputs": {
    "forward_to_connector": true,
    "resource_name": resource.name
  }
}

This rule intercepts SSH to hosts under example.com. The Endpoint evaluates SSH session policies on it.

{
  "condition": {
    "pre_tcp": true,
    "pre_tls": hostname.endsWith(".example.com"),
    "post_tls": technology == "ssh"
  }
}

Verify:

Set the network rule to Active.
Enable Transparent Mode: formal transparent-proxy enable
Confirm it is running: formal transparent-proxy status
Send matching traffic and confirm it appears in Logs.

Technology classification

Formal classifies the plaintext wire protocol after TLS terminates. Use the technology input only in the post_tls condition. It is not available in pre_tls or pre_tcp. technology supports these values:

http
mcp
llm
aws
gcp
postgres
mongodb
ssh

Use technology only in post_tls. A pre_tls or pre_tcp condition cannot read the classified protocol.

Network rule inputs

The Stages column lists where each input can be read. pre_tcp applies on macOS only. Prefer process for new rules. connection_process still works. The connecting process stays nested at connection_process.process. An input left out of pre_tcp is unset there, except the empty values noted below. A condition that reads an unset input does not match. is_llm_hostname and process.cmdline are empty in pre_tcp. technology is empty in pre_tcp and pre_tls. Do not negate an empty value. !is_llm_hostname matches every process.

Input	Type	Stages	Notes
`user.id`	string	`pre_tls`, `post_tls`
`user.email`	string	`pre_tls`, `post_tls`
`user.username`	string	`pre_tls`, `post_tls`	`idp:formal:human:example@example.com` or `idp:formal:machine:example`
`user.type`	string	`pre_tls`, `post_tls`	`human` or `machine`
`user.groups`	array	`pre_tls`, `post_tls`	String array of group names
`user.group_ids`	array	`pre_tls`, `post_tls`	String array of group IDs
`hostname`	string	`pre_tcp`, `pre_tls`, `post_tls`	Destination hostname from macOS APIs or the Linux DNS proxy. Otherwise the destination IP address.
`port`	int	`pre_tcp`, `pre_tls`, `post_tls`	Destination TCP port.
`is_llm_hostname`	bool	`pre_tls`, `post_tls`	True when the hostname is `api.anthropic.com`, `claude.ai`, `chatgpt.com`, `cursor.sh`, or a subdomain of one of those. False in `pre_tcp`.
`process.is_antigravity`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is Antigravity. Linux matches process name `agy`, `antigravity`, or `antigravity-ide`.
`process.is_claude_cli`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is Claude Code. Linux matches process name `claude` or `claude.exe`.
`process.is_claude_desktop`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is Claude Desktop. Linux matches process name `claude-desktop`.
`process.is_codex_cli_rs`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is Codex. Linux matches process name `codex`.
`process.is_cursor`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is Cursor. Linux matches process name `cursor`.
`process.is_devin_cli`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is Devin. Linux matches process name `devin`.
`process.is_grok_bot`	bool	`pre_tcp`, `pre_tls`, `post_tls`	macOS only. True when the connecting process or an ancestor is `grok-bot`.
`process.is_opencode`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process or an ancestor is OpenCode. Linux matches process name `opencode` or `opencode.exe`.
`process.is_agent`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process matches any of the agent inputs above. On Linux this uses those process names. `is_grok_bot` stays macOS only.
`process.has_agent_ancestor`	bool	`pre_tcp`, `pre_tls`, `post_tls`	True when the connecting process is a known agent or has one in its ancestor list. On Linux this uses the process names above.
`process.is_browser`	bool	`pre_tcp`, `pre_tls`, `post_tls`	macOS only. True when the connecting process is a known browser. In `pre_tcp`, Apple WebKit helper processes (such as Safari’s networking process) don’t inherit their browser’s verdict, so Safari traffic can evaluate `false`.
`process.name`	string	`pre_tcp`, `pre_tls`, `post_tls`	Process name of the immediate connecting process, for example `claude`
`process.cmdline`	string	`pre_tls`, `post_tls`	Process command line of the immediate connecting process, for example `claude -p "echo hello"`. Empty in `pre_tcp`.
`process.signing.team_id`	string	`pre_tcp`, `pre_tls`, `post_tls`	macOS only. Team ID of the signed immediate connecting process, for example `Q6L2SF6YDW` for Anthropic.
`process.signing.bundle_identifier`	string	`pre_tcp`, `pre_tls`, `post_tls`	macOS only. Bundle ID of the signed immediate process, for example `com.anthropic.claude-code`.
`process.signing.code_identifier`	string	`pre_tcp`, `pre_tls`, `post_tls`	macOS only. Code ID of the signed immediate process, for example `codex` for the Codex CLI.
`process.ancestors`	array	`pre_tcp`, `pre_tls`, `post_tls`	Array of parent processes. Each object has `name`, `cmdline`, and `signing`. Ancestor `cmdline` is empty in `pre_tcp`.
`os`	string	`pre_tcp`, `pre_tls`, `post_tls`	`linux` or `macos`
`resource.id`	string	`pre_tls`, `post_tls`	Resource ID when a Formal resource matches the hostname and port
`resource.name`	string	`pre_tls`, `post_tls`	Resource name when a Formal resource matches the hostname and port
`resource.space_id`	string	`pre_tls`, `post_tls`	Space ID when a Formal resource matches the hostname and port
`resource.technology`	string	`pre_tls`, `post_tls`	Technology, such as `mcp`, when a Formal resource matches the hostname and port
`technology`	string	`post_tls`	Classified wire protocol: `http`, `mcp`, `llm`, `aws`, `gcp`, `postgres`, `mongodb`, or `ssh`. Empty in `pre_tcp` and `pre_tls`.

Getting Started

Example Use Cases

AI Governance

Configuring Formal

Integrations

Configuration

Overview

Rule structure

`pre_tcp` conditions

`pre_tls` conditions

`post_tls` conditions

Process identity

Known agent identities

Examples

Technology classification

Network rule inputs

Next Steps

Formal Endpoint

Write Policies

​Overview

​Rule structure

​pre_tcp conditions

​pre_tls conditions

​post_tls conditions

​Process identity

​Known agent identities

​Examples

​Technology classification

​Network rule inputs

​Next Steps

Formal Endpoint

Write Policies

Overview

Rule structure

`pre_tcp` conditions

`pre_tls` conditions

`post_tls` conditions

Process identity

Known agent identities

Examples

Technology classification

Network rule inputs

Next Steps