Overview
Network rules select which traffic Formal Endpoint intercepts with Transparent Mode. Intercepted traffic undergoes evaluation and logging. A TCP connection is intercepted when an active network rule matches. All the stages within the CELcondition block (pre_tcp, pre_tls and post_tls) must evaluate to true.
Create rules in the at Network Rules. New rules default to Draft. Set a rule to Active before it intercepts traffic.
Rule structure
pre_tcp applies on macOS only. On Linux, pre_tcp is ignored.
outputs is optional. Use it when the Formal Endpoint should forward traffic to the instead of evaluating policies locally.
SSH ignores
outputs. The Endpoint always connects SSH to the original destination, even when resource_name names an SSH resource. See SSH in Transparent Mode.
pre_tcp conditions
pre_tcp runs in the macOS Network Extension. It sees the connecting process, its ancestors, the destination port, user, and end_user.
A matching pre_tcp condition does not intercept traffic by itself. Formal logs the flow and evaluates policy only when pre_tls and post_tls are also true.
See Network rule inputs for the fields each stage can read.
On macOS, this rule diverts traffic from a known agent or its children. It then intercepts MCP and LLM.
port in pre_tcp to filter destinations before diverting traffic. Put hostname and other destination checks in pre_tls. If other rules should see different processes, give each rule its own pre_tcp condition. Formal diverts a flow when any one of those conditions matches.
Traffic from a process that matches no pre_tcp condition does not appear in Logs.
pre_tls conditions
pre_tls sees TCP flow metadata that Formal can collect without talking to the client process. That includes the destination hostname and port, the Unix process that opened the connection and its ancestors, and the user identity.
If any pre_tls rule matches a TLS flow, Formal terminates TLS so it can inspect and forward plaintext. A TLS flow begins with a TCP ClientHello.
Flows that do not start with a ClientHello, such as SSH, skip TLS termination. post_tls then classifies them from their first bytes.
Exclude applications that do not trust the Formal certificate from pre_tls. This includes clients that do not use the system CA store, such as some Python scripts. Otherwise those clients raise CA trust errors.
post_tls conditions
post_tls receives the same inputs as pre_tls. Formal also classifies the plaintext wire protocol. You can include or exclude specific technologies.
If pre_tls matches and no rule’s post_tls matches, Formal forwards the unchanged traffic. It does not log the flow or evaluate policy.
Process identity
On macOS,process.is_agent, the per-agent flags, process.has_agent_ancestor, and process.is_browser use code-signed process identity.
On Linux, the agent flags match /proc comm of the installed binary. The Cursor CLI runs as Node.js on both, so process.is_cursor instead matches a node process whose argv[0] is the cursor-agent or agent launcher. process.is_gemini_cli likewise matches a node process whose script argument is the gemini launcher. process.is_browser and process.signing.* stay false on Linux. An agent flag with no Linux process name stays false there too.
os is linux or macos. Every stage can read it.
Known agent identities
Formal recognizes these signed processes as agents. Each row requires an exact match for every listed identity field.Any accepts every code identifier or executable path. None requires an empty bundle identifier or team ID. A process from another signing team is not recognized.
Some agents run a runtime signed by its own vendor, such as the Cursor CLI’s bundled Node.js. Formal recognizes these only when the executable runs from the agent’s install directory. * matches one path component.
Examples
This starting rule intercepts MCP and LLM on macOS and Linux. It matches known agents on both. On Linux it also matches known LLM provider hostnames, andpre_tcp is ignored.
has_agent_ancestor is also true when the connecting process is the agent.
example.com. The Endpoint evaluates SSH session policies on it.
- Set the network rule to Active.
- Enable Transparent Mode:
formal transparent-proxy enable - Confirm it is running:
formal transparent-proxy status - Send matching traffic and confirm it appears in Logs.
Technology classification
Formal classifies the plaintext wire protocol after TLS terminates. Use thetechnology input only in the post_tls condition. It is not available in pre_tls or pre_tcp.
technology supports these values:
httpmcpllmawsgcppostgresmysqlmariadbmongodbssh
Network rule inputs
The Stages column lists where each input can be read.pre_tcp applies on macOS only.
Prefer process for new rules. connection_process still works. The connecting process stays nested at connection_process.process. Every process field is also on connection_process.
user is the logged-in Endpoint identity. end_user is the person the traffic runs for. On a direct login, end_user equals user. On an OIDC machine session, user is the machine user and end_user is the human.
An input left out of pre_tcp is unset there, except the empty values noted below. A condition that reads an unset input does not match. is_llm_hostname, socket_ecosystem, and process.cmdline are empty in pre_tcp. is_socket_ecosystem is false in pre_tcp. process.pid_version is 0 in pre_tcp. technology is empty in pre_tcp and pre_tls. Do not negate an empty value. !is_llm_hostname matches every process in pre_tcp.
Next Steps
Formal Endpoint
Install and enable Transparent Mode
Write Policies
Enforce rules on intercepted traffic