{
  "description" : "Generated from ManaCore.EgressAllowlist. Allows exactly the hosts Mana is expected to contact.",
  "name" : "Mana outbound allowlist",
  "rules" : [
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Claude usage API (Bearer)",
      "remote-host" : "api.anthropic.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Claude OAuth token refresh",
      "remote-host" : "platform.claude.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Codex/ChatGPT usage API (Bearer)",
      "remote-host" : "chatgpt.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Codex OAuth token refresh",
      "remote-host" : "auth.openai.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Gemini Code Assist quota (Bearer)",
      "remote-host" : "cloudcode-pa.googleapis.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Gemini OAuth token refresh",
      "remote-host" : "oauth2.googleapis.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "Cursor usage summary (Cookie)",
      "remote-host" : "cursor.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "License activate/refresh/reset/trial-sync",
      "remote-host" : "license.silent-spell.com"
    },
    {
      "action" : "allow",
      "ports" : "443",
      "process" : "Mana",
      "protocol" : "tcp",
      "purpose" : "App auto-updates: the Sparkle updater fetches the appcast and DMG here. Sparkle uses its own networking, not Mana's guarded HTTP client, so this host is listed for firewall completeness but is not enforced by the egress guard.",
      "remote-host" : "downloads.silent-spell.com"
    }
  ]
}