Skip to content

allowlist

URL allow-list policy for the web-search add-on.

A configured allow-list restricts which URLs the tools will surface or fetch. Each entry is a glob compiled by @dbx-tools/path’s match.toPathMatcher (the same Minimatch-backed matcher the package’s file scanning uses). Because that matcher treats / as a path-segment boundary, entries are matched against the right slice of the URL rather than the raw href:

  • A host entry (no / after the optional scheme, e.g. databricks.com or *.databricks.com) is tested against the URL’s hostname. A bare host with no wildcard also matches its subdomains, so databricks.com permits docs.databricks.com - the intuitive reading of a domain allow-list.
  • A path entry (contains a /, e.g. docs.example.com/api/**) is tested against host + pathname (scheme and query stripped), so path globs work without fighting the https:// prefix.

Enforcement is asymmetric by design (see the module’s two consumers): web_search results are SILENTLY filtered to the permitted set, while an explicit web_fetch of a disallowed URL is refused with an error - the search never leaks a URL the caller then can’t fetch, but a direct fetch of a blocked URL is a visible, correctable mistake rather than a silent empty.

An empty / absent allow-list permits everything.