---
title: "Addresses a model provider fetches"
description: "Addresses a model provider fetches for cluster operators and plugin authors."
canonical_url: "https://docs.oz0.ai/concepts/outbound-connections/provider-fetches"
---
# Addresses a model provider fetches

> Addresses a model provider fetches for cluster operators and plugin authors.

For: cluster operators and plugin authors.

## What a provider reaches on a call's behalf

A model call can make the provider itself open a connection: an image's URL, a remote MCP server, web search. That traffic starts outside the cluster, so no sandbox or egress proxy sees it, and the [gateway holds it at the call](https://docs.oz0.ai/spend/models-and-keys/data-rules#what-a-call-may-make-the-provider-read-or-fetch):

<table>
<thead>
  <tr>
    <th>
      What the call names
    </th>
    
    <th>
      What happens
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      An address (image, document, video, audio or file URL; remote MCP server)
    </td>
    
    <td>
      Refused with <code>
        403 oz0_provider_egress
      </code>
      
       unless the host and port are on the tenant's egress list, and on the list for the job's level when one applies
    </td>
  </tr>
  
  <tr>
    <td>
      Inline content (<code>
        data:
      </code>
      
      , base64)
    </td>
    
    <td>
      Passes: no connection is made
    </td>
  </tr>
  
  <tr>
    <td>
      A hosted tool that reaches addresses nobody can name beforehand (web search, web fetch, URL context, one the gateway does not know), or a model family known to search by name
    </td>
    
    <td>
      Off until a tenant admin runs <code>
        oz0 model rules --hosted-web-tools
      </code>
      
      ; always off for a job at a level with an egress list
    </td>
  </tr>
</tbody>
</table>

What is left is the provider's: a model outside that list that browses by itself, and whatever a hosted tool does once a tenant turned it on. See the [threat model](https://docs.oz0.ai/concepts/threat-model/known-gaps#known-gaps). On a node, a local model server is sent no address at all.

## Check it yourself

`make e2e-egress` runs on Linux without root, in an unprivileged user and network namespace (on Ubuntu 24.04, `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0` first). It downloads the toolchain once into `~/.cache/oz0-tools/toolchain`, then runs a dev server, a node from an empty data directory with `--offline`, a plugin from Git, the quickstart's first run and, with `OZ0_TEST_POSTGRES_URL` set, a cluster-mode server, where every packet to another address and every DNS name is recorded. It prints what tried to leave, by process, and fails if anything did.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.