# EGRESS_NOT_ALLOWED

**What it means.** The app tried to reach a service it is not allowed to reach.

**What to do.** An app nobody has kept yet can only reach a short list of common services. Ask the person to keep the app — the link was printed when it was deployed — and it will be able to call any service. The refusal names the host it was trying to reach.

- HTTP status: 403
- Retryable after applying the fix: no

Every failure from the CLI or an MCP tool has this shape:

```json
{
  "ok": false,
  "code": "EGRESS_NOT_ALLOWED",
  "message": "The app tried to reach a service it is not allowed to reach.",
  "fix": "An app nobody has kept yet can only reach a short list of common services. Ask the person to keep the app — the link was printed when it was deployed — and it will be able to call any service. The refusal names the host it was trying to reach.",
  "file": "<where to edit, when known>",
  "retryable": false,
  "docs": "https://docs.uarpie.app/errors/EGRESS_NOT_ALLOWED"
}
```

Apply `fix` (edit `file` when it is given), then run the same command again.