# EGRESS_NOT_ALLOWED

**What it means.** The app tried to reach an address it is not allowed to reach.

**What to do.** Add the hostname to "egress" -> "allow" in deploy.json and deploy again. Apps can only reach addresses they declare; that is deliberate, and it is what stops a package nobody audited sending data somewhere nobody chose.

- HTTP status: 403
- Retryable after applying the fix: no

Every failure from the CLI or an MCP tool has this shape:

```json
{
  "ok": false,
  "code": "EGRESS_NOT_ALLOWED",
  "message": "The app tried to reach an address it is not allowed to reach.",
  "fix": "Add the hostname to \"egress\" -> \"allow\" in deploy.json and deploy again. Apps can only reach addresses they declare; that is deliberate, and it is what stops a package nobody audited sending data somewhere nobody chose.",
  "file": "<where to edit, when known>",
  "retryable": false,
  "docs": "https://docs.uarpie.app/errors/EGRESS_NOT_ALLOWED"
}
```

Apply `fix` (edit `file` when it is given), then run the same command again.