feat: Add AI gateway and MCP gateway flags to network policy create (#7638)

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 118
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai%2Frunloop-1a92de99959f20ab5850a7f89db21cb66269b2e0002ffc5e5afbe660d05b0768.yml
-openapi_spec_hash: 41e4660f26e27e6ab94d223da4ec1253
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai%2Frunloop-dd0f43e15cb67179deaf86f83ae04c6fae4ff858ee33e82a3b89231566cdc5bb.yml
+openapi_spec_hash: 569176c1c4f48efd25a44fa526fad9d1
 config_hash: cbda3692cb48ab8582a0df1674b9e5c8

src/runloop_api_client/resources/network_policies.py

@@ -48,8 +48,10 @@ def create(
         self,
         *,
         name: str,
+        allow_ai_gateway: Optional[bool] | Omit = omit,
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
+        allow_mcp_gateway: Optional[bool] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -69,13 +71,19 @@ def create(
           name: The human-readable name for the NetworkPolicy. Must be unique within the
               account.
 
+          allow_ai_gateway: (Optional) If true, allows devbox egress to the AI credential gateway for
+              credential proxying. Defaults to false.
+
           allow_all: (Optional) If true, all egress traffic is allowed (ALLOW_ALL policy). Defaults
               to false.
 
           allow_devbox_to_devbox: (Optional) If true, allows traffic between the account's own devboxes via
               tunnels. Defaults to false. If allow_all is true, this is automatically set to
               true.
 
+          allow_mcp_gateway: (Optional) If true, allows devbox egress to the MCP hub for MCP server access.
+              Defaults to false.
+
           allowed_hostnames: (Optional) DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -96,8 +104,10 @@ def create(
             body=maybe_transform(
                 {
                     "name": name,
+                    "allow_ai_gateway": allow_ai_gateway,
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
+                    "allow_mcp_gateway": allow_mcp_gateway,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                 },
@@ -150,8 +160,10 @@ def update(
         self,
         id: str,
         *,
+        allow_ai_gateway: Optional[bool] | Omit = omit,
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
+        allow_mcp_gateway: Optional[bool] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         name: Optional[str] | Omit = omit,
@@ -168,10 +180,14 @@ def update(
         All fields are optional.
 
         Args:
+          allow_ai_gateway: If true, allows devbox egress to the AI credential gateway.
+
           allow_all: If true, all egress traffic is allowed (ALLOW_ALL policy).
 
           allow_devbox_to_devbox: If true, allows traffic between the account's own devboxes via tunnels.
 
+          allow_mcp_gateway: If true, allows devbox egress to the MCP hub.
+
           allowed_hostnames: Updated DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -195,8 +211,10 @@ def update(
             f"/v1/network-policies/{id}",
             body=maybe_transform(
                 {
+                    "allow_ai_gateway": allow_ai_gateway,
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
+                    "allow_mcp_gateway": allow_mcp_gateway,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                     "name": name,
@@ -334,8 +352,10 @@ async def create(
         self,
         *,
         name: str,
+        allow_ai_gateway: Optional[bool] | Omit = omit,
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
+        allow_mcp_gateway: Optional[bool] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -355,13 +375,19 @@ async def create(
           name: The human-readable name for the NetworkPolicy. Must be unique within the
               account.
 
+          allow_ai_gateway: (Optional) If true, allows devbox egress to the AI credential gateway for
+              credential proxying. Defaults to false.
+
           allow_all: (Optional) If true, all egress traffic is allowed (ALLOW_ALL policy). Defaults
               to false.
 
           allow_devbox_to_devbox: (Optional) If true, allows traffic between the account's own devboxes via
               tunnels. Defaults to false. If allow_all is true, this is automatically set to
               true.
 
+          allow_mcp_gateway: (Optional) If true, allows devbox egress to the MCP hub for MCP server access.
+              Defaults to false.
+
           allowed_hostnames: (Optional) DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -382,8 +408,10 @@ async def create(
             body=await async_maybe_transform(
                 {
                     "name": name,
+                    "allow_ai_gateway": allow_ai_gateway,
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
+                    "allow_mcp_gateway": allow_mcp_gateway,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                 },
@@ -436,8 +464,10 @@ async def update(
         self,
         id: str,
         *,
+        allow_ai_gateway: Optional[bool] | Omit = omit,
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
+        allow_mcp_gateway: Optional[bool] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         name: Optional[str] | Omit = omit,
@@ -454,10 +484,14 @@ async def update(
         All fields are optional.
 
         Args:
+          allow_ai_gateway: If true, allows devbox egress to the AI credential gateway.
+
           allow_all: If true, all egress traffic is allowed (ALLOW_ALL policy).
 
           allow_devbox_to_devbox: If true, allows traffic between the account's own devboxes via tunnels.
 
+          allow_mcp_gateway: If true, allows devbox egress to the MCP hub.
+
           allowed_hostnames: Updated DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -481,8 +515,10 @@ async def update(
             f"/v1/network-policies/{id}",
             body=await async_maybe_transform(
                 {
+                    "allow_ai_gateway": allow_ai_gateway,
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
+                    "allow_mcp_gateway": allow_mcp_gateway,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                     "name": name,

src/runloop_api_client/types/network_policy_create_params.py

@@ -17,6 +17,12 @@ class NetworkPolicyCreateParams(TypedDict, total=False):
     Must be unique within the account.
     """
 
+    allow_ai_gateway: Optional[bool]
+    """
+    (Optional) If true, allows devbox egress to the AI credential gateway for
+    credential proxying. Defaults to false.
+    """
+
     allow_all: Optional[bool]
     """(Optional) If true, all egress traffic is allowed (ALLOW_ALL policy).
 
@@ -30,6 +36,12 @@ class NetworkPolicyCreateParams(TypedDict, total=False):
     true.
     """
 
+    allow_mcp_gateway: Optional[bool]
+    """(Optional) If true, allows devbox egress to the MCP hub for MCP server access.
+
+    Defaults to false.
+    """
+
     allowed_hostnames: Optional[SequenceNotStr[str]]
     """(Optional) DNS-based allow list with wildcard support.
 

src/runloop_api_client/types/network_policy_update_params.py

@@ -11,12 +11,18 @@
 
 
 class NetworkPolicyUpdateParams(TypedDict, total=False):
+    allow_ai_gateway: Optional[bool]
+    """If true, allows devbox egress to the AI credential gateway."""
+
     allow_all: Optional[bool]
     """If true, all egress traffic is allowed (ALLOW_ALL policy)."""
 
     allow_devbox_to_devbox: Optional[bool]
     """If true, allows traffic between the account's own devboxes via tunnels."""
 
+    allow_mcp_gateway: Optional[bool]
+    """If true, allows devbox egress to the MCP hub."""
+
     allowed_hostnames: Optional[SequenceNotStr[str]]
     """Updated DNS-based allow list with wildcard support.
 

src/runloop_api_client/types/network_policy_view.py

@@ -10,6 +10,12 @@
 class Egress(BaseModel):
     """The egress rules for this policy."""
 
+    allow_ai_gateway: bool
+    """
+    If true, allows devbox egress to the AI credential gateway for credential
+    proxying.
+    """
+
     allow_all: bool
     """If true, all egress traffic is allowed and other fields are ignored.
 
@@ -19,6 +25,9 @@ class Egress(BaseModel):
     allow_devbox_to_devbox: bool
     """If true, allows traffic between the account's own devboxes via tunnels."""
 
+    allow_mcp_gateway: bool
+    """If true, allows devbox egress to the MCP hub for MCP server access."""
+
     allowed_hostnames: List[str]
     """DNS-based allow list with wildcard support.
 

tests/api_resources/test_network_policies.py

@@ -31,8 +31,10 @@ def test_method_create(self, client: Runloop) -> None:
     def test_method_create_with_all_params(self, client: Runloop) -> None:
         network_policy = client.network_policies.create(
             name="name",
+            allow_ai_gateway=True,
             allow_all=True,
             allow_devbox_to_devbox=True,
+            allow_mcp_gateway=True,
             allowed_hostnames=["string"],
             description="description",
         )
@@ -111,8 +113,10 @@ def test_method_update(self, client: Runloop) -> None:
     def test_method_update_with_all_params(self, client: Runloop) -> None:
         network_policy = client.network_policies.update(
             id="id",
+            allow_ai_gateway=True,
             allow_all=True,
             allow_devbox_to_devbox=True,
+            allow_mcp_gateway=True,
             allowed_hostnames=["string"],
             description="description",
             name="name",
@@ -240,8 +244,10 @@ async def test_method_create(self, async_client: AsyncRunloop) -> None:
     async def test_method_create_with_all_params(self, async_client: AsyncRunloop) -> None:
         network_policy = await async_client.network_policies.create(
             name="name",
+            allow_ai_gateway=True,
             allow_all=True,
             allow_devbox_to_devbox=True,
+            allow_mcp_gateway=True,
             allowed_hostnames=["string"],
             description="description",
         )
@@ -320,8 +326,10 @@ async def test_method_update(self, async_client: AsyncRunloop) -> None:
     async def test_method_update_with_all_params(self, async_client: AsyncRunloop) -> None:
         network_policy = await async_client.network_policies.update(
             id="id",
+            allow_ai_gateway=True,
             allow_all=True,
             allow_devbox_to_devbox=True,
+            allow_mcp_gateway=True,
             allowed_hostnames=["string"],
             description="description",
             name="name",