[OCI] opencodeintel.com classified as "grayware" by URL filters; blocks pilot users on corp/uni networks

[DevanshuNEU]

Why this exists

NEU's web filter blocks opencodeintel.com (and api., mcp. subdomains) with classification "Category: grayware". On port 80 the filter serves a "Web Page Blocked" page showing that category string. On port 443 it sends TCP RST, surfaced in Chrome as ERR_CONNECTION_RESET. Other Vercel and Railway sites (github.com, vercel.com) load normally from the same network, confirming the block is domain-specific, not a network outage.

Any pilot user on an enterprise / university network using PAN-DB, Cisco Talos, or a similar URL-category feed will likely hit the same wall. That includes most of the audience we want to put OCI in front of (Greptile, Solid, larger eng orgs whose corporate WiFi runs commercial URL filters by default).

Evidence (captured 2026-05-12 on NEU campus WiFi)

$ curl -4 http://opencodeintel.com
HTTP/1.1 503 Service Unavailable
<title>Web Page Blocked</title>
<p><b>Category:</b> grayware</p>

$ curl -4 https://www.opencodeintel.com
* TLS handshake, Client hello (1)
* Recv failure: Connection reset by peer
curl: (35) Recv failure: Connection reset by peer

$ curl -4 https://api.opencodeintel.com   # different IP, Railway-hosted
curl: (35) Recv failure: Connection reset by peer

$ curl -4 https://mcp.opencodeintel.com   # different IP, Railway-hosted
curl: (35) Recv failure: Connection reset by peer

$ curl -4 https://github.com              # sanity check
HTTP/1.1 200 OK

$ curl -4 https://vercel.com              # sanity check
HTTP/1.1 200 OK

What ships

• Submit category reclassification to Palo Alto PAN-DB for opencodeintel.com, api.opencodeintel.com, mcp.opencodeintel.com (submitted 2026-05-12)
• Submit dispute to Cisco Talos at https://talosintelligence.com/reputation_center
• Submit reclassification to Symantec/Broadcom at https://sitereview.symantec.com/
• File NEU ITS ticket requesting whitelist of *.opencodeintel.com for academic use
• Add a "Network access" section to the OCI README documenting the block, the three reputation-check links, and the bypass options (mobile hotspot, VPN) while reclassification propagates

Acceptance criteria

• PAN-DB Test A Site (https://urlfiltering.paloaltonetworks.com/) returns a non-grayware category for opencodeintel.com
• Talos reputation shows opencodeintel.com as Neutral or better
• Symantec sitereview returns a non-suspicious category
• opencodeintel.com loads from NEU campus WiFi without VPN (canonical test environment)
• README has a "Network access" section linking the three reputation checks

Wave

pre-thesis (Phase 1, pilot-reach infrastructure)

Dogfooding signal

yes — discovered 2026-05-12 while trying to load opencodeintel.com on NEU campus WiFi during an /oci session

Notes

This blocks no code path inside OCI itself. The site, API, and MCP server are healthy and reachable from any unfiltered network. The fix is entirely about domain reputation with third-party URL classifiers — slow to propagate but a one-shot ask.