diff --git a/src/server/authz/routeGuard.ts b/src/server/authz/routeGuard.ts
index f077f274ac..18636c1d4d 100644
--- a/src/server/authz/routeGuard.ts
+++ b/src/server/authz/routeGuard.ts
@@ -31,6 +31,8 @@ export const LOCAL_ONLY_API_PREFIXES: ReadonlyArray<string> = [
   "/api/services/", // T-10: embedded service lifecycle (spawn child processes)
   "/dashboard/providers/services/", // T-07: reverse proxy to embedded service UIs
   "/api/copilot/", // unauthenticated LLM driver — CLI-only by default; admins can opt-in to remote access via manage-scope bypass
+  "/api/tools/agent-bridge/", // F5: start/stop MITM server + DNS edits
+  "/api/tools/traffic-inspector/", // F6: http-proxy listener + system proxy
 ];
 
 /**
@@ -51,6 +53,8 @@ export const LOCAL_ONLY_API_PREFIXES: ReadonlyArray<string> = [
 export const SPAWN_CAPABLE_PREFIXES: ReadonlyArray<string> = [
   "/api/cli-tools/runtime/",
   "/api/services/", // T-10: can run npm install + spawn node processes
+  "/api/tools/agent-bridge/", // start/stop MITM server + DNS edits
+  "/api/tools/traffic-inspector/", // http-proxy listener + system proxy
 ];
 
 /**