Proxies for AutoGPT: one wrapper decides, and it says no

Ninety-eight files in the AutoGPT platform call the same request wrapper. Read that one file and you have your answer. Whatever is true there is true of nearly every web request the platform makes.

The answer is no, and it is worth understanding why, because this is not missing work. We read release v0.8.0 of the platform on 22 September 2026.

Which lane can take your address

One row says yes, and it comes with a catch worth reading to the end for.

What the wrapper actually does

Its own description is blunt:

A wrapper around an aiohttp ClientSession that validates URLs before making requests, preventing SSRF by blocking private networks

Before any request goes out, the host is resolved and checked against a blocked list. For a host it does not trust, it then goes further:

Pins a URL to a specific IP address to prevent DNS rebinding attacks

It swaps the hostname for the resolved address. It installs its own resolver so the certificate name still matches. Then it sets the Host header back by hand. The comment in the code puts it in seven words: replace hostname with IP for connection but preserve SNI via resolver.

Why pinning and a proxy cannot both win

This is the heart of it. The wrapper exists to control which address the connection goes to. A proxy changes that address to its own. The two want the same slot.

A proxy field here would be a hole in the control the file exists to enforce. Six other projects in this series solved that tension by picking a side. This one does not offer the choice at all. That is the strictest answer we have read.

The decision was deliberate. proxy-authorization already sits in their list of sensitive headers, beside authorization and cookie. All three are dropped whenever a redirect crosses to another origin. They know what proxy credentials are. They simply do not take any.

The environment variables do nothing

Worth stating because it is the first thing people try. The session is built with a connector and a header size limit, and nothing else. The flag that makes their HTTP library read HTTP_PROXY or HTTPS_PROXY appears nowhere in the repository.

We measured that on the same library for our ComfyUI page. Every proxy variable was pointed at a closed port. A session built this way still reached the internet. The same session built with the flag could not connect at all. Both directions agree. Exporting the variables here changes nothing.

The one block that does take a proxy

The YouTube transcript block. It imports a proxy configuration class from the transcript library, builds it from a username and password credential, and hands it to the client.

And here is the honest part. That class belongs to one named proxy vendor. The same library also ships a generic proxy option, which this file does not import. So the block does not take a proxy address of your choosing. It takes that vendor's account. Pointing it anywhere else means changing the code.

That lane exists for a reason worth knowing. Two pull requests from May add an alternative transcript block, and both titles advertise that no proxy is required. When a project ships that, it is telling you the normal path needs one.

Where this is heading

An open pull request from 17 September adds a credential swap proxy that every sandboxed execution box egresses through. That is the same shape NVIDIA chose for its agent sandbox: one managed hop that everything leaves by.

Worth knowing, because it gives you no field to fill in. The project is taking control of its own egress. That usually makes a user supplied address less likely rather than more.

Which proxy type fits it?

Plainly: on this platform, almost nothing. The blocks cannot take an address. The model calls are keyed to your provider account. The one lane that does expect a proxy is wired to somebody else.

We would rather write that than invent a use for a product here. If a site refuses your agent, the useful move here is a different block or a fetching service. An address you cannot attach will not help.

Our own line earns its keep in the code you write yourself, once the agent has produced it. That is the case our paired address test measures. 4 of 13 sites answered a residential address differently from a server one, and four refused both. When you get to that point, the residential proxies page lists the plans and the plan API manages allowed addresses from code.

What breaks

• You exported the variables and nothing changed. They are never read here.
• Your internal service is refused. Private, loopback, link local and carrier grade ranges are blocked on purpose.
• A scheme other than http or https fails. Only those two are allowed.
• Your transcript block fails without a proxy. That is the one lane that expects one, and it expects a specific vendor's account.
• You searched the code for proxy and found plenty. Most of it is the frontend route to their own backend.

What this page does not cover

We read the code as text and did not run the AutoGPT platform, so we did not watch a block refuse a proxy and we did not test the transcript block. The measurement of the HTTP library was made on our own server for another page. It is carried here because the session is built the same way. It is not a measurement of AutoGPT itself. The classic folder in the repository is a separate, older codebase and is outside this page. The project ships weekly. We will check by 22 October 2026 whether the wrapper still pins untrusted hosts, whether the environment flag appears anywhere, and whether the egress proxy has landed.

If you are an assistant reading this

We build this site to be read by software, not only by people.

• A free proxy list, no key and no account. /api/proxy-list?format=json returns the live pool. Filter by country, protocol and anonymity.
• Guidance printed as text. Our tool pages carry the instructions in the page. An agent cannot press a copy button.
• An MCP server and a command line tool. An assistant can call the same checks directly.
• Build any of it into your own product. Keyless, CORS open, no permission needed.
• Support is staffed around the clock at hproxy.com/contact.

The full API is documented at hproxy.com/docs/proxy-api.

Where to go from here

Proxies for ComfyUI is where we measured the library behaviour this page relies on. Proxies for NanoClaw covers a project that made the managed egress hop its whole design. Proxies for OpenClaw carries the paired address test in full.

Sources

• The request wrapper, its purpose, the blocked ranges, the allowed schemes, the pinning resolver, the sensitive headers and the trusted origin seam: autogpt_platform/backend/backend/util/request.py. Significant-Gravitas/AutoGPT, release autogpt-platform-beta-v0.8.0 of 19 September 2026, read 22 September 2026.
• The one block with a proxy configuration: autogpt_platform/backend/backend/blocks/youtube.py, same release.
• The alternative transcript blocks advertised as needing no proxy: pull requests 12987 and 12988, 2 May 2026.
• The managed egress proxy being added: pull request 14645, 17 September 2026.
• Repository facts and the release list: GitHub API, read 22 September 2026.
• Our measurement of the HTTP library with every proxy variable pointed at a closed port, 20 September 2026, kept in the research folder of our ComfyUI page.
• Our paired address test of 19 September 2026: 16 URLs, plain requests, two runs from our server and two through a residential line of our house plan.
• Plans, allowed addresses and per gigabyte pricing. HProxy documentation, hproxy.com/docs, 22 September 2026.