Proxies for Hermes Agent: the browser, search and model calls

Hermes Agent sends traffic out on five paths: the model calls, the chat gateway, the web tools, the browser and the terminal. The usual advice is to set HTTPS_PROXY, and it reaches more than you want and less than you think. It moves your model calls, which a proxy billed per gigabyte then counts. It moves the local browser only through a fallback in the browser's helper. It never reaches web_extract through a vendor, because the vendor's servers load those pages. The browser has its own setting, AGENT_BROWSER_PROXY, and the keyless search has DDGS_PROXY. We read every setting on this page in the docs and code of Hermes Agent v2026.9.14, released on 14 September 2026. We also read agent-browser 0.26.0, the browser helper it installs.

Two Hermes commands carry the word proxy and change nothing here. hermes egress runs a firewall that keeps API keys out of Docker sandboxes. hermes proxy shares your model subscription with other apps. Neither changes the IP a website sees.

Which Hermes traffic leaves from your IP?

Follow each path to the machine that sends the request to the website. Only that machine's IP counts for a block.

A fresh install sends web_search and web_extract to the free tiers of Exa, Parallel, Firecrawl and Keenable, in turn. With a key, it sends them to the vendor you picked. In both cases the vendor does the fetching, and your proxy carries at most the call to its API. If a site blocks the vendor, a proxy on your side does not help. Run hermes setup to see which backend is active.

Why does Hermes get blocked on a server?

The browser and DDGS leave from your server, and many sites judge that IP first. We tested this on 19 September 2026. Thirteen sites got the same plain request twice from our server, which sits in a hosting network. Each got it twice more through a residential line. Both sides ran within five minutes.

DuckDuckGo matters most for Hermes, since DDGS searches from your machine. Its HTML search failed the TLS handshake on 3 of 5 requests from our server that day. Through the residential line it answered both times. Our test used curl, while ddgs sends a browser's TLS fingerprint. Read it as a sign of the server IP's standing, not as a result for DDGS.

Indeed and Glassdoor answered with Cloudflare's page, "Enable JavaScript and cookies to continue". A plain request runs no script, whatever its IP. Those sites need the browser, with a residential IP behind it. We did not test whether that pair passes. The full table per site is on our OpenClaw page.

Which setting reaches which traffic?

Each Hermes path reads its own names. The chart shows which setting reaches which traffic.

How do I put the Hermes browser behind a proxy?

It takes four steps: the setting, a restart, the login and a check.

Step 1: set AGENT_BROWSER_PROXY in ~/.hermes/.env

# ~/.hermes/.env
AGENT_BROWSER_PROXY=http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT

Hermes loads ~/.hermes/.env into its own process at start, and its values beat the shell's. That matters for a gateway run as a service. On macOS, the service that hermes gateway start writes drops the proxy settings of your shell, as issue #41906 reports. It still reads this file.

Hermes starts the browser through a helper called agent-browser. First it removes its known secrets from the helper's settings, by name, and no proxy name is on that list. The helper reads AGENT_BROWSER_PROXY first, then a proxy in its own config file. Without either, it falls back to HTTP_PROXY, then HTTPS_PROXY, then ALL_PROXY. Both local modes start their Chromium this way: the default Browser Use mode and the built-in browser tools.

Unlike OpenClaw, Hermes needs no security switch for a browser behind a proxy. Its URL check still resolves each host itself, so there is nothing to turn off.

Step 2: restart Hermes

Hermes reads ~/.hermes/.env when it starts, so restart it after the change. If the agent runs in the gateway, run hermes gateway restart. The helper then compares the proxy on every command. When the proxy has changed, it closes the old browser and starts a new one behind the new line.

Step 3: mind the two limits of the login

The helper takes the username and password out of the URL. It starts Chrome with the bare address and answers the proxy's login request over Chrome's DevTools protocol. OpenClaw does not do this, so on Hermes a line with a password works without a forwarder. Two limits remain in version 0.26.0, the one Hermes installs.

• SOCKS5 gets no login. Chromium's own docs say: "No authentication methods are supported for SOCKSv5 in Chrome". Use an http:// line, or a SOCKS5 line that allows your server's IP.
• Only the first tab is covered. The helper answers the login on the tab that is active at launch. A tab opened later gets no answer, such as a link that opens a new window or a tab that the Browser Use tool opens. Its requests meet the proxy's login request and nobody replies. We read this in the code and did not see it in a run.

An allowed IP removes both limits. Put your server's IP on the proxy's allow list and leave the login out of the URL. If you keep the login, write the password as it is. The helper splits the URL at the last @ and does not decode percent signs.

Step 4: check the IP the sites see

Ask the agent to open https://api.ipify.org in its browser. Then run curl https://api.ipify.org on the server itself. If the two answers differ, the browser leaves through the proxy.

Do not read the warning "Running WITHOUT residential proxies" as a verdict on your proxy. Hermes shows it on the first page of every session that lacks Browserbase's proxy flag, and that includes the local browser. Issue #54197 asks to remove it there.

How do I send Hermes' searches through a proxy?

It depends on the backend.

• DDGS. Add DDGS_PROXY to ~/.hermes/.env. Hermes hands no proxy to the ddgs library, and the library then reads this name. Hermes has no setting of its own for it yet, as issue #102412 notes. Despite the name, ddgs asks several engines, from Bing and Brave to Google and Yandex, all from your machine. A rotating line suits it, since each search stands alone.
• SearXNG. SearXNG sends the searches from its own host, so the proxy goes in its settings.yml, under outgoing. Hermes only calls SearXNG's JSON endpoint.
• A Firecrawl you host. It loads pages from its own host and takes PROXY_SERVER, PROXY_USERNAME and PROXY_PASSWORD in its own .env.
• Vendors. Firecrawl's cloud, Tavily, Exa, Parallel, Keenable and Perplexity load the page on their side. There is nothing to set in Hermes.

# ~/.hermes/.env
DDGS_PROXY=http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT

# settings.yml of your SearXNG, with your server's IP allowed on the proxy
outgoing:
  proxies:
    all://:
      - http://GATEWAY_HOST:GATEWAY_PORT

Should HTTPS_PROXY carry the model calls?

Only if your network requires a proxy. Hermes' model client reads HTTPS_PROXY, then HTTP_PROXY, then ALL_PROXY, and a socks5:// URL works too. On a line billed per gigabyte, every prompt and every streamed answer then counts. The blocks in our test sat on websites, not on model hosts.

If you do set HTTPS_PROXY, keep the model host out with NO_PROXY. Hermes matches exact hosts, *.domain forms, IP addresses and ranges such as 10.0.0.0/8. The open issue #59465 says ranges are ignored, but the code in v2026.9.14 handles them.

# ~/.hermes/.env
NO_PROXY=openrouter.ai,api.openai.com,localhost,127.0.0.1

The chat gateway has its own names. TELEGRAM_PROXY and DISCORD_PROXY override HTTPS_PROXY and take http://, https:// and socks5:// URLs. They matter where your network blocks those apps.

Which proxy type fits Hermes?

Match the proxy to the path. The refusals in our test sat on the websites, and several judged only the IP. A datacenter proxy leaves from a hosting network, like your server, so it lifts few of them. For the browser, use a sticky residential line, so one visit keeps one IP. A page load pulls many files, and a login spans many pages. For DDGS, use a rotating line. Leave the model calls direct.

Browser traffic is heavy. In our bandwidth study, a headless browser pulled 6.54 MB per protected page. Put paid residential IPs on the browser and the searches only.

HProxy residential gateways fit both paths. Allow your server's IP on a Residential Premium plan, up to 150 per plan, and point AGENT_BROWSER_PROXY at a sticky port with no password. That also avoids both limits of the login. An allowed IP takes no country or city targeting. When a task needs a country, use a generated line with the targeting in its username. Give DDGS_PROXY a rotating line from the same plan. The residential proxies page lists the plans, and the plan API generates lines and manages allowed IPs from code.

What breaks when the proxy is on?

• The IP did not change. Hermes still holds the old value from its start. Restart Hermes, or the gateway.
• Only the first tab loads. A line with a password meets a new tab, the limit from step 3. Use an allowed IP.
• SOCKS5 fails in the browser. Chrome sends no SOCKS5 login. Use an http:// line.
• 407 Proxy Authentication Required. The proxy refused the login. On our gateways this means a wrong password or a line from another plan. Our 407 guide walks through it.
• The gateway lost its proxy after a restart on macOS. The service drops the settings of your shell. Put them in ~/.hermes/.env.
• Hermes says your API key is wrong, but it is not. A Cloudflare check from the model host is read as a failed login, as open issue #70566 reports. Check the network path before you change keys.
• Model calls got slow or cost traffic. HTTPS_PROXY carries them. Add the model host to NO_PROXY.

What this page does not cover

We read the docs and code of Hermes Agent v2026.9.14 and of agent-browser 0.26.0. We did not run either. The blocking test used plain requests from one server IP and one residential line, over one afternoon. It did not run Hermes' browser or the ddgs library. The limit on new tabs comes from reading the code, not from a run. We did not check whether primp, the client under ddgs, also reads HTTPS_PROXY, so this page names only DDGS_PROXY. Hermes ships every few days, so we will read these settings again at the newest release by 19 October 2026.

Where to go from here

Proxies for OpenClaw covers the other big agent, whose browser ignores the proxy names. Proxies for browser-use covers the project whose CLI drives Hermes' default browser mode. Proxies for AI agents covers the job in general. Sticky vs rotating sessions explains the choice above. How websites detect proxies explains the checks behind the refusals.

Sources

• Browser Automation, Web Search and Extract, Environment Variables, Egress proxy and Subscription Proxy. Hermes Agent documentation, website/docs, release v2026.9.14, 14 September 2026.
• process_bootstrap.py, proxy_bypass.py, browser_tool.py, browser_use_cli.py, env_loader.py, local.py, local_env_policy.py, url_safety.py and the ddgs provider. Hermes Agent source code, release v2026.9.14, read on 19 September 2026.
• flags.rs, main.rs, connection.rs, chrome.rs, actions.rs and browser.rs. agent-browser source code, release v0.26.0, 16 April 2026.
• ddgs.py and the engines folder. ddgs source code, release v9.16.0, 26 August 2026.
• net/docs/proxy.md, the SOCKS section. The Chromium Authors, read on 19 September 2026.
• The outgoing settings. SearXNG documentation, read on 19 September 2026.
• SELF_HOST.md, the proxy settings. Firecrawl, release v2.11.0, 19 June 2026.
• Issues #102412, #41906, #54197, #70566, #59465, #6023, #11609 and #5454. NousResearch/hermes-agent issue tracker, April to September 2026.
• Plans, IP whitelist and sticky sessions; errors; the proxy API. HProxy documentation, hproxy.com/docs, 19 September 2026.
• Headless browsers and proxy bandwidth. HProxy data study, 6 August 2026, updated 1 September 2026.
• Our own test of 19 September 2026: plain GET requests to 13 sites and 3 controls, two runs from our server and two through a residential line of our own house plan, with curl 8.5.0. Raw output is kept in the page's research folder.