Most projects in this series have no proxy support and we have to go looking for a door. NemoClaw has the opposite problem. Search its code for the word proxy and 870 files answer, and almost none of them are about yours.
NVIDIA's sandbox runs a proxy of its own in front of every agent, and a network policy decides what that proxy will connect to. Your proxy is a second hop. Knowing which one is refusing you saves the whole afternoon. We read tag v0.0.127 on 21 September 2026.
Whose proxy is in the path
Read the last row first. A host the policy does not allow is refused whatever you configure. A contributor reported exactly that the day we read the code: the baseline policy allowed one service endpoint and
denies HTTPS CONNECT to portal.nousresearch.com. The request is rejected by the sandbox proxy before it reaches the origin service
So when an agent cannot reach something, your first question is not which proxy to set. It is whether the policy allows the host at all.
Where your proxy goes
On the host, in the ordinary variables. The onboarding collects HTTP_PROXY, HTTPS_PROXY, NO_PROXY and their lowercase spellings and carries them in. A named allow list forwards the same six into the processes the agent spawns, which is where the agent's own fetching happens. The list beside it covers certificates, starting with SSL_CERT_FILE, which is what an intercepting company proxy needs.
That alone puts this project ahead of most of the field. It is proxy aware on purpose rather than by accident.
The seven hosts it keeps off your proxy
Here is the part worth stealing. When a proxy is present, the sandbox adds seven hosts to your bypass list:
Added to NO_PROXY | What it protects |
|---|---|
localhost, 127.0.0.1, ::1, 0.0.0.0 | the agent reaching its own services |
host.docker.internal, host.containers.internal | the container reaching the machine it runs on |
inference.local | managed inference, which must not leave through your proxy |
Their own comment says the goal plainly: keep host loopback, container host aliases and managed inference off any forwarded host proxy chain. Your existing entries are kept and theirs are appended, so nothing you set is thrown away.
And then the detail that made me sit up:
Keep both spellings identical so a consumer's case precedence cannot discard exclusions configured through the other spelling.
Clients disagree about whether the uppercase or lowercase variable wins. This writes both to the same value so the disagreement cannot cost you anything. It is the most careful handling of these variables we have read in this whole series, and it quietly prevents the bug that breaks agents elsewhere, where loopback traffic goes through the proxy and the agent cannot reach its own services.
The login question, answered better than anywhere else
This project looks inside your proxy address for a username and password. Two functions exist for nothing else.
And when it finds one, it refuses to remember it:
Non-secret replay intent. Proxy credentials remain launch-only and never enter the canonical startup profile or durable receipt.
A proxy address without a login gets written into the saved startup profile. One with a login does not, and the profile records instead that you will have to supply it again.
| Proxy login in the URL | Allowed address | |
|---|---|---|
| Written to the saved profile | no, by design | yes |
| Needed again at each launch | yes | no |
| Can appear in a durable receipt | no, by design | nothing to appear |
That is correct engineering, and it has a practical consequence: on this project an allowed address fits better than a password. Not because a password is unsafe here, but because the sandbox deliberately forgets it, and you will be typing it again every single launch.
Why you cannot simply open the policy
The obvious workaround is to allow everything in the network policy and let your proxy sort it out. The policy validator is built to stop that. It rejects catch-all endpoints and tells you to name a specific public hostname instead, while permitting scoped subdomain wildcards such as one covering a single domain.
Which is the right call. A sandbox whose policy says everything is not a sandbox. It does mean a blocked host is a policy edit, not a proxy setting, and the page you are reading cannot sell you out of that.
One more thing you may find and should leave alone: the managed lanes have their own trusted proxy variable. It is not yours to set, and an open report shows the project is currently tightening what happens when someone forges it.
Which proxy type fits it?
The lane your address touches is the agent fetching public sites, and whatever it spawns to do that. Managed inference and managed search never use it, because the gateway holds those keys and makes those calls itself.
Residential, for hosts that answer a server address differently. Our own paired test is the honest size of it: 4 of 13 sites answered a residential address differently from a server one, and four refused both.
One sandbox host, one address, which suits address authentication. Here that is more than tidiness: it matches how the project chooses to store things. The machine is allowed by its address, up to 150 per plan on a Residential Premium plan. The residential proxies page lists the plans, and the plan API manages allowed addresses from code.
What breaks
- A host is refused although your proxy works. The policy does not list it. Edit the policy.
- You tried to allow everything. Catch-all endpoints are rejected by design.
- Your login vanishes between launches. That is deliberate, and an allowed address is the way around it.
- Local inference stopped working. Check that the bypass list still carries the seven local hosts.
- You searched the code for proxy. Most of the 870 files are the sandbox proxy, the DNS proxy, or a reverse proxy in front of local inference.
What this page does not cover
We read the code and the issue tracker as text and did not run NemoClaw, so we did not watch a request leave through an address and did not test a policy edit. We did not launch a sandbox twice to watch the credential behaviour, and we did not test an intercepting company proxy with its certificate. The project publishes no releases, only tags, and it was pushed again on the day we read it, with 709 open issues and pull requests. We will check by 21 October 2026 whether the bypass list still holds seven hosts, whether proxy credentials are still launch only, and whether the catch-all rule has changed.
Where to go from here
Proxies for NanoClaw is the closest relative: another sandbox where the address belongs at the gateway rather than in the agent. Proxies for OpenClaw covers one of the agents this sandbox runs, on its own. Proxies for ComfyUI is the opposite case, where no setting exists and half the program ignores the variables anyway.
Sources
- The sandbox proxy refusing a host at CONNECT, and the policy as its allow list. NVIDIA/NemoClaw issue 12166, opened 21 September 2026, read the same day.
- The host proxy variables and the credential detection: src/lib/onboard/host-proxy-env.ts, tag v0.0.127.
- The seven local hosts, the appended bypass list and the case precedence comment: src/lib/proxy/local-no-proxy.ts, same tag.
- Proxy credentials kept launch only: src/lib/onboard/managed-startup/onboard-profile.ts, same tag.
- Catch-all hosts rejected in policy endpoints: src/lib/policy/semantic-validation.ts, same tag.
- The proxy and certificate variables forwarded to subprocesses: nemoclaw/src/lib/subprocess-env.ts, same tag.
- Managed search keys kept gateway side and rewritten at egress: src/lib/onboard/web-search-verify.ts, same tag.
- The trusted fetch proxy variable being hardened: issue 12127, 20 September 2026.
- Repository facts, tags and issue counts: GitHub API, read 21 September 2026.
- Our paired address test of 19 September 2026: 16 URLs, plain requests, two runs from our server and two through a residential line of our house plan.
- Plans, allowed addresses and per gigabyte pricing. HProxy documentation, hproxy.com/docs, 21 September 2026.
