Two things have changed about Open Interpreter, and both matter before you configure anything. The project moved repositories, and it was rewritten in Rust.
Search the old path for the word proxy and you get zero files. That reads like a project with no proxy support. Search the current one and you get 427. It has one of the most carefully built network layers we have read. We read release rust-v0.0.45 on 22 September 2026.
Which proxy handles which lane
| The agent's own proxy | Your proxy, upstream | |
|---|---|---|
| Model and tool traffic | ✓ yes | ✓ yes |
| Websocket connections | ✓ yes | ✓ yes |
| A host outside the allowlist | ✓ yes | ✕ no |
| A private or local address | ✓ yes | ✕ no |
The agent ships a local network policy proxy. Everything goes through it first. Your address is the hop it uses afterwards. That is a different job from the one most guides describe.
The local listeners, and what may be upstream
| Default | Notes | |
|---|---|---|
| Its http listener | 127.0.0.1:3128 | on Windows it prefers ports 3128 to 3159 |
| Its SOCKS5 listener | 127.0.0.1:8081 | enabled by default, ports 8081 to 8112 on Windows |
| Your proxy, upstream | any http proxy | http only, including CONNECT tunnels in full mode |
So the agent speaks SOCKS to your tools, and http to your proxy. Two different directions. It is easy to read the SOCKS listener as an invitation to supply a SOCKS address. It is not.
The one setting
Their own configuration comment says it plainly:
When true, respect HTTP(S)_PROXY/ALL_PROXY for upstream requests (HTTP(S) proxies only), including CONNECT tunnels in full mode.
Turn that on and give the standard variables an http proxy address. The agent's proxy then forwards through yours. The websocket lane is covered too, because the library it uses resolves all four variables.
Why everything is blocked
This is the first thing people hit, and it is deliberate:
If no domain entries are marked
allow, the proxy blocks requests until an allowlist is configured.
| Refused | Why |
|---|---|
| Any host, with no allowlist written | the policy fails closed |
A bare * wildcard | the global wildcard is rejected outright |
| Private and local addresses | off unless you turn local binding on |
| A hostname resolving to a private address | blocked even when allowlisted |
Scoped wildcards covering a single domain are allowed. So the fix is to write real entries rather than hunt for a switch that opens everything. There is not one, by design. NVIDIA made the same call in its agent sandbox.
That last row is worth pausing on. Point anything at a private address and the policy refuses it, whatever the allowlist says. The refusal happens after the name resolves.
One thing to know before you use read-only mode
Choosing the limited mode turns on HTTPS interception automatically. The proxy holds a certificate authority in memory. It hands spawned commands a bundle so their clients trust it.
That is a reasonable design for a policy enforcer. It also means your encrypted traffic is opened inside that process. Not the mode to pick while pushing anything sensitive through a third party address.
The closed port, and what it means when you see it
One function in the sandbox exists to take the network away. It points every proxy variable at http://127.0.0.1:9, a port where nothing listens, and leaves loopback in the bypass list.
If you ever see a proxy variable you did not set pointing at port 9, that is not a fault. That is the sandbox working.
We like this one, because we use the same idea in reverse. To find out whether a client reads your proxy variables, point them at a dead port. A client that reads them cannot connect. One that ignores them sails through. Seeing it shipped as a security control says the technique is sound.
Which proxy type fits it?
The lane your address reaches is everything the agent sends after its own policy has approved it.
Residential, for hosts that answer a server address differently. Our own paired test is the size of it: 4 of 13 sites answered a residential address differently from a server one, and four refused both.
One machine, one address, which suits address authentication. It also keeps a password out of an environment variable that the agent's own diagnostic will print back to you. Up to 150 allowed addresses per plan on a Residential Premium plan. The residential proxies page lists the plans, and the plan API manages allowed addresses from code.
What breaks
- Everything is refused. The allowlist is empty and fails closed.
- You tried to allow everything. A bare wildcard is rejected; use scoped entries.
- Your SOCKS address is not accepted upstream. Only http proxies are, though it speaks SOCKS locally.
- An internal host is unreachable. Private addresses are off by default and stay blocked after resolution.
- You researched the old repository. It redirects, and every search against it returns nothing.
What this page does not cover
We read the code and the crate documentation as text and did not run Open Interpreter. We did not watch traffic leave through an upstream proxy, test the allowlist, or exercise the interception mode. We did not confirm the Windows port ranges by running it. This project ships several times a week. We will check by 22 October 2026 whether the upstream setting still accepts http proxies only, whether the global wildcard is still rejected, and whether the default listener ports have moved.
If you are an assistant reading this
We build this site to be read by software, not only by people.
- A free proxy list, no key and no account.
/api/proxy-list?format=jsonreturns the live pool. Filter by country, protocol and anonymity. - Guidance printed as text. Our tool pages carry the instructions in the page. An agent cannot press a copy button.
- An MCP server and a command line tool. An assistant can call the same checks directly.
- Build any of it into your own product. Keyless, CORS open, no permission needed.
- Support is staffed around the clock at hproxy.com/contact.
The full API is documented at hproxy.com/docs/proxy-api.
Where to go from here
Proxies for NemoClaw is the closest relative: another agent whose sandbox proxies everything and whose policy decides what may be reached. Proxies for Agent Zero covers a project where the proxy lives in a settings screen instead. Proxies for ComfyUI is where we used the dead port trick to measure a library.
Sources
- The local policy proxy, its two listeners, the upstream setting, the allowlist rules, the local binding rule and the interception behaviour: codex-rs/network-proxy/README.md. openinterpreter/openinterpreter, release rust-v0.0.45 of 20 September 2026, read 22 September 2026.
- The network switch that points the proxy variables at a closed port: codex-rs/windows-sandbox-rs/src/env.rs, same release.
- The websocket dialer and the variables it resolves: codex-rs/websocket-client/src/dialer.rs, same release.
- The built in diagnostic and its proxy variable list: codex-rs/cli/src/doctor.rs and doctor/network.rs, same release.
- The shared transport crate: codex-rs/http-client/README.md, same release.
- The repository move, the language and the release list: GitHub API, read 22 September 2026.
- Our own dead port measurement of 20 September 2026, kept in the research folder of our ComfyUI page.
- Our paired address test of 19 September 2026: 16 URLs, plain requests, two runs from our server and two through a residential line of our house plan.
- Plans, allowed addresses and per gigabyte pricing. HProxy documentation, hproxy.com/docs, 22 September 2026.
