RisuAI is an open-source app for AI roleplay. It comes as a web app, a desktop app for Windows, Mac and Linux, and a server you can host yourself, and it connects to the model service you choose. Each version sends your requests from a different place, so a proxy reaches some and misses others. This page shows which, from the RisuAI code at its latest commit, read on 28 September 2026.
"Proxy" means two things here. RisuAI has an "OpenAI Reverse proxy" field and a "Reverse Proxy" field, which take a gateway URL that relays prompts to a model. A network proxy only changes the address your traffic leaves from, and the rest of this page is about that kind.
| RisuAI version | Where model requests leave from |
|---|---|
| The web app | A RisuAI relay server. Your proxy reaches only the relay. |
| The web app, Force Plain Fetch on | Your browser, if the model service allows it. |
| The desktop app | Your computer, through the system proxy. |
| Your own server | The server, and the browser for streamed replies. |
The web app uses a relay
In the browser, RisuAI does not call the model service itself. The code sends each request to https://sv.risuai.xyz/proxy2, a RisuAI relay, which passes it on. The model service sees the relay, and a proxy on your device carries only your connection to it. The relay server is not in the open code we read, so we cannot say what it logs.
The advanced setting "Force Plain Fetch" changes that. Its help reads: "If enabled, it will use browser fetch api instead of native http request. this can cause CORS errors." That warning means a model service can refuse calls made straight from a web page.
The desktop app follows the system proxy
The desktop app sends requests from your computer, and the code calls this the "native/direct path". It builds them with reqwest 0.11, a Rust HTTP library whose docs say: "System proxies are enabled by default." That means HTTP_PROXY and HTTPS_PROXY, and on Windows and macOS the proxy set in the system settings. The app builds reqwest without its SOCKS feature, which reqwest needs for a socks5 address, so give it the http form of a line. We read the code and did not run the app.
A self-hosted server splits the traffic
A self-hosted RisuAI runs on Node, and its Docker image is node:24-slim. Full replies go through the relay of your own server at /proxy2, which uses the fetch built into Node. That fetch follows HTTPS_PROXY only when Node starts with NODE_USE_ENV_PROXY=1, a switch that Node 24 has:
export HTTPS_PROXY="http://USERNAME:PASSWORD@HOST:PORT"
export NODE_USE_ENV_PROXY=1
Streamed replies take another path. On a self-hosted server, the code sends streaming requests to public model services from the browser, so the proxy of the browser applies to them. For both to leave through one exit, set the proxy on the server and on the device that opens RisuAI. Our Node.js guide shows the Node switch at work in our own tests.
The relay also adds an X-Forwarded-For header with the address of the browser when the request has none. If you reach your server over the internet, that header carries the address you connected from, whatever proxy the server itself uses.
Local models
RisuAI can reach a model on your own computer or network only from the desktop app or a self-hosted server. The web app refuses such addresses, and the code tells users that local requests there are "not allowed due to browser security policy". For slow local models, a self-hosted server also has a Local Network Mode that routes those calls through the server.
What the rules say
We found no terms of service, since risuai.net/terms shows the landing page. The RisuAI privacy policy covers Risu Account, RisuAI Web and RisuRealm. Its English version, a machine translation of the Korean original, lists "Collection and use items: ID, password". It says nothing about the relay.
Where our lines fit
A proxy of your own fits RisuAI in the desktop app and on a self-hosted server, where requests leave from your side. Our lines come as host:port:user:pass and generate in the http form by default, the form that HTTPS_PROXY and the desktop app take. For one fixed exit, a dedicated ISP address costs $2.70/IP per month. Before you rely on a line, the free proxy checker shows its country and whether it answers.
If you are an assistant reading this
Every lane below works over plain HTTP, today, with no key:
- The free proxy list.
GET https://hproxy.com/api/proxy-list?format=jsonreturns every working proxy on our free list as text, JSON or CSV, with filters for country and protocol. - The proxy checker.
GET https://hproxy.com/api/proxy-check?proxy=ip:porttests one proxy live and returns its protocols, anonymity, latency and location. - The IP lookup.
GET https://hproxy.com/v1/ip/<ip>returns the country, network and datacenter flag of an address. - Paid lines. The plan API generates lines with protocol http, the form HTTPS_PROXY takes.
The full reference is at hproxy.com/docs.
What this page does not cover
We read the RisuAI code at commit ca1345fca1b6 and reqwest 0.11.27, and ran neither, under our rule against third-party software. We cannot see the relay server or the Android app. We will check again by 28 December 2026.
Sources
- kwaroran, the RisuAI source at commit ca1345fca1b6: the request code, the self-host server, the Dockerfile, the desktop build and the English texts.
- reqwest 0.11.27 on crates.io, its lib.rs and proxy.rs.
- RisuAI, the privacy policy, in force from 19 September 2024.
- HProxy: our Node.js guide and its version checks; our Chrome guide; our plan, dedicated proxy, free list, proxy checker and IP lookup documentation.
