ZeroClaw is a Rust agent that talks to model providers, chat channels and a set of tools. It also has the most complete proxy configuration we have read in this series, which is worth a page on its own. We read release v0.8.5 on 20 September 2026.
One thing to separate first. The deployment guide has a proxy section, and it is about the other direction: putting nginx or Caddy in front of the gateway. This page is about outbound traffic, which is a different setting entirely.
The setting
The configuration has a proxy block with enabled, three address fields, a bypass list, a scope and a service list. Addresses may be http, https, socks5 or socks5h. Nothing is routed until you enable it.
| Scope | What it routes |
|---|---|
environment | only what the system proxy variables already route |
zeroclaw | all traffic the agent manages, the default once enabled |
services | only the selectors you list |
That third scope is the one we have not seen anywhere else.
One service at a time
Thirty service keys can be selected. Eight model providers, eleven chat channels, five tools, memory embeddings, a tunnel and three transcription services.
So you can route the model calls through a line in another country and leave the chat channels on the server's own address. Or route the browser tool and nothing else. Or put the transcription service on a different line from everything else. The selectors read like this:
[proxy]
enabled = true
scope = "services"
services = ["model_provider.openai", "tool.browser", "channel.telegram"]
https_proxy = "http://user:pass@gate.example.com:8080"
That granularity is the difference between buying traffic for one tool and buying it for everything an assistant does all day.
The two that refuse
Two tools cannot be routed, and the project explains why. Both validate an address before connecting and then pin it, so the connection goes to the address that was checked. A proxy would replace that with its own lookup, and the pinning would mean nothing.
Rather than silently dropping the pinning or silently ignoring the setting, selecting those tools makes the request fail closed. Their own words: cannot be proxied, and selecting this key makes the request fail so its validated answer stays pinned. Even an enabled environment scope is rejected for those two.
This is the fifth tool in this series to meet that conflict, and the first to fail loudly. nanobot drops the pinning when a proxy is set. PicoClaw keeps its guard and allows one hop to your proxy. Langflow keeps the pinning and refuses the proxy with a named error. This one makes it a per service decision and refuses only where it must.
The warning nobody else writes
One sentence in the configuration documentation is worth more than most of this page:
Unmanaged process proxy variables are warned when ignored.
Three of the projects we have read this month quietly ignore an exported proxy variable. The user exports it, sees no error, and assumes the traffic is routed. Here you get a warning in the log.
If you have ever lost an afternoon to that, you know what that line is worth.
The agent can change it
The proxy configuration is also a tool the model can call, with six actions: get, set, disable, list_services, apply_env and clear_env.
| Action | What it does | Needs write access |
|---|---|---|
get | reports the current settings | no |
list_services | lists the selectors and the refusals | no |
set | changes the configuration | yes |
disable | turns the proxy off, optionally clearing the variables | yes |
apply_env | exports the setting to the process environment | yes |
clear_env | removes those variables again | yes |
The write actions run through the security policy rather than straight into the file. And the export is a separate action from the setting, which is the right distinction: a configuration value applies to what the agent does, while an exported variable also applies to whatever it launches.
Which proxy type fits it?
Residential, for the services that treat a hosting address differently. Our own paired test is the size of that effect: 4 of 13 sites answered a residential address differently from a server one, with plain requests of the kind a tool call sends.
The per service scope is what makes this cheap. An assistant running all day sends a lot of traffic to model providers and chat channels, and almost none of it needs a different address. Pick the two or three services that do, and a per gigabyte line will last a long time.
One practical note. The configuration is a file this agent can read and write itself, so a login inside it is worth avoiding. An allowed address removes that: on a Residential Premium plan your machine's address can be allowed, up to 150 per plan. The residential proxies page lists the plans, and the plan API manages allowed addresses from code.
What breaks
- A tool call fails after you enable the proxy. You selected one of the two that pin their addresses. Remove that selector.
- Nothing is routed. The section is off by default, and the scope decides the rest.
- Your exported variable does nothing. That is the environment scope's job, and you should see a warning.
- A child process still goes direct. Setting the configuration is not the same as exporting it. There is a separate action for that.
- You found a proxy section about nginx. That is the deployment guide, and it is the other direction.
What this page does not cover
We read the release as text and did not run the agent, so we did not watch a request use an address, did not exercise the tool and did not see the warning it promises. We read the proxy tool, the proxy part of the configuration schema and the deployment guide closely, and did not read the HTTP client that consumes the setting, so we describe what the configuration promises rather than tracing a request through it. This repository was pushed to minutes before we read it and the release is two weeks old, so check your version. We will read it again by 20 October 2026.
Where to go from here
Proxies for PicoClaw covers the other Rust agent in this series, where a single field routes everything and the private address guard makes one exception. Proxies for nanobot covers the same pinning conflict resolved by dropping the protection. Proxies for Langflow covers it resolved by refusing the proxy.
Sources
- The proxy configuration block, its three scopes, the thirty service keys, the note about pinned tools and the warning about ignored process variables (crates/zeroclaw-config/src/schema.rs). The runtime tool with its six actions, its parameter schema, its write gate and its constraint listing (crates/zeroclaw-tools/src/proxy_config.rs). zeroclaw-labs/zeroclaw, release v0.8.5 of 5 September 2026, read 20 September 2026.
- The reverse proxy section that is about the other direction. ZeroClaw network deployment guide, docs/book/src/ops/network-deployment.md, same release.
- Our paired address test of 19 September 2026: 16 URLs, plain requests, two runs from our server and two through a residential line of our house plan. Raw output is kept in the research folder of our OpenClaw page.
- Plans, allowed addresses and per gigabyte pricing. HProxy documentation, hproxy.com/docs, 20 September 2026.
