Giving an AI agent a proxy: environment variables, Playwright MCP and browser agents

The three problems agents create#

• Unpredictable targets. The agent decides where to go; you cannot pre-select datacenter for one site and residential for another. A residential exit is the safe default.
• Many hops per task. Search, open, click, read, repeat: a task is a session, and should stay on one exit while it lasts.
• Unbounded spending. An agent in a loop can fetch gigabytes. Give it a ceiling it cannot exceed.

Environment variables for the whole toolchain#

requests, HTTPX and urllib can read proxy environment variables in their default configurations. aiohttp requires ClientSession(trust_env=True), or an explicit proxy argument. Browsers and tools with their own network stacks may ignore these variables. Verify the exit from each tool and use NO_PROXY only for hosts that should connect directly.

export HTTPS_PROXY="http://AGENTUSER-cc-us-sid-task-4f2a-ttl-2h:PASS@res.proxy-cyber.com:9000"
export HTTP_PROXY="$HTTPS_PROXY"
export NO_PROXY="localhost,127.0.0.1,api.openai.com,api.anthropic.com"
python agent.py

Exclude the model provider's API hosts with NO_PROXY: the LLM calls do not need a residential exit and would only cost traffic.

Node.js agents#

On supported Node.js releases, NODE_USE_ENV_PROXY=1 enables HTTP_PROXY, HTTPS_PROXY and NO_PROXY for built-in fetch; --use-env-proxy is available in Node.js 22.21+ and 24.5+. An explicit undici ProxyAgent or EnvHttpProxyAgent is an alternative. Libraries with their own transports or custom agents need separate configuration, so test each tool rather than assuming the whole process is covered.

import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
setGlobalDispatcher(new EnvHttpProxyAgent()); // reads HTTPS_PROXY / NO_PROXY

Playwright MCP server#

The Playwright MCP server, used by Claude, ChatGPT-style tools and IDE agents to drive a browser, accepts a proxy at launch. Pass the gateway with a sticky username and the bypass list for local hosts.

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--proxy-server=http://res.proxy-cyber.com:9000",
        "--proxy-bypass=localhost,127.0.0.1"
      ]
    }
  }
}

Submit the server’s actual outbound public IPv4 in Access and wait for administrator activation. NAT or a VPN may change the address seen by the gateway. Password-free access works only after the entry is confirmed for the assigned service. Confirm country and session options separately; a source-IP allowlist does not send username parameters.

Browser agents built on Playwright#

Frameworks such as browser-use expose Playwright's proxy settings (server, username, password) in their browser configuration. Give each agent run a fresh session id so parallel runs do not share an exit, and set the context locale and time zone to the exit's country.

proxy = {
    "server": "http://res.proxy-cyber.com:9000",
    "username": f"AGENTUSER-cc-us-sid-{run_id}-ttl-1h",
    "password": "PASS",
}
# pass `proxy` where the framework accepts Playwright proxy settings

Ceilings: sub-users#

Submit a sub-user request in Access with a distinct label, network and intended GB limit. The administrator assigns credentials and confirms activation and any gateway-enforced limit. A pending request is not an active account. Keep an application-side usage budget as well, and ask support to revoke or replace active credentials if they are exposed.

Behavioural hygiene#

• Cap the agent's requests per domain and per minute; rotation does not excuse hammering.
• Block images, media and fonts in the browser context; agents read text.
• Log the session id with each task so a blocked run can be traced to its exit and replayed on a new one.

Questions people ask#