Proxy#

Use proxies for corporate networks, geo-testing, scraping infrastructure, and traffic routing through a controlled egress point.

CLI flags#

agent-browser --proxy "http://proxy.example.com:8080" open https://example.com
agent-browser --proxy "http://user:pass@proxy.example.com:8080" open https://example.com
agent-browser --proxy "http://proxy.example.com:8080" --proxy-bypass "localhost,*.internal.com" open https://example.com
agent-browser --proxy "http://proxy.example.com:8080" --ca-cert /etc/ssl/certs/proxy-ca.pem open https://example.com

Flag	Description
`--proxy <url>`	Proxy server URL, with optional credentials
`--proxy-bypass <hosts>`	Hosts that should bypass the proxy
`--ca-cert <path>`	Trust a CA certificate or PEM bundle in a locally launched Chromium browser on Linux
`--no-ca-cert`	Clear CA trust retained by the running browser session

Environment variables#

Variable	Description
`AGENT_BROWSER_PROXY`	agent-browser proxy URL
`AGENT_BROWSER_PROXY_BYPASS`	agent-browser proxy bypass list
`AGENT_BROWSER_PROXY_USERNAME`	Proxy username when credentials are provided separately
`AGENT_BROWSER_PROXY_PASSWORD`	Proxy password when credentials are provided separately
`AGENT_BROWSER_CA_CERT`	Path to a CA certificate or PEM bundle for locally launched Chromium on Linux
`HTTP_PROXY` / `HTTPS_PROXY`	Standard proxy environment variables, used as fallbacks
`ALL_PROXY`	SOCKS or all-traffic proxy fallback
`NO_PROXY`	Standard proxy bypass fallback

AGENT_BROWSER_PROXY takes precedence over standard proxy variables. The CLI also accepts credentials embedded in the proxy URL and separates them before passing launch options to the daemon.

HTTPS interception certificates#

On Linux, --ca-cert imports each certificate into a private NSS database used only by the Chromium process launched for that session. Normal hostname and validity checks remain enabled. Later commands retain that trust when they omit the flag. A different certificate or --no-ca-cert relaunches Chromium without restarting the daemon. The same certificate content reuses the current browser even when supplied from a different path. agent-browser install --with-deps installs the required certutil; otherwise install libnss3-tools on Debian/Ubuntu or nss-tools on RPM Linux.

The option cannot be combined with --profile, --cdp, --auto-connect, providers, Lightpanda, or --ignore-https-errors. It is not supported on macOS or Windows.

SOCKS proxy#

export ALL_PROXY="socks5://proxy.example.com:1080"
agent-browser open https://example.com

export ALL_PROXY="socks5://user:pass@proxy.example.com:1080"
agent-browser open https://example.com

Bypass local traffic#

export AGENT_BROWSER_PROXY="http://proxy.example.com:8080"
export AGENT_BROWSER_PROXY_BYPASS="localhost,127.0.0.1,*.internal.com"

agent-browser open https://external.example.com
agent-browser open http://localhost:3000

Verify routing#

agent-browser open https://httpbin.org/ip
agent-browser get text body

The response should show the proxy egress address, not the machine's direct network address.

Security notes#

Prefer environment variables or secret stores for proxy credentials.
Do not commit proxy usernames, passwords, or session URLs.
HAR exports and network logs may include proxy-authenticated requests.