Skip to content

Add proxy-aware fetch for HTTP_PROXY/HTTPS_PROXY support#87

Merged
jancurn merged 2 commits intomainfrom
claude/reimplement-pr-78-qa7h3
Mar 18, 2026
Merged

Add proxy-aware fetch for HTTP_PROXY/HTTPS_PROXY support#87
jancurn merged 2 commits intomainfrom
claude/reimplement-pr-78-qa7h3

Conversation

@jancurn
Copy link
Member

@jancurn jancurn commented Mar 17, 2026

Summary

This PR adds comprehensive HTTP proxy support for all network requests in the application, including MCP server connections, OAuth token refresh, and x402 payment signing. Previously, the MCP SDK transport and OAuth calls bypassed the global dispatcher and ignored HTTP_PROXY/HTTPS_PROXY environment variables.

Key Changes

  • New src/lib/proxy.ts module: Provides two functions for proxy-aware networking:

    • initProxy(): Initializes the global undici dispatcher with proxy support from environment variables. Must be called once at process startup.
    • proxyFetch(): A fetch function that explicitly routes through the configured HTTP proxy, for use in code that bypasses the global dispatcher (e.g., MCP SDK transport, OAuth calls).
  • Updated CLI and bridge entry points: Both src/cli/index.ts and src/bridge/index.ts now call initProxy() instead of manually creating and setting EnvHttpProxyAgent.

  • MCP transport proxy support: src/core/transports.ts now passes proxyFetch to the StreamableHTTPClientTransport so it respects proxy environment variables.

  • OAuth proxy support: src/lib/auth/oauth-utils.ts now uses proxyFetch for OAuth discovery and token refresh endpoints.

  • x402 middleware integration: src/bridge/index.ts passes proxyFetch to the x402 fetch middleware for payment signing requests.

  • Test updates: Updated test/unit/lib/auth/oauth-utils.test.ts to mock proxyFetch instead of global fetch.

Implementation Details

The solution addresses the limitation that undici's setGlobalDispatcher() is not honored by libraries that manage their own HTTP connections. By providing an explicit proxyFetch function, code can opt-in to proxy support even when the global dispatcher is bypassed. The --insecure flag is also supported to disable TLS certificate verification for self-signed certificates.

https://claude.ai/code/session_01RiDkNSfSQcdczmcGcLHYJM

HTTP_PROXY/HTTPS_PROXY environment variables were not respected by the
MCP SDK's StreamableHTTPClientTransport (which manages its own HTTP
connections) or by OAuth token discovery/refresh calls.

Consolidate proxy setup into a single src/lib/proxy.ts module that both
sets the global undici dispatcher and exports a proxy-aware fetch function
for code that bypasses the global dispatcher (MCP SDK transport, OAuth
utils, x402 middleware).

https://claude.ai/code/session_01RiDkNSfSQcdczmcGcLHYJM
- Unit tests verify proxyFetch is injected into StreamableHTTPClientTransport
  by default, and that custom fetch (e.g. x402 middleware) takes priority
- Add request counting to E2E proxy server (control API) and framework
  helpers (proxy_request_count, proxy_reset_count) for future use
- Fix transports.ts type error with exactOptionalPropertyTypes

https://claude.ai/code/session_01RiDkNSfSQcdczmcGcLHYJM
@jancurn jancurn merged commit 6203bb6 into main Mar 18, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants