How can I verify whether an OpenCode Web UI setup sends requests through an external proxy is a request-routing investigation that compares backend settings with observed network activity. For example, inspect the selected provider endpoint and correlate one harmless prompt with backend connections and available gateway logs.
A browser showing localhost can still belong to a workflow that sends prompts through an external gateway. Before submitting proprietary code, establish where the backend sends the request. A familiar browser address cannot tell you who receives a server-originated model call.
I recommend investigating the route in layers: browser, backend, provider endpoint, and network intermediaries. This gives you a useful finding without assuming that every unfamiliar connection is malicious or that every local interface keeps inference local.
Evidence note: No installation, completed test, or captured incident log was supplied. The harmless-request investigation below is a proposed test scenario from the research brief, not an experiment I performed. I distinguish documented settings, illustrative examples, and evidence you must collect from your own deployment.
How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?
Quick Answer
Identify the active OpenCode backend, inspect its selected provider endpoint and runtime proxy variables, then correlate a harmless request with outbound connections and available intermediary logs. Browser DevTools establishes the browser’s immediate destination; it does not reveal every backend hop. Report whether proxy use is confirmed, configured but unverified, or inconclusive.
The central distinction is between a configured route and an observed request. A setting can indicate an intended intermediary without proving that the selected session used it. A connection can show an immediate destination without explaining everything that happens upstream.
OpenCode documents two relevant controls: proxy environment variables and a custom provider baseURL. Either can affect routing; they can also operate together. Empty proxy variables therefore do not eliminate the possibility of an application gateway. OpenCode — Network documentation OpenCode — Provider configuration
When someone asks, “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, I begin by identifying the actual OpenCode backend server. Inspecting a laptop is insufficient when the selected server runs in a container or on another machine.
Why does a localhost browser address leave the outbound route uncertain?
A browser and a backend make different connections. The browser may communicate exclusively with a local service while that service submits prompts to an external provider. OpenCode’s Web documentation describes a local server started by opencode web; its connected-server controls help identify which backend you are using. OpenCode — Web interface documentation
An inbound reverse proxy receives browser traffic and forwards it toward the application. An outbound forward proxy relays connections initiated by the backend. An LLM API gateway accepts model API requests and forwards them to an upstream service.
| Component | Role | What observing it establishes |
|---|---|---|
| Browser connection | Reaches the UI or backend | The browser’s immediate destination |
| Inbound reverse proxy | Forwards incoming UI traffic | An intermediary on the incoming path |
| Outbound forward proxy | Relays backend connections | An outgoing intermediary when correlated |
| LLM API gateway | Accepts API requests and forwards upstream | An application endpoint in the model path |
| Local relay | Receives requests on the local host | A local hop whose upstream needs inspection |
A forward proxy and an API gateway can both appear in one route. A local relay can introduce another hop. I would map the candidate path before changing settings, then mark which portions are observed and which remain assumptions.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, the useful distinction is incoming versus outgoing traffic. Evidence about one path does not automatically establish the other.
Which settings can cause unexpected external routing?
Start with HTTP_PROXY and HTTPS_PROXY, the documented proxy environment variables, and NO_PROXY, which specifies bypass destinations. Inspect their values in the backend’s actual runtime context rather than relying on what appears in your terminal. OpenCode — Network documentation
OpenCode’s network guidance documents a localhost bypass for the TUI’s connection to its local server. That guidance does not establish whether external provider requests bypass a proxy. Local connectivity and model-request routing are separate questions.
The following observations are diagnostic possibilities, not findings about your application.
| Observation | Possible explanation | First check |
|---|---|---|
| Browser connects locally | Backend makes external calls separately | Active backend and provider endpoint |
| Proxy variables appear empty | Provider targets an API gateway | Selected provider’s baseURL |
| Terminal settings look correct | Service inherited another environment | Running backend environment |
| Provider endpoint is loopback | Local relay forwards externally | Relay’s upstream configuration |
| Configuration appears direct | Infrastructure mediates egress | Network policy and egress logs |
| Sessions behave differently | Different server or provider selected | Backend, provider, model, and launch settings |
The question “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?” cannot be answered by inspecting only one configuration file. Project settings, user settings, startup overrides, and wrappers may influence the running application.
Also inspect lowercase variable variants and ALL_PROXY where the surrounding runtime uses them. The cited OpenCode documentation does not establish support for every variant. Record them as investigation items rather than declaring that OpenCode necessarily honors them.
How can I verify whether an OpenCode Web UI setup sends requests through an external proxy step by step?
I would preserve the existing configuration first, then collect a small amount of correlated evidence. Changing several settings immediately can destroy the distinction between the original route and the route created during troubleshooting.
1. Identify the active backend
Record the application version using opencode --version on the machine or container running the backend. Record the launch method as well: a terminal command, service manager, container deployment, or third-party wrapper can each supply different settings.
Create a short investigation record containing:
- Browser origin and connected backend.
- Backend host or container and identified process.
- OpenCode version and launch method.
- Selected provider and model.
- Relevant wrapper, local relay, or deployment configuration.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, this record defines the investigation’s scope. Otherwise, you can inspect one backend while the browser quietly uses another.
Do not assume that the browser’s port is fixed. Identify the running instance instead of matching a familiar port number. If several instances exist, verify the selected server before attributing any connection to the test.
2. Record the browser’s first hop
Open the browser DevTools Network panel, trigger one harmless interaction, and inspect the destination origin of relevant session requests and streaming connections. Record any direct browser requests to an external API separately from browser-to-backend requests.
A localhost destination establishes a local first hop. It does not establish where the backend sends the prompt afterward. Conversely, an external UI hostname may belong to your own reverse proxy rather than the selected model provider.
“How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?” requires more evidence than a DevTools screenshot. I use browser observations to locate the backend, then continue the investigation there.
Avoid sharing an unredacted HAR export. Such exports can contain authorization headers, cookies, request bodies, and prompt content. Usually, a sanitized record of the destination origin, timestamp, and relevant request identifiers is enough for this stage.
3. Inspect the selected provider endpoint
Locate the configuration actually loaded by the running backend. Check applicable user, project, launch-time, and wrapper settings without assuming a precedence order that you have not confirmed for the installed version.
OpenCode documents provider.<provider-id>.options.baseURL as a way to customize provider endpoints. Inspect the selected provider’s value, if present, and identify the actual endpoint operator. A provider label is not proof that traffic reaches that provider directly. OpenCode — Provider configuration
For example, imagine that the selected provider’s options.baseURL resolves to a company-managed gateway. That would establish a configured application endpoint. You would still need request evidence to show that the tested session used it.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, a local endpoint needs additional attention. Identify the process listening there and inspect its upstream configuration. Local reception does not establish local inference.
If the endpoint is inherited from a default, identify the default relevant to the selected provider and installed configuration. Do not fill an evidence gap by guessing a domain from the provider’s display name.
4. Inspect the running process’s proxy environment
Inspect process environment variables in the actual service or container. Your interactive shell may be empty while the service has a configured proxy, or your shell may contain proxy settings that the service never inherited.
On Linux, an authorized operator can inspect /proc/<PID>/environ for the identified backend process. Use an inspection method appropriate to your permissions and deployment. Examine the service’s startup definition too, especially when runtime settings differ from the expected configuration.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, record sanitized proxy destinations and relevant bypass entries. Do not copy a full environment dump into a ticket; it may contain unrelated secrets.
Inspect NO_PROXY alongside the proxy address. A proxy being configured does not establish that a particular destination uses it. Likewise, a localhost bypass says nothing conclusive about an external gateway or provider destination.
5. Observe one harmless request
Use a fresh test session without proprietary attachments or repository context where practical. A harmless prompt alone does not guarantee a harmless payload: an agent may also include existing conversation history, instructions, or tool context.
Record a timestamp and submit a simple prompt, such as “Reply with the word ready.” Observe outbound network connections associated with the backend while the request runs. On Linux, the following are diagnostic examples, not commands tested against your installation.
# Replace 12345 with the confirmed backend PID.
sudo lsof -nP -a -p 12345 -iTCP
# Alternative view of TCP connections and process information.
sudo ss -tpn(Illustrative example)
These commands require the relevant tools and permissions. The second view is broader than the first, so attribute connections to the correct process. In a container, observe the appropriate network namespace or host-side process.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, include established sockets in your observations. A request may reuse a connection opened earlier; the absence of a newly opened socket does not establish the absence of traffic.
An IP address alone may be ambiguous because gateways, providers, and CDNs can share infrastructure. Short requests may also escape a single snapshot. Use repeated observations or available network telemetry when necessary, and avoid treating every concurrent connection as part of the model call.
6. Correlate intermediary records
Where available, compare backend observations with forward-proxy, gateway, or egress logs. Match timestamps, destination hosts, and request identifiers. Account for timezone differences and clock offsets before rejecting a possible match.
TLS CONNECT tunneling is especially important to interpret correctly. A forward-proxy record showing a CONNECT destination supports tunnel use. The tunnel can carry multiple requests, so a tunnel record alone may not identify an individual prompt.
A gateway access record may provide stronger application-level attribution when its request identifier matches the tested call. Do not assume a backend, proxy, and provider use the same identifier unless the deployment propagates it.
“How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?” is also different from asking whether that proxy reads the prompt. A TLS tunnel alone does not inherently expose plaintext bodies; TLS interception or application-layer termination changes that assessment.
Prefer connection metadata when it answers the routing question. There is no need to collect prompt bodies or authentication tokens merely to demonstrate that a named intermediary received the connection.
7. Compare one routing factor in a test instance
If the evidence remains ambiguous, use an authorized test instance and change one factor at a time. Preserve required organizational controls. Do not remove a mandatory egress proxy merely to see whether the application can reach the internet without it.
A controlled comparison can follow this sequence:
- Preserve the original configuration and collect baseline observations.
- Change one authorized routing setting.
- Restart the affected process if necessary.
- Repeat the same harmless request and compare evidence.
- Restore the baseline before testing a different factor.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, success after removing explicit proxy variables is insufficient proof of direct routing. A custom provider gateway, local relay, or transparent intermediary may remain.
Failure after a change establishes a dependency worth investigating. It does not reveal every hop. A direct endpoint may require different credentials or protocol settings, so authentication failure is not automatically proof that the original gateway carried the request.
8. Classify the evidence
I would write the conclusion before deciding whether a configuration change is necessary. A named, approved gateway may be expected. The objective is to establish the route and compare it with policy, rather than assume that every intermediary is unwanted.
Use the evidence categories in the next section. Scope the finding to the tested backend, provider/model, configuration, and request. Other tools, plugins, providers, and sessions remain outside that conclusion unless separately observed.
“How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?” should end with a bounded finding. “This request used the approved gateway” is more defensible than “everything is private” or “no traffic ever uses a proxy.”
9. Correct the responsible routing layer
If you identify an unapproved route, correct the setting that controls it. That might be the provider endpoint, inherited service environment, local relay, wrapper, or network policy. Editing a browser setting will not repair an unrelated backend gateway configuration.
Restart or redeploy the affected component when required, and confirm that the new process loaded the intended settings. Preserve a recoverable configuration so a routing correction does not become an unexplained outage.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, credential handling depends on evidence too. Rotate affected credentials when evidence indicates they were disclosed to an unapproved endpoint. A tunnel’s existence alone does not establish credential disclosure.
10. Repeat the test and preserve the finding
Repeat the harmless request after correction and compare the observed route with the baseline. A changed configuration file is not sufficient: the running backend may still have the old environment or an existing connection.
Preserve a sanitized record of:
- Backend, provider/model, and relevant configuration.
- Test timestamp and available request identifiers.
- Observed destination and intermediary evidence.
- Corrective change and post-change observations.
- Conclusion and remaining visibility gaps.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, this record makes the finding repeatable. Recheck after changes to provider configuration, deployment environment, or egress policy that could alter routing.
What evidence supports a defensible conclusion?
Use the following categories to keep configuration evidence separate from execution evidence. They are investigation labels, not product certifications or guarantees that every network hop has been discovered.
| Conclusion | Evidence needed | Limit to state |
|---|---|---|
| Confirmed through a named intermediary | Correlated backend and intermediary evidence | Applies to the tested request |
| Configured for an intermediary; execution unconfirmed | Endpoint or runtime settings identify an intermediary | No matching request evidence |
| No explicit application proxy observed | Inspected settings and observed connections show none | Infrastructure routing may remain outside visibility |
| Inconclusive | Required access, records, or attribution is missing | Route cannot yet be established |
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, a negative finding deserves particular care. “No explicit application proxy observed” describes your visibility; it does not rule out transparent network infrastructure.
No installation-specific error log is available. Proxy use may occur without an error. The following is an illustrative investigation record, not captured output or a claim that this test was completed.
Scenario: Selected provider appears configured for an external gateway.
Evidence requested: Runtime endpoint, backend connections, matching gateway record.
Current finding: Configured for an intermediary; execution unconfirmed.
Next action: Correlate one harmless request with available metadata.(Illustrative example)
Bad: “The browser uses localhost, so prompts cannot pass through an external intermediary.”
Good: “The browser uses a local backend. Its selected provider endpoint and runtime environment were inspected, and the finding is limited to the request for which connection evidence was collected.”
Measure investigation coverage without inventing a security score
I suggest route-evidence coverage as a proposed audit-completeness metric. Divide configurations with completed runtime routing assessments by all backend/provider configurations in scope, then multiply by 100. Count confirmed-intermediary findings and adequately supported no-explicit-proxy findings as completed assessments, retaining their stated limits.
Exclude inconclusive configurations and settings-only findings whose execution remains unconfirmed. This prevents a list of configured endpoints from being mistaken for completed request verification.
For example, three completed assessments out of four configurations give 75% coverage. This is illustrative arithmetic, not a measured OpenCode result. Coverage says how much of the defined investigation is complete; it does not measure confidentiality or prove that an approved route is secure.
For “How can I verify whether an OpenCode Web UI setup sends requests through an external proxy?”, the denominator matters. Testing one provider on one backend does not provide coverage for a second backend or unrelated tool traffic.
Frequently Asked Questions
Does localhost mean my prompts stay on my computer?
No. It identifies a local browser destination. The backend may still send prompts to a provider, gateway, or other external service. Inspect the selected backend’s endpoint and runtime activity before drawing a conclusion about where model requests go.
Can browser DevTools prove that OpenCode bypasses an external proxy?
Not by itself. DevTools shows browser-originated traffic; backend requests require backend and network evidence. It is useful for identifying the browser’s first hop and detecting direct frontend API calls, but it does not automatically expose a server’s outbound route.
Can a provider gateway be used when HTTP_PROXY and HTTPS_PROXY are empty?
Yes. A custom provider baseURL can target a gateway independently of explicit proxy environment variables. OpenCode documents custom provider endpoints, including proxy-service use. Empty variables therefore leave the endpoint and surrounding network infrastructure to investigate. OpenCode — Provider configuration
Does a reverse proxy in front of the Web UI also proxy model requests?
Not necessarily. Incoming UI traffic and outgoing model traffic are separate paths. The same infrastructure might handle both in a particular deployment, but you need separate evidence rather than inferring outbound behavior from the browser-facing configuration.
Can a forward proxy read my prompts?
A TLS tunnel alone does not inherently reveal plaintext prompts. Visibility depends on TLS termination, interception, and the intermediary’s role. An application gateway receiving the model API request has a different position from a forward proxy merely tunneling an encrypted connection.
What if I cannot access gateway or network logs?
Record the settings and connection evidence you can obtain, then name the missing visibility. Request sanitized metadata from the administrator when necessary. If attribution remains uncertain, use an inconclusive or execution-unconfirmed finding rather than claiming a complete route.
Does one successful test establish routing for every OpenCode feature?
No. Scope the result to the tested backend and provider configuration. Other providers, tools, plugins, and sessions may use different destinations. OpenCode’s documentation explains available controls, but your runtime evidence determines what you can say about your installation. OpenCode — Network documentation
For the broader troubleshooting workflow, see the complete guide. Preserve the same discipline across investigations: identify the responsible component, collect evidence, change one factor, and verify the resulting behavior.
Leave a Reply