> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rye.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy and CA

> Configure Rye's local proxy, HTTPS interception, system proxy settings, and API shim.

Rye's local proxy is the network enforcement point for model traffic.

By default, `rye up` starts the proxy on:

```txt theme={null}
127.0.0.1:18080
```

## Start the proxy

```bash theme={null}
rye up
```

Start with CA installation:

```bash theme={null}
rye up --install-ca
```

Start on a custom address:

```bash theme={null}
rye up --listen 127.0.0.1:19090
```

Stop the proxy:

```bash theme={null}
rye down
```

## Intercepted domains

Rye intercepts common AI tool and model-provider domains by default, including OpenAI, Anthropic, Claude, Cursor, Windsurf, ChatGPT, and Gemini domains.

Override the list:

```bash theme={null}
rye up --intercept-patterns openai.com,anthropic.com,claude.com
```

Intercept everything:

```bash theme={null}
rye up --intercept-all
```

Manage stored patterns:

```bash theme={null}
rye intercept list
rye intercept add openai.com,anthropic.com
rye intercept remove cursor.com
```

## Manual proxy environment

For CLI tools, start Rye and set environment variables before launching the agent:

```bash theme={null}
export HTTP_PROXY="http://127.0.0.1:18080"
export HTTPS_PROXY="http://127.0.0.1:18080"
export NODE_EXTRA_CA_CERTS="$(rye ca path)"
```

`rye wrap` handles these variables for the child process.

## CA management

Rye generates a local CA certificate and private key in its log directory.

| Command             | Purpose                                         |
| ------------------- | ----------------------------------------------- |
| `rye ca install`    | Install the Rye CA into the system trust store. |
| `rye ca path`       | Print the CA certificate path.                  |
| `rye ca regenerate` | Generate a new CA keypair.                      |

<Warning>
  Protect the Rye CA private key. Any local CA trusted by a machine can sign certificates that the machine accepts. Install it only on devices you own or administer.
</Warning>

## System proxy setup

Use automatic system proxy setup when an app does not inherit shell environment variables:

```bash theme={null}
rye up --auto-configure-proxy
```

On macOS, you can use a PAC file so only matching domains route through Rye:

```bash theme={null}
rye up --auto-configure-proxy-pac --intercept-patterns openai.com,anthropic.com
```

`rye down` restores proxy settings that Rye configured.

## API shim

Use the API shim when a client supports a custom model API base URL. This avoids MITM certificate setup for that client.

Start an Anthropic-compatible shim:

```bash theme={null}
rye up \
  --shim-listen 127.0.0.1:18090 \
  --shim-upstream https://api.anthropic.com
```

Point a compatible client at the shim:

```bash theme={null}
ANTHROPIC_BASE_URL="http://127.0.0.1:18090" claude
```

Use MITM proxying for broad compatibility. Use the API shim when the client exposes a reliable base URL setting.