@@ -1,32 +1,58 @@
11---
2-summary: "CLI reference for `openclaw proxy`, the local debug proxy and capture inspector"
2+summary: "CLI reference for `openclaw proxy`, including operator-managed proxy validation and the local debug proxy capture inspector"
33read_when:
4+ - You need to validate operator-managed proxy routing before deployment
45 - You need to capture OpenClaw transport traffic locally for debugging
56 - You want to inspect debug proxy sessions, blobs, or built-in query presets
67title: "Proxy"
78---
89910# `openclaw proxy`
101111-Run the local explicit debug proxy and inspect captured traffic.
12+Validate operator-managed proxy routing, or run the local explicit debug proxy
13+and inspect captured traffic.
121413-This is a debugging command for transport-level investigation. It can start a
14-local proxy, run a child command with capture enabled, list capture sessions,
15-query common traffic patterns, read captured blobs, and purge local capture
16-data.
15+Use `validate` to preflight an operator-managed forward proxy before enabling
16+OpenClaw proxy routing. The other commands are debugging tools for
17+transport-level investigation: they can start a local proxy, run a child command
18+with capture enabled, list capture sessions, query common traffic patterns, read
19+captured blobs, and purge local capture data.
17201821## Commands
19222023```bash
2124openclaw proxy start [--host <host>] [--port <port>]
2225openclaw proxy run [--host <host>] [--port <port>] -- <cmd...>
26+openclaw proxy validate [--json] [--proxy-url <url>] [--allowed-url <url>] [--denied-url <url>] [--timeout-ms <ms>]
2327openclaw proxy coverage
2428openclaw proxy sessions [--limit <count>]
2529openclaw proxy query --preset <name> [--session <id>]
2630openclaw proxy blob --id <blobId>
2731openclaw proxy purge
2832```
293334+## Validate
35+36+`openclaw proxy validate` checks the effective operator-managed proxy URL from
37+`--proxy-url`, config, or `OPENCLAW_PROXY_URL`. It reports a config problem when
38+no proxy is enabled and configured; use `--proxy-url` for a one-off preflight
39+before changing config. By default it verifies that a public destination succeeds
40+through the proxy and that the proxy cannot reach a temporary loopback canary.
41+Custom denied destinations are fail-closed: HTTP responses and ambiguous
42+transport failures both fail unless you can verify a deployment-specific denial
43+signal separately.
44+45+Options:
46+47+- `--json`: print machine-readable JSON.
48+- `--proxy-url <url>`: validate this proxy URL instead of config or env.
49+- `--allowed-url <url>`: add a destination expected to succeed through the proxy. Repeat to check multiple destinations.
50+- `--denied-url <url>`: add a destination expected to be blocked by the proxy. Repeat to check multiple destinations.
51+- `--timeout-ms <ms>`: per-request timeout in milliseconds.
52+53+See [Network Proxy](/security/network-proxy) for deployment guidance and denial
54+semantics.
55+3056## Query presets
31573258`openclaw proxy query --preset <name>` accepts:
@@ -42,9 +68,11 @@ openclaw proxy purge
42684369- `start` defaults to `127.0.0.1` unless `--host` is set.
4470- `run` starts a local debug proxy and then runs the command after `--`.
71+- `validate` exits with code 1 when proxy config or destination checks fail.
4572- Captures are local debugging data; use `openclaw proxy purge` when finished.
46734774## Related
48754976- [CLI reference](/cli)
77+- [Network Proxy](/security/network-proxy)
5078- [Trusted proxy auth](/gateway/trusted-proxy-auth)
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。