Introduction

DeepSeek Harness (DSH) uses a plugin-based architecture. Typically, configuring a proxy through environment variables (such as HTTP_PROXY) affects the network behavior of the entire DSH process. If you only want specific Provider routes to be accessed through a proxy while other Providers remain directly connected, the dsh-provider-proxy plugin provides this fine-grained control.

Plugin Overview

dsh-provider-proxy is a DeepSeek Harness LLM middleware that forwards selected Provider routes to an HTTP or HTTPS proxy. The plugin is maintained by user stayhpjinng and is released under the MIT license.

It addresses the problem of a single global proxy configuration being too broad in multi-Provider scenarios. With this plugin, you can specify which Providers use a proxy and which Providers keep direct connections. Even concurrent requests can retain their respective network paths.

The plugin targets DSH version 0.1.1-rc.2 and requires a Node.js version satisfying ^22.19.0 || >=24.

Core Features

  • Provider-scoped proxying: Enables proxy forwarding only for configured Provider routes, while other routes retain their original network behavior.
  • Protocol support: Supports HTTP and HTTPS forward proxies, implemented using Undici’s ProxyAgent.
  • Coverage: Supports Provider implementations that use globalThis.fetch, including DSH’s native DeepSeek adapter and common fetch-based third-party Provider implementations.
  • Model discovery: Wraps DSH’s llm.discoverModels() path. When an “available models” request specifies a Provider, it uses that Provider’s proxy.

Installation and Activation

The plugin is installed as a DSH bundle, but it remains dormant until enabled.

  1. Obtain the plugin source code and ensure the path is an absolute path.
  2. Run the installation command:
dsh plugin --profile web add /absolute/path/to/dsh-provider-proxy
  1. Restart the dsh web service, then enable it from the settings interface.

Configuration

After installing the plugin, you need to configure the specific Provider and proxy address.

UI Configuration

After restarting dsh web, open Settings → Provider Proxy. Each available Provider has a separate toggle, proxy URL (or environment variable), optional proxy authentication environment variable, and save and reset controls. After turning off the toggle, the setting applies immediately to new requests, and in-flight streaming requests are allowed to complete on their original dispatcher.

YAML Configuration

Configure it by editing the configuration file $DSH_HOME/profiles/web/cordis.patch.yml.

- id: provider-proxy
  config:
    providers:
      openrouter:
        enabled: true
        proxyUrl: http://127.0.0.1:7890

Note: The keys under providers must be DSH Provider routes (for example, openrouter), not upstream hostnames or model names.

Using Environment Variables

Place the proxy URL in an environment variable to keep sensitive information out of configuration files:

- id: provider-proxy
  config:
    providers:
      anthropic:
        enabled: true
        proxyUrlEnv: DSH_ANTHROPIC_PROXY_URL

Make sure the environment variable is set before starting DSH:

export DSH_ANTHROPIC_PROXY_URL=http://127.0.0.1:7890
dsh web

Proxy Authentication

If the proxy requires authentication, use a dedicated authentication environment variable:

- id: provider-proxy
  config:
    providers:
      anthropic:
        enabled: true
        proxyUrl: https://proxy.example.com:8443
        proxyAuthorizationEnv: DSH_ANTHROPIC_PROXY_AUTH

DSH_ANTHROPIC_PROXY_AUTH should contain the full Proxy-Authorization value, such as Basic <base64-user:password>. The plugin refuses to embed credentials directly in the proxy URL to prevent leakage into configuration export files.

Scope and Limitations

  • Protocol limitation: SOCKS or PAC proxy URLs are not supported.
  • No baseURL rewriting: The plugin does not rewrite a Provider’s baseURL. If you need to use an API relay or reverse proxy, set it directly in the Provider’s configuration.
  • Network-layer limitation: Only implementations that use globalThis.fetch are covered. Provider SDKs that bypass Fetch and open Sockets directly require dedicated transport-layer integration; this plugin does not provide a process-level proxy fallback.
  • Model discovery cache: If a Provider has a non-empty static models list configured, DSH returns that list directly without network I/O. To test the proxy connection, clear that static list.

Conclusion

dsh-provider-proxy provides a solution for Provider-level network isolation in DSH. It is suitable for scenarios where you need to configure a proxy for specific Providers while keeping other Providers directly connected.

Plugin directory
GitHub repository