ai-proxy-rules: Route Only OpenAI and Claude Through Your Proxy

When you use Claude Code or call the OpenAI API from somewhere these services aren’t reachable directly, the easy fix is to switch your proxy to global mode. But then local sites, your company intranet and package downloads all take the detour too, so they get slower and sometimes break. The only traffic that actually needs the proxy is a few dozen AI domains.

So I put together a rule set that covers just OpenAI and Claude. Those domains go through the proxy, and everything else stays direct.

What’s covered

The easy ones to miss are the CAPTCHA used at login, LiveKit for voice, the Artifacts sandbox domains and the upload domains. Miss one and you get “the page loads but I can’t sign in” or “chat works but file uploads fail”. Every rule is commented with what it’s for, and you can search the list on the website.

How to use it

Open the project website, pick your client, and copy the snippet.

• Shadowrocket: open the site on your iPhone or iPad and tap the install button to import a standalone config. It contains no servers: PROXY is whichever server you have selected in the app. If you already have your own config, you can add two RULE-SET lines instead.
• Surge / Loon / Stash: add two RULE-SET lines above FINAL.
• Clash / mihomo: add a rule-providers entry and a RULE-SET rule to your own config. Both services can share one node or use separate ones. Put the RULE-SET before GEOIP,CN and MATCH.

All the rules live in one source, rules/*.list. A script generates the Clash and Shadowrocket files from it, and CI checks that the generated files match the source, so every client gets the same rules.

The web app works but your SDK times out?

This is the most common problem for developers: “system proxy” mode on desktop usually covers only browsers. curl, Node and Python in your terminal don’t read the system proxy settings by default, so the rules never see their traffic.

There are two fixes:

1. Turn on TUN / enhanced mode. Traffic from every process goes through the proxy client, and the rules apply as expected.

2. Set proxy environment variables in your shell:

   export HTTPS_PROXY=http://127.0.0.1:7890
   export HTTP_PROXY=http://127.0.0.1:7890
   export NO_PROXY=localhost,127.0.0.1
   

   This sends every request from that shell through the proxy, not just the domains in the rule set.

Two more tips:

• Don’t match Claude Code with PROCESS-NAME,node. That rule sends every Node process on the machine through the proxy, including local dev servers and npm installs. Matching on domains is more precise.
• Prefer a residential node, and don’t use load balancing. Both providers are strict about datacenter IPs, and switching exit IP in the middle of a session signs you out.

If you run Claude Code on a remote server from Claude Desktop, see my other post: giving the remote Claude its own proxy.

Finally

The repository contains domain lists and configuration notes only, not servers. It covers OpenAI and Anthropic for now, and other services may be added later. If you spot a missing domain, open an issue or PR on GitHub.