Networking and proxies

Configure Cline to work behind corporate firewalls, proxies, and self-signed SSL certificates.

If you are working behind a corporate proxy or firewall, you need to configure proxy settings so Cline can reach AI provider APIs. The configuration method depends on which version of Cline you are using.

VS Code extension

The VS Code extension automatically uses VS Code’s built-in proxy settings. No additional Cline configuration is required.

To configure the proxy in VS Code:

1. Open VS Code Settings (Cmd/Ctrl + ,).
2. Search for http.proxy.
3. Enter your proxy URL (for example, http://proxy.company.com:8080).

For more detail, see Network connections in Visual Studio Code.

SSL/TLS certificate errors in VS Code

If you see SSL certificate errors, your proxy may be performing TLS inspection with a self-signed certificate.

Option 1: Trust the certificate system-wide

Add your corporate CA certificate to the operating system trust store. VS Code picks up system certificates automatically.

Option 2: Relax strict SSL (not recommended for production)

In VS Code Settings, search for http.proxyStrictSSL and disable it. This bypasses certificate verification and should only be used for testing.

Option 3: Verify the certificate with curl

curl -x http://proxy.company.com:8080 --cacert /path/to/ca-cert.pem -vv https://api.anthropic.com

---

Cline CLI

The Cline CLI uses standard HTTP proxy environment variables. Set these before running cline commands.

Basic configuration

macOS/Linux

export https_proxy=http://proxy.company.com:8080
export http_proxy=http://proxy.company.com:8080
cline start

set https_proxy=http://proxy.company.com:8080
set http_proxy=http://proxy.company.com:8080
cline start

$env:https_proxy="http://proxy.company.com:8080"
$env:http_proxy="http://proxy.company.com:8080"
cline start

Proxy with authentication

Include credentials directly in the proxy URL:

export https_proxy=http://username:[e-mail]:8080
export http_proxy=http://username:[e-mail]:8080

Storing credentials in environment variables exposes them to other processes on the same machine. Use this method only when no alternative is available, and avoid committing these values to source control.

Bypass proxy for local addresses

Set no_proxy to prevent local traffic from being routed through the proxy:

macOS/Linux

export no_proxy=localhost,127.0.0.1,.local

set no_proxy=localhost,127.0.0.1,.local

Self-signed or custom CA certificates

If your proxy uses a custom certificate authority, point Node.js to the certificate file:

macOS/Linux

export NODE_EXTRA_CA_CERTS=/path/to/ca-certificate.pem
cline start

set NODE_EXTRA_CA_CERTS=C:\path\to\ca-certificate.crt
cline start

The certificate file must be in PEM format.

Permanent configuration

To avoid setting variables on every session, add them to your shell profile.

macOS/Linux (~/.bashrc, ~/.zshrc, or ~/.profile)

# Proxy configuration
export https_proxy=http://proxy.company.com:8080
export http_proxy=http://proxy.company.com:8080
export no_proxy=localhost,127.0.0.1,.local
export NODE_EXTRA_CA_CERTS=/path/to/ca-certificate.pem

1. Search for "Environment Variables" in Windows Settings.
2. Add the variables under "User variables" or "System variables".
3. Restart your terminal or IDE.

Known limitations

The Cline CLI supports HTTP proxies only. The following are not supported:

• SOCKS proxies
• Proxy autoconfiguration (PAC) scripts
• Proxy authentication methods beyond basic username/password

---

JetBrains IDEs

The JetBrains plugin uses the IDE’s HTTP proxy settings.

1. Open Settings

   • Windows/Linux: File > Settings (or Ctrl+Alt+S)
   • macOS: IntelliJ IDEA > Preferences (or Cmd+,)
2. Navigate to HTTP Proxy

   Go to Appearance & Behavior > System Settings > HTTP Proxy.

3. Configure manual proxy

   Select Manual proxy configuration and enter:

   • Host name: proxy.company.com
   • Port number: 8080
   • No proxy for: localhost,127.0.0.1
   • Check Proxy authentication and enter credentials if required.
4. Test the connection

   Click Check connection to verify your settings, then click OK.

5. Restart the IDE

   Cline does not pick up proxy changes dynamically. Restart the IDE for the new settings to take effect.

Custom CA certificate in JetBrains

If your proxy uses a custom certificate authority:

• Add the certificate to your operating system’s trust store, or
• Import it into JetBrains: Settings > Tools > Server Certificates > click + and select your certificate file.

The JetBrains plugin only supports HTTP proxies. SOCKS proxies and PAC scripts are not supported.

---

Troubleshooting

Connection timeouts

1. Verify that the proxy address and port are correct.
2. Check whether the proxy requires authentication.
3. Confirm that your firewall allows outbound HTTPS traffic to the AI provider’s API endpoints (for example, api.anthropic.com).

SSL/TLS certificate errors

1. Confirm that NODE_EXTRA_CA_CERTS points to the correct file and that the file is in PEM format.

2. Test the certificate with curl:

   curl -x http://proxy.company.com:8080 --cacert /path/to/ca-cert.pem -vv https://api.anthropic.com
   

3. If using VS Code, consider disabling http.proxyStrictSSL temporarily to isolate the issue (not recommended for ongoing use).

Testing your proxy configuration

Verify that your proxy works independently of Cline using curl:

macOS/Linux

export https_proxy=http://proxy.company.com:8080
curl -vv https://api.anthropic.com

$env:https_proxy="http://proxy.company.com:8080"
curl.exe -vv https://api.anthropic.com

Add --cacert $NODE_EXTRA_CA_CERTS if you need to specify a custom certificate.

For the CLI and JetBrains plugin, check ~/.cline/cline-core-service.log for proxy configuration details and network errors.

---

Common proxy configurations

# Authenticated HTTPS proxy with custom CA
export https_proxy=http://username:[e-mail]:8080
export NODE_EXTRA_CA_CERTS=/path/to/ca-cert.pem

# Unauthenticated proxy
export https_proxy=http://proxy.company.com:8080
export http_proxy=http://proxy.company.com:8080

# Proxy with bypass rules for internal addresses
export https_proxy=http://proxy.company.com:8080
export no_proxy=localhost,127.0.0.1,.company.local,192.168.0.0/16