Summary

Users in restricted network environments (corporate firewalls, regions with internet restrictions like China mainland, etc.) cannot use the web_fetch tool to access external URLs. Currently there is no way to configure an HTTP proxy for outbound web requests, which
blocks a significant use case.

Proposed solution

Add a proxy configuration option under tools.web.fetch that accepts an HTTP proxy URL string. When configured, the web_fetch tool should route all requests through the specified proxy using undici's ProxyAgent.

Example configuration:

tools:
  web:
    fetch:
      proxy: "http://127.0.0.1:7890"

Alternatives considered

1. System-level proxy (HTTP_PROXY env var) - Less flexible, affects all network requests globally rather than just web_fetch
2. Per-request proxy parameter - More complex API, most users want a single proxy for all requests
3. SOCKS proxy support - Could be added later, HTTP proxy covers most common use cases

Additional context

• Implementation PR: feat(tools): add proxy support for web_fetch tool #5831
• Uses undici ProxyAgent for proxy connections
• SSRF protection is intentionally bypassed when proxy is configured (user trusts their proxy to handle requests safely)
• Full test coverage included