---
name: phase-ai-proxy
description: >-
  Route the agent's own web traffic through Phase AI Proxy: opens a local SOCKS5
  port backed by the iroh-proxy client. Use when sites block or rate-limit the
  agent's data-center traffic. Requires USDT on Phase (see phase-bridge-usdt) and
  PHASE for the deposit transaction (see phase-get-gas).
---

# Open an AI Proxy gate

Never ask the user to paste a private key into the chat.

## Install

The skill is four files. Put them in one directory and make the scripts executable:

```bash
mkdir -p phase-ai-proxy/scripts && cd phase-ai-proxy
for f in SKILL.md scripts/setup.sh scripts/open-gate.sh scripts/close-gate.sh; do
  curl -fsSL -o "$f" "https://phase.xyz/docs/skills/phase-ai-proxy/$f"
done
chmod +x scripts/*.sh
```

On first use `open-gate.sh` downloads the `iroh-proxy` client for macOS (Apple silicon, Intel) or Linux (x86_64, arm64) from `https://phase.xyz/downloads/iroh-proxy/` and checks its SHA-256 against the published `SHA256SUMS`.

## Steps

1. Setup, only if `config.env` is missing (it sits in the directory above `scripts/`).
   Ask your user to run `setup.sh` in their own terminal.
   It prompts for the billing URL (default `https://billing.phase.xyz`, the Phase mainnet billing service) and, at a hidden prompt, for the private key of the wallet that holds the USDT deposit, and writes them to `config.env` (chmod 600).
   If your user has already set `IROH_PROXY_BILLING_KEY` in the agent's environment, skip this step: `open-gate.sh` then uses `https://billing.phase.xyz`.

2. Deposit, only if the wallet has no USDT deposit on the billing contract.
   Ask your user to approve and deposit USDT (amounts in 6-decimal units; 2000000 = 2 USDT).
   `$PHASE_RPC` is the Phase RPC: `https://rpc-main.phase.xyz`.

   ```bash
   cast send 0x0000000000000000000000000000000000000091 "approve(address,uint256)" 0x0000000000000000000000000000000000000090 2000000 --private-key $KEY --rpc-url $PHASE_RPC
   cast send 0x0000000000000000000000000000000000000090 "deposit(uint256)" 2000000 --private-key $KEY --rpc-url $PHASE_RPC
   ```

   Check the deposit: `cast call 0x0000000000000000000000000000000000000090 "balanceOf(address)(uint256)" <address> --rpc-url $PHASE_RPC`.

3. Then run `open-gate.sh`.
   The scripts keep their state (the client binary, its log and pid) in `${TMPDIR:-/tmp}/iroh-proxy-gate`; set `TMPDIR` to keep it elsewhere.
   It starts the client, waits until the local SOCKS5 port is listening and prints:

   ```
   GATE_ENDPOINT=socks5h://127.0.0.1:1080
   GATE_PID=12345
   GATE_LOG=/tmp/iroh-proxy-gate/gate.log
   ```

   If it exits with "gate not set up yet", go back to step 1.
   If it exits with "timed out waiting for SOCKS5 listener", read `GATE_LOG`, run `close-gate.sh` and try once more; if it fails again, tell your user and stop.

4. Check that the gate works: this must print the exit node's IP, not yours.

   ```bash
   curl --max-time 20 -x socks5h://127.0.0.1:1080 https://api.ipify.org
   ```

   If it prints your own IP or times out, run `close-gate.sh`, open the gate again and repeat the check once; if it still fails, tell your user and stop.

5. Route all of the agent's traffic through `GATE_ENDPOINT`. Use the `socks5h://` scheme (the `h`) so DNS is resolved on the proxy side, not locally:

   ```bash
   curl -x socks5h://127.0.0.1:1080 https://example.com
   ```

6. Run `close-gate.sh`. Close the gate as soon as you no longer need it: traffic through the gate is charged, and a withdrawal is not approved while a session is open.

Docs: https://phase.xyz/docs/md/proxy-quickstart.md