HKUDS/Vibe-Trading · error · ValueError

OAuth MCP servers require an https url

Error message

OAuth MCP servers require an https url

What it means

Raised by validate_transport_config when a server with an auth (OAuth) block uses a url that does not start with https://. OAuth refresh tokens must never travel over cleartext, so http:// endpoints are rejected outright.

Source

Thrown at agent/src/config/schema.py:410

                raise ValueError("stdio MCP servers do not accept auth (OAuth is HTTP-only)")
            return self

        if not self.url.strip():
            raise ValueError(f"{transport} MCP servers require a url")
        if self.command.strip() or self.args or self.env:
            raise ValueError(f"{transport} MCP servers do not accept command/args/env")

        if self.auth is not None:
            # The OAuth provider owns the runtime Authorization header; a
            # hand-set static header alongside it is always a config error.
            if self.headers:
                raise ValueError(
                    "MCP servers using auth must not also set static headers "
                    "(the OAuth provider owns the Authorization header)"
                )
            # A refresh token must never traverse cleartext.
            if not self.url.strip().lower().startswith("https://"):
                raise ValueError("OAuth MCP servers require an https url")
        return self


class MCPServerConfigOverride(ConfigBase):
    """Partial MCP server override used for runtime config layering."""

    type: Literal["stdio", "sse", "streamableHttp"] | None = None
    command: str | None = None
    args: list[str] | None = None
    env: dict[str, str] | None = None
    url: str | None = None
    headers: dict[str, str] | None = None
    auth: MCPOAuthConfig | None = None
    tool_timeout: float | None = Field(default=None, ge=0.1)
    init_timeout: float | None = Field(default=None, ge=0.1)
    enabled_tools: list[str] | None = None

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Switch the url to https:// (terminate TLS at a proxy if the backend is plain HTTP).
2. For local testing without OAuth, remove the auth block — plain http is then permitted.
3. For local OAuth testing, use a self-signed cert with https and trust it appropriately.

Example fix

# before
url: http://localhost:8080/mcp
auth: {client_id: abc}

# after
url: https://localhost:8443/mcp
auth: {client_id: abc}

def auth_url_is_https(entry: dict) -> bool:
    if entry.get('auth') is not None:
        return str(entry.get('url', '')).strip().lower().startswith('https://')
    return True

When it happens

Trigger: An auth-configured server with url starting with http:// or any non-https scheme; local development against http://localhost with real OAuth credentials.

Common situations: Local dev against a non-TLS proxy; typo dropping the 's' in https; on-prem servers without TLS where OAuth was enabled anyway.

Related errors

• stdio MCP servers do not accept auth (OAuth is HTTP-only)
• MCP servers using auth must not also set static headers (the
• Live-broker MCP server '{server_key}' may not use a wildcard
• HTTP MCP servers require an explicit type of 'sse' or 'strea
• stdio MCP servers require a command

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/dba7fd9fc978a90f. Report an issue: GitHub.