RightNow-AI/openfang · error

Failed to build HTTP client

Error message

Failed to build HTTP client

What it means

Same reqwest failure as the CLI main path: reqwest::blocking::Client::builder().build() errors when TLS backend init, proxy parsing, or builder config is invalid. The MCP server's create_backend() panics via expect, so the whole MCP process dies when a daemon was found but the HTTP client cannot be constructed.

Source

Thrown at crates/openfang-cli/src/mcp.rs:143

            Ok(Some(msg)) => {
                let response = handle_message(&backend, &msg);
                if let Some(resp) = response {
                    write_message(&mut writer, &resp);
                }
            }
            Ok(None) => break,
            Err(_) => break,
        }
    }
}

fn create_backend(config: Option<std::path::PathBuf>) -> McpBackend {
    // Try daemon first
    if let Some(base_url) = super::find_daemon() {
        let client = reqwest::blocking::Client::builder()
            .timeout(std::time::Duration::from_secs(120))
            .build()
            .expect("Failed to build HTTP client");
        return McpBackend::Daemon { base_url, client };
    }

    // Fall back to in-process kernel
    let kernel = match OpenFangKernel::boot(config.as_deref()) {
        Ok(k) => k,
        Err(e) => {
            eprintln!("Failed to boot kernel for MCP: {e}");
            std::process::exit(1);
        }
    };
    let rt = tokio::runtime::Runtime::new().expect("Failed to create Tokio runtime");
    McpBackend::InProcess {
        kernel: Box::new(kernel),
        rt,
    }
}

View on GitHub (pinned to acf2587e46)

Solutions

1. Fix the environment: install CA certificates (ca-certificates package) and correct/unset malformed proxy env vars.
2. Fall back to the in-process kernel backend instead of panicking when client construction fails.
3. If using rustls with multiple crypto providers installed, ensure a default provider is installed (CryptoProvider::install_default) at startup.
4. Propagate the error and report it via MCP protocol instead of aborting the process.

Example fix

// before
let client = reqwest::blocking::Client::builder()
    .timeout(std::time::Duration::from_secs(120))
    .build()
    .expect("Failed to build HTTP client");
return McpBackend::Daemon { base_url, client };
// after
match reqwest::blocking::Client::builder()
    .timeout(std::time::Duration::from_secs(120))
    .build()
{
    Ok(client) => return McpBackend::Daemon { base_url, client },
    Err(e) => eprintln!("daemon client unavailable ({e}); using in-process kernel"),
}

// Verify TLS-capable environment before attempting daemon client
fn tls_env_ok() -> bool {
    std::path::Path::new("/etc/ssl/certs/ca-certificates.crt").exists()
        || std::env::var_os("SSL_CERT_FILE").is_some()
}

// fall back to in-process kernel when client build fails
match reqwest::blocking::Client::builder()
    .timeout(std::time::Duration::from_secs(120))
    .build()
{
    Ok(client) => return McpBackend::Daemon { base_url, client },
    Err(e) => {
        eprintln!("daemon client unavailable: {e}; falling back to in-process kernel");
        // proceed to OpenFangKernel::boot path
    }
}

When it happens

Trigger: create_backend() finds a daemon via find_daemon(), then builds a blocking client with a 120s timeout; build() fails due to TLS backend initialization errors, malformed proxy env vars, or invalid builder options.

Common situations: Containers missing CA certificates (rustls-native-certs or system trust store empty); HTTPS_PROXY pointing to an invalid URL; running under musl/minimal images without TLS crypto provider initialized.

Related errors

• Failed to build HTTP client
• Failed to build HTTP client
• Failed to create Tokio runtime
• MCP message too large: {content_length} bytes (max {MAX_MCP_
• Failed to listen for SIGTERM

AI-assisted analysis of RightNow-AI/openfang@acf2587e46 (2026-09-02). Data as JSON: /api/errors/81123fbedd19c89a. Report an issue: GitHub.