{"record":{"id":"8515190fef6e73c6","repo":"ruvnet/ruflo","slug":"warning-connecting-to-non-https-mcp-server-in-pro","errorCode":null,"errorMessage":"Warning: Connecting to non-HTTPS MCP server in production. This may expose sensitive data.","messagePattern":"Warning: Connecting to non-HTTPS MCP server in production\\. This may expose sensitive data\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ruflo/src/ruvocal/src/lib/utils/mcpValidation.ts","lineNumber":28,"sourceCode":" * @param urlString - The URL string to validate\n * @returns Sanitized URL string or null if invalid\n */\nexport function validateMcpServerUrl(urlString: string): string | null {\n\tif (!urlString || typeof urlString !== \"string\") {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst url = new URL(urlString.trim());\n\n\t\t// Allow http/https only\n\t\tif (![\"http:\", \"https:\"].includes(url.protocol)) {\n\t\t\treturn null;\n\t\t}\n\n\t\t// Warn about non-HTTPS in production\n\t\tif (!dev && url.protocol === \"http:\" && browser) {\n\t\t\tconsole.warn(\n\t\t\t\t\"Warning: Connecting to non-HTTPS MCP server in production. This may expose sensitive data.\"\n\t\t\t);\n\t\t}\n\n\t\t// Block certain localhost/private IPs in production\n\t\tif (!dev && isPrivateOrLocalhost(url.hostname)) {\n\t\t\tconsole.warn(\"Warning: Localhost/private IP addresses are not recommended in production.\");\n\t\t}\n\n\t\treturn url.toString();\n\t} catch (error) {\n\t\t// Invalid URL\n\t\treturn null;\n\t}\n}\n\n/**\n * Check if hostname is localhost or a private IP","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/ruflo/src/ruvocal/src/lib/utils/mcpValidation.ts#L10-L46","documentation":"Browser-side console warning from validateMcpServerUrl: an MCP server URL uses plain http: while running in production mode, which can expose request payloads in transit; the URL is still accepted, only warned about.","triggerScenarios":"Thrown at ruflo/src/ruvocal/src/lib/utils/mcpValidation.ts:28 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an HTTPS URL for the MCP server in production to avoid exposing traffic."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}