{"record":{"id":"a8211f5381d860c5","repo":"zeroclaw-labs/zeroclaw","slug":"mcp-server-server-name-tls-ca-cert-path-requi","errorCode":null,"errorMessage":"MCP server `{server_name}`: tls_ca_cert_path requires an HTTPS {target}; refusing plaintext transport","messagePattern":"MCP server `(.+?)`: tls_ca_cert_path requires an HTTPS (.+?); refusing plaintext transport","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/mcp_transport.rs","lineNumber":91,"sourceCode":"    }\n}\n\nfn apply_request_timeout(\n    req: reqwest::RequestBuilder,\n    timeout_secs: Option<u64>,\n) -> reqwest::RequestBuilder {\n    if let Some(timeout_secs) = timeout_secs {\n        req.timeout(Duration::from_secs(timeout_secs))\n    } else {\n        req\n    }\n}\n\nfn require_https_url(server_name: &str, url: &str, target: &str) -> Result<()> {\n    let parsed = reqwest::Url::parse(url)\n        .with_context(|| format!(\"MCP server `{server_name}`: invalid {target} URL\"))?;\n    if parsed.scheme() != \"https\" {\n        bail!(\n            \"MCP server `{server_name}`: tls_ca_cert_path requires an HTTPS {target}; \\\n             refusing plaintext transport\"\n        );\n    }\n    Ok(())\n}\n\n/// Open a candidate CA file without letting a special file block the caller.\n///\n/// The open itself carries `O_NONBLOCK` on unix so that a FIFO (or a symlink to\n/// one) substituted at `path` returns a handle immediately instead of parking\n/// the thread until a writer appears. Classification happens on the returned\n/// handle, never on a second pathname lookup, so the file object we validate is\n/// the same one we read.\n///\n/// Symlinks are followed deliberately: certificate rotation and mounted-secret\n/// deployments publish CA bundles through symlink indirection. Following them is\n/// safe here precisely because the resulting handle is classified after the","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/mcp_transport.rs#L73-L109","documentation":"Error \"MCP server `{server_name}`: tls_ca_cert_path requires an HTTPS {target}; refusing plaintext transport\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:91 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an https URL for the MCP server when tls_ca_cert_path is set."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}