What causes "An enterprise MCP server URL must use HTTP or HTTPS." in different-ai/openwork?

Use an http:// or https:// URL for serverUrl (https:// in production).

An enterprise MCP server URL must use HTTP or HTTPS.

Error message

An enterprise MCP server URL must use HTTP or HTTPS.

What it means

validateConnection in packages/enterprise-mcp-client/src/enterprise-mcp-client.ts parses the serverUrl with a zod URL schema and then checks the resulting URL's protocol; anything other than http: or https: throws. The MCP transport (StreamableHTTPClientTransport) only speaks HTTP, so schemes like ws:, ftp:, or file: are rejected up front.

Source

Thrown at packages/enterprise-mcp-client/src/enterprise-mcp-client.ts:105

  observer: EnterpriseMcpRequestObserver
  controller: AbortController
  requestOptions: RequestOptions
  lifecycle: EnterpriseMcpLifecycle
}

function requestInit(authorization: EnterpriseMcpAuthorization): RequestInit | undefined {
  if (authorization.type !== "api-key") return undefined
  return { headers: { authorization: `Bearer ${authorization.token}` } }
}

function validateConnection(connection: EnterpriseMcpConnection): URL {
  const parsed = connectionSchema.parse({ id: connection.id, serverUrl: connection.serverUrl })
  if (connection.authorization.type === "api-key" && !connection.authorization.token.trim()) {
    throw new Error("An API key connection requires a non-empty token.")
  }
  const url = new URL(parsed.serverUrl)
  if (url.protocol !== "https:" && url.protocol !== "http:") {
    throw new Error("An enterprise MCP server URL must use HTTP or HTTPS.")
  }
  if (url.username || url.password) {
    throw new Error("An enterprise MCP server URL cannot contain embedded credentials.")
  }
  if (url.hash) throw new Error("An enterprise MCP server URL cannot contain a fragment.")
  return url
}

function validateRedirectUri(redirectUri: string): string {
  const parsed = redirectUriSchema.parse(redirectUri)
  const url = new URL(parsed)
  if (url.protocol !== "https:" && url.protocol !== "http:") {
    throw new Error("An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.")
  }
  if (url.username || url.password || url.hash) {
    throw new Error("An enterprise MCP OAuth redirect URI cannot contain credentials or a fragment.")
  }
  return parsed

View on GitHub (pinned to 2b7df46e8a)

Solutions

Use an http:// or https:// URL for serverUrl (https:// in production).
If you have a ws:// or wss:// endpoint, find its HTTP streamable equivalent (usually the same host/path without the ws scheme).
Validate the configured URL's protocol before constructing the connection.

Example fix

// before
serverUrl: "wss://mcp.example.com/mcp"

// after
serverUrl: "https://mcp.example.com/mcp"

Defensive patterns

Strategy: validation

Validate before calling

function assertHttpUrl(serverUrl: string) {
  const u = new URL(serverUrl)
  if (u.protocol !== "https:" && u.protocol !== "http:") {
    throw new Error(`serverUrl must be http(s), got ${u.protocol}`)
  }
}

Prevention

Store canonical https:// URLs in configuration, never ws:// or scheme-less hosts
Normalize endpoints at config load time with new URL() and re-serialize
Add a startup config lint that checks all serverUrl values

When it happens

Trigger: Creating a connection with serverUrl using a non-HTTP(S) scheme, e.g. "ws://mcp.example.com", "ftp://host", or a URL that zod accepted but new URL() resolved to another protocol.

Common situations: Confusing WebSocket (ws://) URLs — used by the older SSE-style MCP transports — with the HTTP streamable transport; copy-pasting a scheme-less host and a library adding a wrong prefix; typos like "http//" that parse oddly.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/1bd3a6d52df36f35. Report an issue: GitHub.