What causes "Remote plugin server port out of range. Expected [0, %s], actual %s." in google/tsunami-security-scanner?

Set each --remote-plugin-server-port value to an integer in 1..65535.

google/tsunami-security-scanner · error · ParameterException

Remote plugin server port out of range. Expected

Error message

Remote plugin server port out of range. Expected [0, %s], actual %s.

What it means

LanguageServerOptions.validate() checks every --remote-plugin-server-port value against NetworkEndpointUtils.MAX_PORT_NUMBER and rejects ports that are <= 0 (despite the message text saying 'Expected [0, ...]'). This guarantees remote plugin server endpoints are valid TCP ports before Tsunami connects to them.

Solutions

Set each --remote-plugin-server-port value to an integer in 1..65535.
Verify the plugin server actually listens on the configured port.
Check for typos or duplicated digits in the port list.

Example fix

// before
--remote-plugin-server-port=99966
// after
--remote-plugin-server-port=9996

Defensive patterns

Strategy: validation

Validate before calling

boolean valid = ports.stream().allMatch(p -> p > 0 && p <= 65535);

Try / catch

try { options.validate(); } catch (ParameterException e) { throw new IllegalArgumentException("Bad remote plugin server port: " + e.getMessage(), e); }

Prevention

Check port ranges (1-65535) in any script that generates Tsunami flags.
Confirm the plugin server listens on the configured port before launching the scan.
Avoid hand-editing port digits; use variables.

When it happens

Trigger: Passing a remote plugin server port of 0, negative, or greater than 65535 (NetworkEndpointUtils.MAX_PORT_NUMBER) to --remote-plugin-server-port, evaluated in the for-loop at LanguageServerOptions.java:139.

Common situations: Typo like 99966 instead of 9996; using port 0 by mistake; forgetting the flag expects port numbers, not full host:port strings parsed to an out-of-range number.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/e98c38e9a693114f. Report an issue: GitHub.

Appendix: source

Thrown at main/src/main/java/com/google/tsunami/main/cli/LanguageServerOptions.java:139

            String.format(
                "Number of remote plugin server paths must be equal to number of plugin server "
                    + "ports. Addresses: %s. Ports: %s.",
                addrCounts, portCounts));
      }

      if (!remotePluginServerRpcDeadlineSeconds.isEmpty()) {
        if (remotePluginServerRpcDeadlineSeconds.size() != addrCounts) {
          throw new ParameterException(
              String.format(
                  "Number of plugin server rpc deadlines must be equal to number of plugin server"
                      + " ports. Paths: %s. Ports: %s. Deadlines: %s",
                  addrCounts, portCounts, pluginServerRpcDeadlineSeconds.size()));
        }
      }

      for (int port : remotePluginServerPort) {
        if (!(port <= NetworkEndpointUtils.MAX_PORT_NUMBER && port > 0)) {
          throw new ParameterException(
              String.format(
                  "Remote plugin server port out of range. Expected [0, %s], actual %s.",
                  NetworkEndpointUtils.MAX_PORT_NUMBER, port));
        }
      }
    }
  }
}

View on GitHub (pinned to 363ba87b35)