langchain-ai/deepagents · error · MarketplaceError

Marketplace redirect must use https: {detail}

Error message

Marketplace redirect must use https: {detail}

What it means

This error is raised by the custom HTTPS redirect handler used when downloading a marketplace catalog. urllib followed an HTTP 3xx redirect, but the redirect target URL does not use the https scheme, so the library refuses the redirect to prevent a secure request from being downgraded to plaintext HTTP. The target URL is credential-redacted before being included in the message.

Source

Thrown at libs/code/deepagents_code/plugins/marketplace.py:355

    cache_key: str,
) -> Path:
    return _clone_repository_to_cache(source, git_url, cache_key=cache_key)


class _HttpsOnlyRedirectHandler(urllib.request.HTTPRedirectHandler):
    def redirect_request(
        self,
        req: urllib.request.Request,
        fp: IO[bytes],
        code: int,
        msg: str,
        headers: HTTPMessage,
        newurl: str,
    ) -> urllib.request.Request | None:
        if urlparse(newurl).scheme != "https":
            detail = _redact_url_credentials(newurl)
            error = f"Marketplace redirect must use https: {detail}"
            raise MarketplaceError(error)
        return super().redirect_request(req, fp, code, msg, headers, newurl)


def _download_marketplace(url: str) -> Path:
    parsed = urlparse(url)
    if parsed.scheme != "https":
        msg = f"Marketplace URL must use https: {_redact_url_credentials(url)}"
        raise MarketplaceError(msg)
    cache_path = (
        ensure_marketplace_cache_dir() / f"marketplace-url-{opaque_cache_key(url)}.json"
    )
    request = urllib.request.Request(  # noqa: S310  # Scheme is restricted above.
        url, headers={"User-Agent": "dcode-plugin-manager"}
    )
    opener = urllib.request.build_opener(_HttpsOnlyRedirectHandler())
    try:
        with opener.open(request, timeout=10) as response:
            final_url = response.geturl()

View on GitHub (pinned to a1af029e6e)

Solutions

  1. Fix the server/CDN redirect so the Location header points to an https:// URL
  2. Serve the marketplace directly over https with no redirect chain that exits TLS
  3. Verify the configured marketplace URL is correct; a wrong hostname may land on a server that redirects to http
  4. If you control the infrastructure, enable HTTPS on the redirect target

Example fix

// before (server config redirects to http)
Redirect permanent / http://cdn.example.com/marketplace.json
// after
Redirect permanent / https://cdn.example.com/marketplace.json
Defensive patterns

Strategy: try-catch

Validate before calling

from urllib.parse import urlparse
if urlparse(marketplace_url).scheme != "https":
    raise ValueError("Marketplace URL must be https")

Type guard

def is_https_url(url: str) -> bool:
    return urlparse(url).scheme == "https"

Try / catch

try:
    marketplace, path = materialize_marketplace_source(source)
except MarketplaceError as exc:
    if "redirect must use https" in str(exc):
        log.warning("Marketplace host redirects to non-https; fix server or pick another URL")
    else:
        raise

Prevention

When it happens

Trigger: Calling any marketplace download flow (e.g. adding a URL-based marketplace via materialize_marketplace_source -> _download_marketplace) where the server responds with a redirect (301/302/307/308) to an http:// or other non-https URL.

Common situations: A marketplace host misconfigured to redirect https traffic to plain http; a CDN or load balancer terminating TLS and forwarding over http; a typo'd or stale canonical URL configured on the server.

Related errors

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/830d47b6aa1f62c7. Report an issue: GitHub.