langchain-ai/deepagents · error · MarketplaceError

Marketplace response must use https: {detail}

Error message

Marketplace response must use https: {detail}

What it means

After _download_marketplace completes the HTTP request, it checks the final (post-redirect) response URL and requires it to be https. This catches cases where the initial URL was https but the server silently redirected to a non-https endpoint, preventing a downgrade even mid-chain.

Source

Thrown at libs/code/deepagents_code/plugins/marketplace.py:377

def _download_marketplace(url: str) -> Path:
    parsed = urlparse(url)
    if parsed.scheme != "https":
        msg = f"Marketplace URL must use https: {_redact_url_credentials(url)}"
        raise MarketplaceError(msg)
    cache_path = (
        ensure_marketplace_cache_dir() / f"marketplace-url-{opaque_cache_key(url)}.json"
    )
    request = urllib.request.Request(  # noqa: S310  # Scheme is restricted above.
        url, headers={"User-Agent": "dcode-plugin-manager"}
    )
    opener = urllib.request.build_opener(_HttpsOnlyRedirectHandler())
    try:
        with opener.open(request, timeout=10) as response:
            final_url = response.geturl()
            if urlparse(final_url).scheme != "https":
                detail = _redact_url_credentials(final_url)
                msg = f"Marketplace response must use https: {detail}"
                raise MarketplaceError(msg)
            data = json.load(response)
    except (OSError, urllib.error.URLError, json.JSONDecodeError) as exc:
        msg = (
            "Failed to download marketplace from "
            f"{_redact_url_credentials(url)}: {redact_urls_in_text(str(exc))}"
        )
        raise MarketplaceError(msg) from exc
    if not isinstance(data, dict):
        msg = (
            f"Marketplace URL must return a JSON object: {_redact_url_credentials(url)}"
        )
        raise MarketplaceError(msg)
    cache_path.parent.mkdir(parents=True, exist_ok=True)
    cache_path.write_text(
        json.dumps(data, indent=2, sort_keys=True) + "\n", encoding="utf-8"
    )
    return cache_path

View on GitHub (pinned to a1af029e6e)

Solutions

  1. Make the final redirect destination use https://
  2. Remove the redirect and serve the catalog at the original https URL
  3. Check the response chain with curl -sIL <url> and fix the hop that drops TLS

Example fix

# diagnose
$ curl -sIL https://example.com/marketplace.json | grep -i location
# before
location: http://cdn.example.com/marketplace.json
// after
location: https://cdn.example.com/marketplace.json
Defensive patterns

Strategy: try-catch

Validate before calling

import urllib.request
from urllib.parse import urlparse
req = urllib.request.Request(url, method="HEAD")
with urllib.request.urlopen(req) as resp:
    assert urlparse(resp.geturl()).scheme == "https", "final URL not https"

Type guard

def final_url_is_https(url: str) -> bool:
    import urllib.request
    from urllib.parse import urlparse
    with urllib.request.urlopen(url) as r:
        return urlparse(r.geturl()).scheme == "https"

Try / catch

try:
    marketplace, path = materialize_marketplace_source(source)
except MarketplaceError as exc:
    if "response must use https" in str(exc):
        log.error("Marketplace redirect chain exits TLS at %s", exc)
    raise

Prevention

When it happens

Trigger: Requesting an https:// marketplace URL where the server returns a redirect whose final response.geturl() is not https (e.g. https host redirecting to http CDN).

Common situations: TLS-terminating proxy forwards to http backend; misconfigured hosting that 301s https traffic to http; a marketplace file moved to a new plain-HTTP host.

Related errors

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/07f012cb0a0a59d1. Report an issue: GitHub.