langchain-ai/deepagents · error · MarketplaceError

Marketplace URL must use https: {_redact_url_credentials(url

Error message

Marketplace URL must use https: {_redact_url_credentials(url)}

What it means

_download_marketplace rejects any initial marketplace URL whose scheme is not https before issuing the request. This is a deliberate guard so plugin catalogs are only ever fetched over TLS; the URL is credential-redacted in the message.

Source

Thrown at libs/code/deepagents_code/plugins/marketplace.py:363

        req: urllib.request.Request,
        fp: IO[bytes],
        code: int,
        msg: str,
        headers: HTTPMessage,
        newurl: str,
    ) -> urllib.request.Request | None:
        if urlparse(newurl).scheme != "https":
            detail = _redact_url_credentials(newurl)
            error = f"Marketplace redirect must use https: {detail}"
            raise MarketplaceError(error)
        return super().redirect_request(req, fp, code, msg, headers, newurl)


def _download_marketplace(url: str) -> Path:
    parsed = urlparse(url)
    if parsed.scheme != "https":
        msg = f"Marketplace URL must use https: {_redact_url_credentials(url)}"
        raise MarketplaceError(msg)
    cache_path = (
        ensure_marketplace_cache_dir() / f"marketplace-url-{opaque_cache_key(url)}.json"
    )
    request = urllib.request.Request(  # noqa: S310  # Scheme is restricted above.
        url, headers={"User-Agent": "dcode-plugin-manager"}
    )
    opener = urllib.request.build_opener(_HttpsOnlyRedirectHandler())
    try:
        with opener.open(request, timeout=10) as response:
            final_url = response.geturl()
            if urlparse(final_url).scheme != "https":
                detail = _redact_url_credentials(final_url)
                msg = f"Marketplace response must use https: {detail}"
                raise MarketplaceError(msg)
            data = json.load(response)
    except (OSError, urllib.error.URLError, json.JSONDecodeError) as exc:
        msg = (
            "Failed to download marketplace from "

View on GitHub (pinned to a1af029e6e)

Solutions

1. Change the marketplace URL to start with https://
2. Serve the catalog over HTTPS (e.g. via a TLS-enabled host or a static hosting provider)
3. If this is a git/local marketplace, use the git or local source type instead of a URL source

Example fix

// before
add_marketplace_source("http://example.com/marketplace.json")
// after
add_marketplace_source("https://example.com/marketplace.json")

from urllib.parse import urlparse
def validate_marketplace_url(url: str) -> None:
    if urlparse(url).scheme != "https":
        raise ValueError(f"use https, got {urlparse(url).scheme}")

def is_https_url(url: str) -> bool:
    from urllib.parse import urlparse
    return urlparse(url).scheme == "https"

try:
    add_marketplace_source(url_source)
except MarketplaceError as exc:
    if "must use https" in str(exc):
        url_source = url_source.replace("http://", "https://", 1)
        add_marketplace_source(url_source)

When it happens

Trigger: Calling materialize_marketplace_source with a URL source (or add_marketplace_source) whose value starts with http://, ftp://, or any non-https scheme.

Common situations: Typing http:// instead of https:// when adding a marketplace; copying an old HTTP link from documentation; a config file containing a plain-HTTP catalog URL.

Related errors

• Remote marketplace sources must use https
• Marketplace redirect must use https: {detail}
• Marketplace response must use https: {detail}
• allow_fs_tools must be None or a non-empty list
• interpreter_ptc='all' exposes every host tool to PTC calls t

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/2cd00d9c01b429cd. Report an issue: GitHub.