langchain-ai/deepagents · error · MarketplaceError

Remote marketplace sources must use https

Error message

Remote marketplace sources must use https

What it means

`parse_marketplace_source` rejects any marketplace source that starts with `http://` (marketplace.py:165-167). The library enforces HTTPS for all remote marketplaces so that the marketplace JSON is fetched over an encrypted connection; a plaintext HTTP source could be tampered with in transit and the plugins it describes would then be installed unverified. The check runs before URL parsing, so even valid HTTP URLs are refused outright.

Source

Thrown at libs/code/deepagents_code/plugins/marketplace.py:167

        Parsed marketplace source.

    Raises:
        MarketplaceError: If the source string is empty or unsupported.
    """
    value = raw.strip()
    if not value:
        msg = "Please enter a marketplace source"
        raise MarketplaceError(msg)

    ssh_match = _SSH_GIT_RE.match(value)
    if ssh_match:
        return RepositoryMarketplaceSource(
            source_type="git", value=ssh_match.group(1), ref=ssh_match.group(2)
        )

    if value.startswith("http://"):
        msg = "Remote marketplace sources must use https"
        raise MarketplaceError(msg)
    if value.startswith("https://"):
        url, _, ref = value.partition("#")
        try:
            parsed = urlparse(url)
        except ValueError as exc:
            msg = "Invalid marketplace URL"
            raise MarketplaceError(msg) from exc
        path = parsed.path
        if path.endswith(".git") or "/_git/" in path:
            return RepositoryMarketplaceSource(
                source_type="git", value=url, ref=ref or None
            )
        if parsed.hostname in {"github.com", "www.github.com"}:
            parts = [part for part in path.split("/") if part]
            if len(parts) == _GITHUB_REPO_PART_COUNT:
                repo_path = "/".join(parts)
                git_url = urlunparse(parsed._replace(path=f"/{repo_path}.git"))
                return RepositoryMarketplaceSource(

View on GitHub (pinned to a1af029e6e)

Solutions

1. Change the source URL scheme from `http://` to `https://` and retry.
2. If the server does not support HTTPS, put it behind TLS (reverse proxy or certificate) before registering it as a marketplace.
3. For purely local marketplaces, use a filesystem path (`./path` or `~/path`) instead of an HTTP URL.

Example fix

// before
add_marketplace_source("http://example.com/marketplace.json")
// after
add_marketplace_source("https://example.com/marketplace.json")

def ensure_https(source: str) -> str:
    stripped = source.strip()
    if stripped.startswith("http://"):
        raise ValueError(f"Use https instead of http: {stripped}")
    return stripped

add_marketplace_source(ensure_https(user_source))

def is_https_url(value: str) -> bool:
    return value.strip().startswith("https://")

try:
    source = parse_marketplace_source(raw)
except MarketplaceError as exc:
    if "must use https" in str(exc):
        raw = raw.replace("http://", "https://", 1)
        source = parse_marketplace_source(raw)
    else:
        raise

When it happens

Trigger: Calling `parse_marketplace_source('http://example.com/marketplace.json')`, `add_marketplace_source(...)` with an `http://` URL, or configuring a plugin repository source (via `_plugin_repository_source`) whose value starts with `http://`. Any leading-whitespace-trimmed `http://` string reaches this branch, since SCP-style and GitHub-shorthand regexes do not match it.

Common situations: Copying a marketplace URL from an internal server or docs page that still uses plain HTTP; self-hosted Git servers (GitLab/Gitea) behind HTTP-only endpoints; hand-typed URLs in a config file; older CI scripts written before the HTTPS-only policy.

Related errors

• remote source must be an absolute HTTPS URL
• remote source must not contain credentials
• remote_source must be a validated absolute HTTPS URL
• Marketplace URL must use https: {_redact_url_credentials(url
• allow_fs_tools must be None or a non-empty list

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/81b7eab6bf077030. Report an issue: GitHub.