musistudio/claude-code-router · error · Error

${identityIssue.message}

Error message

${identityIssue.message}

What it means

Thrown when a remote provider manifest defines a provider whose baseUrl or name trips the providerIdentitySafetyIssue check (e.g. the base URL impersonates a known/bundled provider identity). This is a supply-chain/SSRF guard: a remote manifest is untrusted input, so providers that masquerade as official presets are rejected before any fetch happens.

Source

Thrown at packages/core/src/providers/manifest-service.ts:165

  }
  if (url.username || url.password) {
    throw new Error("Provider manifest URL cannot include credentials.");
  }
  if (url.hash) {
    url.hash = "";
  }
  validateRemoteHostname(url.hostname, "Provider manifest URL");
  return url;
}

async function validateRemoteManifestProvider(provider: ProviderDeepLinkPayload): Promise<void> {
  await validatePublicHttpsUrl(provider.baseUrl, "Provider Base URL");
  const identityIssue = providerIdentitySafetyIssue({
    baseUrl: provider.baseUrl,
    name: provider.name
  });
  if (identityIssue) {
    throw new Error(identityIssue.message);
  }

  const connectors = provider.account?.connectors ?? [];
  for (const connector of connectors) {
    await validateRemoteAccountConnector(provider, connector);
  }
}

async function validateRemoteAccountConnector(provider: ProviderDeepLinkPayload, connector: ProviderAccountConnectorConfig): Promise<void> {
  if (connector.type === "http-json") {
    validateSafeHeaders(connector.headers);
    const endpoint = (connector as ProviderAccountHttpJsonConnectorConfig).endpoint;
    await validatePublicHttpsUrl(endpoint, "Fetch usage URL");
    validateProviderApiKeyTarget(provider, endpoint);
    return;
  }
  if (connector.type === "standard") {
    const standardConnector = connector as ProviderAccountStandardConnectorConfig;

View on GitHub (pinned to 99f24806c6)

Solutions

1. Change the manifest provider's baseUrl to a domain you actually own rather than one matching a bundled provider preset
2. Rename the provider in the manifest so it does not impersonate an official provider identity
3. If the manifest is yours and the collision is legitimate, serve it locally instead of as a remote manifest (local manifests skip the remote identity checks)
4. Upgrade the manifest host and core package together so preset identity data is in sync

Example fix

// before (manifest.json)
{"name": "openrouter", "baseUrl": "https://openrouter.ai/api/v1"}
// after
{"name": "my-gateway", "baseUrl": "https://manifests.example.com/my-gateway"}

const issue = providerIdentitySafetyIssue({ baseUrl: provider.baseUrl, name: provider.name });
if (issue) throw new Error(issue.message); // surface before fetchProviderManifest

When it happens

Trigger: fetchProviderManifest() on a remote manifest whose provider entry has a baseUrl that collides with a known provider preset identity (or a spoofing name pattern), causing providerIdentitySafetyIssue({baseUrl, name}) to return an issue.

Common situations: Hosting a community manifest that copies an official provider's base URL, renaming a custom provider to match a bundled one, or stale manifest entries after the local presets list changed in an upgrade.

Related errors

• ${label} cannot target a local or internal host.
• Provider manifest URL must use https.
• Provider manifest URL cannot include credentials.
• ${issue.message}
• ${label} from a remote manifest must use https.

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/a1fa580d35158bc1. Report an issue: GitHub.