musistudio/claude-code-router · error · Error

${label} from a remote manifest must use https.

Error message

${label} from a remote manifest must use https.

What it means

validatePublicHttpsUrl rejects any URL from a remote manifest that is not https. Remote manifests are fetched over the network and their derived URLs will carry credentials/tokens, so plaintext http would allow interception.

Source

Thrown at packages/core/src/providers/manifest-service.ts:213

  }
}

function validateProviderApiKeyTarget(provider: ProviderDeepLinkPayload, endpoint: string): void {
  const issue = providerEndpointCanReceiveProviderApiKey({
    apiKey: "manifest-provider-api-key",
    endpoint,
    providerName: provider.name,
    providerPresetId: findProviderPresetByBaseUrl(provider.baseUrl)?.id
  });
  if (issue) {
    throw new Error(issue.message);
  }
}

async function validatePublicHttpsUrl(value: string, label: string): Promise<void> {
  const url = new URL(providerUrlWithDefaultScheme(value));
  if (url.protocol !== "https:") {
    throw new Error(`${label} from a remote manifest must use https.`);
  }
  if (url.username || url.password) {
    throw new Error(`${label} cannot include credentials.`);
  }
  validateRemoteHostname(url.hostname, label);
  await resolveSafeAddress(url.hostname);
}

function validateRemoteHostname(hostname: string, label: string): void {
  const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
  if (!normalized) {
    throw new Error(`${label} is invalid.`);
  }
  if (
    normalized === "localhost" ||
    normalized.endsWith(".localhost") ||
    normalized.endsWith(".home") ||
    normalized.endsWith(".lan") ||

View on GitHub (pinned to 99f24806c6)

Solutions

1. Change the URL in the manifest to https://...
2. Obtain a TLS certificate for the host (e.g. Let's Encrypt) if the service is public
3. For local testing, use a local manifest instead of a remote one (the remote https rule does not apply)

Example fix

// before
"baseUrl": "http://api.example.com"
// after
"baseUrl": "https://api.example.com"

if (!provider.baseUrl.startsWith('https://')) throw new Error('remote manifest URLs must use https');

When it happens

Trigger: validatePublicHttpsUrl(value, label) where the parsed URL protocol is 'http:' (or any non-https scheme) — e.g. provider.baseUrl 'http://api.example.com' or a connector endpoint without a scheme defaulting to http.

Common situations: Manifest authored with http:// for local testing then deployed remotely; scheme omitted so providerUrlWithDefaultScheme applied http; or an internal tool URL pasted into a public manifest.

Related errors

• Artifact origin is not the configured CCR gateway.
• Provider manifest URL must use https.
• ${identityIssue.message}
• ${label} cannot include credentials.
• ${label} is invalid.

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/c51d54c13568657c. Report an issue: GitHub.