ruvnet/ruflo · error

Warning: Connecting to non-HTTPS MCP server in production. T

Error message

Warning: Connecting to non-HTTPS MCP server in production. This may expose sensitive data.

What it means

Browser-side console warning from validateMcpServerUrl: an MCP server URL uses plain http: while running in production mode, which can expose request payloads in transit; the URL is still accepted, only warned about.

Source

Thrown at ruflo/src/ruvocal/src/lib/utils/mcpValidation.ts:28

 * @param urlString - The URL string to validate
 * @returns Sanitized URL string or null if invalid
 */
export function validateMcpServerUrl(urlString: string): string | null {
	if (!urlString || typeof urlString !== "string") {
		return null;
	}

	try {
		const url = new URL(urlString.trim());

		// Allow http/https only
		if (!["http:", "https:"].includes(url.protocol)) {
			return null;
		}

		// Warn about non-HTTPS in production
		if (!dev && url.protocol === "http:" && browser) {
			console.warn(
				"Warning: Connecting to non-HTTPS MCP server in production. This may expose sensitive data."
			);
		}

		// Block certain localhost/private IPs in production
		if (!dev && isPrivateOrLocalhost(url.hostname)) {
			console.warn("Warning: Localhost/private IP addresses are not recommended in production.");
		}

		return url.toString();
	} catch (error) {
		// Invalid URL
		return null;
	}
}

/**
 * Check if hostname is localhost or a private IP

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Use an HTTPS URL for the MCP server in production to avoid exposing traffic.

When it happens

Trigger: Thrown at ruflo/src/ruvocal/src/lib/utils/mcpValidation.ts:28 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/8515190fef6e73c6. Report an issue: GitHub.