tinyhumansai/openhuman · error

Browser tool enabled but no allowed_domains configured. Add

Error message

Browser tool enabled but no allowed_domains configured. Add [browser].allowed_domains in config.toml or set OPENHUMAN_BROWSER_ALLOW_ALL=1

What it means

validate_url fails when the browser tool is enabled but [browser].allowed_domains is empty and the OPENHUMAN_BROWSER_ALLOW_ALL=1 escape hatch is not set. An empty allowlist would mean every navigation is out of policy, so the misconfiguration is reported before any navigation is attempted.

Source

Thrown at src/openhuman/tools/impl/browser/browser.rs:301

    fn validate_url(&self, url: &str) -> anyhow::Result<()> {
        let url = url.trim();

        if url.is_empty() {
            anyhow::bail!("URL cannot be empty");
        }

        // Block file:// URLs — browser file access bypasses all SSRF and
        // domain-allowlist controls and can exfiltrate arbitrary local files.
        if url.starts_with("file://") {
            anyhow::bail!("file:// URLs are not allowed in browser automation");
        }

        if !url.starts_with("https://") && !url.starts_with("http://") {
            anyhow::bail!("Only http:// and https:// URLs are allowed");
        }

        if self.allowed_domains.is_empty() && !allow_all_browser_domains() {
            anyhow::bail!(
                "Browser tool enabled but no allowed_domains configured. \
                Add [browser].allowed_domains in config.toml or set OPENHUMAN_BROWSER_ALLOW_ALL=1"
            );
        }

        let host = extract_host(url)?;

        if is_private_host(&host) {
            anyhow::bail!("Blocked local/private host: {host}");
        }

        if !self.allowed_domains.is_empty() && !host_matches_allowlist(&host, &self.allowed_domains)
        {
            anyhow::bail!("Host '{host}' not in browser.allowed_domains");
        }

        Ok(())
    }

View on GitHub (pinned to 7491200858)

Solutions

1. Add [browser].allowed_domains entries in config.toml.
2. Set OPENHUMAN_BROWSER_ALLOW_ALL=1 only if unrestricted browsing is intended.

When it happens

Trigger: Thrown at src/openhuman/tools/impl/browser/browser.rs:301 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/19317df10e5f685e. Report an issue: GitHub.