tinyhumansai/openhuman · error

Host '{host}' is not in browser.allowed_domains

Error message

Host '{host}' is not in browser.allowed_domains

What it means

Allowlist enforcement in BrowserOpenTool::validate_url. After https-only and configured-allowlist checks, the extracted host is matched against browser.allowed_domains (normalize_allowed_domains-applied); a host that matches no entry (including wildcard suffixes) is refused. It fires whenever the user opens a URL on a domain not explicitly allowlisted in config.toml — a deliberate security boundary, not a misconfiguration.

Source

Thrown at src/openhuman/tools/impl/browser/browser_open.rs:49

        if !url.starts_with("https://") {
            anyhow::bail!("Only https:// URLs are allowed");
        }

        if self.allowed_domains.is_empty() {
            anyhow::bail!(
                "Browser tool is enabled but no allowed_domains are configured. Add [browser].allowed_domains in config.toml"
            );
        }

        let host = extract_host(url)?;

        if is_private_or_local_host(&host) {
            anyhow::bail!("Blocked local/private host: {host}");
        }

        if !host_matches_allowlist(&host, &self.allowed_domains) {
            anyhow::bail!("Host '{host}' is not in browser.allowed_domains");
        }

        Ok(url.to_string())
    }
}

#[async_trait]
impl Tool for BrowserOpenTool {
    fn name(&self) -> &str {
        "browser_open"
    }

    fn description(&self) -> &str {
        "Open an approved HTTPS URL in Brave Browser. Security constraints: allowlist-only domains, no local/private hosts, no scraping."
    }

    fn parameters_schema(&self) -> serde_json::Value {
        json!({

View on GitHub (pinned to 7491200858)

Solutions

1. Add the host (or wildcard pattern) to [browser].allowed_domains.
2. Choose a URL on an already-allowed domain.

When it happens

Trigger: Thrown at src/openhuman/tools/impl/browser/browser_open.rs:49 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/d2c8ea5fcd14e9e7. Report an issue: GitHub.