unslothai/unsloth · warning · HTTPException

Enter an http(s):// URL, or a local command whose first toke

Error message

Enter an http(s):// URL, or a local command whose first token is an executable (not a URL).

What it means

400 raised when stdio MCP is enabled, the value is treated as a local command, but the first parsed token contains '://' — i.e. the user typed a URL into the command field. The backend refuses to exec a URL-looking token as a process (which would fail or do something unintended) and tells the user to use the value as a proper http(s) URL instead. Mirrors the frontend's check.

Source

Thrown at studio/backend/routes/mcp_servers.py:84

    # When stdio is enabled, a non-HTTP value is a local command (reuses this
    # field so stdio servers ride existing CRUD/storage).
    if stdio_mcp_enabled() and is_stdio(trimmed):
        try:
            parts = parse_stdio_command(trimmed)
        except ValueError as exc:
            raise log_and_http_error(
                exc,
                400,
                "Invalid command. Check quoting and try again.",
                event = "mcp_servers.invalid_command",
                log = logger,
            )
        if not parts or not parts[0].strip():
            raise HTTPException(status_code = 400, detail = "command must not be empty")
        if "://" in parts[0]:
            # A URL-scheme first token is a mistyped URL, not a command. Reject
            # cleanly instead of exec-ing it (mirrors the frontend check).
            raise HTTPException(
                status_code = 400,
                detail = "Enter an http(s):// URL, or a local command whose "
                "first token is an executable (not a URL).",
            )
        return trimmed
    parsed = urlparse(trimmed)
    if parsed.scheme not in ("http", "https"):
        if _looks_like_command(trimmed):
            detail = (
                "Local commands aren't enabled on this server. To allow them, "
                "set UNSLOTH_STUDIO_ALLOW_STDIO_MCP=1 and restart Unsloth, or use "
                "an http:// or https:// URL instead."
            )
        else:
            detail = (
                "MCP server address must start with http:// or https:// "
                "(for example https://example.com/mcp)."
            )

View on GitHub (pinned to 203007d190)

Solutions

1. If you meant a remote server: send just the http(s):// URL with no trailing tokens after it (encode spaces in the path/query).
2. If you meant a local command: put a real executable first (npx, uvx, node, python) and pass any URL as a later argument, not the first token.

Example fix

# before
{'url': 'https://example.com/mcp --flag'}   # -> 400, URL in executable slot

# after
{'url': 'https://example.com/mcp'}           # remote server
# or
{'url': 'npx -y some-mcp-wrapper https://example.com/mcp'}  # URL as an argument

const first = command.trim().split(/\s+/)[0];
if (first.includes('://')) throw new Error('First token looks like a URL — send the URL alone, or put a real executable first');

function firstTokenIsExecutable(cmd) { return !cmd.trim().split(/\s+/)[0].includes('://'); }

When it happens

Trigger: POST/PUT an MCP server with url like 'https://example.com/mcp extra-arg' or 'http://host' while stdio mode classifies it as a command because the string contains whitespace (a URL with an unencoded space is definitively not a URL, so 'npx https://...' style mistakes land here too).

Common situations: Pasting a URL plus arguments into the command box, or constructing 'npx https://server.example' style commands where the executable slot holds a URL.

Related errors

• url must not be empty
• command must not be empty
• MCP server address must start with http:// or https:// (for
• url is missing a host
• Local commands aren't enabled on this server. To allow them,

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/fa6c72ca0b783018. Report an issue: GitHub.