What causes "Invalid Caido URL: {base_url}" in usestrix/strix?

Set a fully qualified URL including scheme and host: export STRIX_CAIDO_URL=http://127.0.0.1:8080.

usestrix/strix · error · ValueError

Invalid Caido URL: {base_url}

Error message

Invalid Caido URL: {base_url}

What it means

Caido proxy integration derives its GraphQL endpoint from STRIX_CAIDO_URL (default applied when unset). _graphql_url() parses the base URL and requires an http/https scheme and a non-empty network location; otherwise it raises ValueError. Every GraphQL call (login, search, repeat) funnels through this, so it fails on first client use.

Source

Thrown at strix/tools/proxy/caido_api.py:68

    "host": ("req", "host"),
    "method": ("req", "method"),
    "path": ("req", "path"),
    "source": ("req", "source"),
    "status_code": ("resp", "code"),
    "response_time": ("resp", "roundtrip"),
    "response_size": ("resp", "length"),
}


def caido_url() -> str:
    return os.environ.get("STRIX_CAIDO_URL", _DEFAULT_CAIDO_URL).rstrip("/")


def _graphql_url() -> str:
    base_url = caido_url()
    parsed = urlparse(base_url)
    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
        raise ValueError(f"Invalid Caido URL: {base_url}")
    return f"{base_url}/graphql"


def _login_as_guest() -> str:
    body = json.dumps({"query": "mutation { loginAsGuest { token { accessToken } } }"}).encode(
        "utf-8"
    )
    req = urllib.request.Request(  # noqa: S310
        _graphql_url(),
        data=body,
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=10) as resp:  # noqa: S310  # nosec B310
        payload = json.loads(resp.read())
    return str(payload["data"]["loginAsGuest"]["token"]["accessToken"])

View on GitHub (pinned to 8551339130)

Solutions

Set a fully qualified URL including scheme and host: export STRIX_CAIDO_URL=http://127.0.0.1:8080.
Confirm the port matches Caido's listening port in its settings.
Ensure the variable is not set to an empty string; unset it to use the default.
Check for scheme typos like 'http//' or 'http:/localhost'.

Example fix

# before
export STRIX_CAIDO_URL=localhost:8080

# after
export STRIX_CAIDO_URL=http://localhost:8080

Defensive patterns

Strategy: validation

Validate before calling

from urllib.parse import urlparse
import os

def caido_url_valid(url: str) -> bool:
    p = urlparse(url)
    return p.scheme in {"http", "https"} and bool(p.netloc)

url = os.environ.get("STRIX_CAIDO_URL", "")
assert not url or caido_url_valid(url.rstrip("/")), "STRIX_CAIDO_URL must be http(s)://host[:port]"

Try / catch

try:
    await caido_call(...)
except ValueError as exc:
    if "Invalid Caido URL" in str(exc):
        raise SystemExit("fix STRIX_CAIDO_URL to http://host:port") from exc
    raise

Prevention

Always include the scheme when configuring STRIX_CAIDO_URL.
Never set it to an empty string — unset it to fall back to the default.
Add a startup smoke check that pings the Caido GraphQL endpoint before a long scan.

When it happens

Trigger: Setting STRIX_CAIDO_URL to a value without a scheme ('localhost:8080') or without a host ('http://'), or to a non-HTTP scheme ('ftp://caido'). Any Caido tool call then raises before any network traffic is attempted.

Common situations: Users omit the http:// prefix because browsers add it implicitly; trailing config drift after Caido moves ports; copying a ws:// or grpc:// URL by mistake; empty string after .rstrip('/') in caido_url().

Related errors

AI-assisted analysis of usestrix/strix@8551339130 (2026-08-15). Data as JSON: /api/errors/120a5c4a137df065. Report an issue: GitHub.