zeroclaw-labs/zeroclaw · error · anyhow::Error

MCP server `{server_name}`: tls_ca_cert_path requires an HTT

Error message

MCP server `{server_name}`: tls_ca_cert_path requires an HTTPS {target}; refusing plaintext transport

What it means

Error "MCP server `{server_name}`: tls_ca_cert_path requires an HTTPS {target}; refusing plaintext transport" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:91

    }
}

fn apply_request_timeout(
    req: reqwest::RequestBuilder,
    timeout_secs: Option<u64>,
) -> reqwest::RequestBuilder {
    if let Some(timeout_secs) = timeout_secs {
        req.timeout(Duration::from_secs(timeout_secs))
    } else {
        req
    }
}

fn require_https_url(server_name: &str, url: &str, target: &str) -> Result<()> {
    let parsed = reqwest::Url::parse(url)
        .with_context(|| format!("MCP server `{server_name}`: invalid {target} URL"))?;
    if parsed.scheme() != "https" {
        bail!(
            "MCP server `{server_name}`: tls_ca_cert_path requires an HTTPS {target}; \
             refusing plaintext transport"
        );
    }
    Ok(())
}

/// Open a candidate CA file without letting a special file block the caller.
///
/// The open itself carries `O_NONBLOCK` on unix so that a FIFO (or a symlink to
/// one) substituted at `path` returns a handle immediately instead of parking
/// the thread until a writer appears. Classification happens on the returned
/// handle, never on a second pathname lookup, so the file object we validate is
/// the same one we read.
///
/// Symlinks are followed deliberately: certificate rotation and mounted-secret
/// deployments publish CA bundles through symlink indirection. Following them is
/// safe here precisely because the resulting handle is classified after the

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Use an https URL for the MCP server when tls_ca_cert_path is set.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:91 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/a8211f5381d860c5. Report an issue: GitHub.