zeroclaw-labs/zeroclaw · error

Refusing to transmit sensitive data over non-HTTPS URL: URL

Error message

Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https

What it means

ensure_https (composio.rs:17-24) refuses to send a request whose URL does not start with 'https://' because the x-api-key header carrying the Composio API key is about to be transmitted. It guards the execute and schema-lookup endpoints (called at composio.rs:386 and 487) whose URLs are built from the constant COMPOSIO_API_BASE_V3 = "https://backend.composio.dev/api/v3" (composio.rs:14). In a stock build the check can never fail; it fires only when that base has been changed to a non-https value (fork, patch, or a config-driven override).

Source

Thrown at crates/zeroclaw-tools/src/composio.rs:19

use anyhow::Context;
use async_trait::async_trait;
use parking_lot::RwLock;
use reqwest::Client;
use serde::{Deserialize, Serialize};
use serde_json::json;
use std::collections::HashMap;
use std::fmt::Write;
use std::sync::Arc;
use zeroclaw_api::tool::{Tool, ToolOutput, ToolResult};
use zeroclaw_config::policy::SecurityPolicy;
use zeroclaw_config::policy::ToolOperation;

const COMPOSIO_API_BASE_V3: &str = "https://backend.composio.dev/api/v3";
const COMPOSIO_TOOL_VERSION_LATEST: &str = "latest";

fn ensure_https(url: &str) -> anyhow::Result<()> {
    if !url.starts_with("https://") {
        anyhow::bail!(
            "Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https"
        );
    }
    Ok(())
}

/// A tool that proxies actions to the Composio managed tool platform.
pub struct ComposioTool {
    api_key: String,
    default_entity_id: String,
    security: Arc<SecurityPolicy>,
    recent_connected_accounts: RwLock<HashMap<String, String>>,
    action_slug_cache: RwLock<HashMap<String, String>>,
}

impl ComposioTool {
    pub fn new(
        api_key: &str,

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Restore the https base: const COMPOSIO_API_BASE_V3: &str = "https://backend.composio.dev/api/v3".
2. For local testing, put TLS in front of the proxy (e.g. an https-terminating reverse proxy with a trusted cert) and point the base at the https URL.
3. Audit any patch/config layer that rewrites the Composio base URL and remove http overrides.

Example fix

// before (patched build)
const COMPOSIO_API_BASE_V3: &str = "http://localhost:8080/api/v3";

// after
const COMPOSIO_API_BASE_V3: &str = "https://backend.composio.dev/api/v3";
// local proxies: terminate TLS locally and use an https:// base

fn ensure_https_base(base: &str) -> anyhow::Result<()> {
    anyhow::ensure!(
        base.starts_with("https://"),
        "Composio base URL must use https: {base}"
    );
    Ok(())
}

// at startup, after resolving whatever base your build uses:
// ensure_https_base(&resolved_composio_base)?;

When it happens

Trigger: Any code path hitting execute_action_v3 (tool action='execute') or get_tool_schema after COMPOSIO_API_BASE_V3 was repointed at an http:// URL, e.g. 'http://localhost:8080/api/v3' for a local mock or an http reverse proxy. Also triggered by test builds that inject an http base.

Common situations: Developers standing up a local Composio proxy for offline testing and switching the base to plain http; CI builds with an env-override patch; forks adding self-hosted gateway support without TLS.

Related errors

• security.otp.cache_valid_secs must be greater than or equal
• security.otp.gated_actions[{i}] contains invalid characters:
• AgentScopedMemory refuses purge_namespace: cross-agent bulk
• xAI OAuth discovery returned non-HTTPS {label}
• Request timestamp too old or too far in future

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/ef37c6dc394a6895. Report an issue: GitHub.