[BUG] "Hosted mode requires HTTPS" error when using local MCP server with custom provider

[reBirthLab]

Issue

When using a any model provider, any prompt in the playground chat throws "An error occurred: Hosted mode requires HTTPS server URLs"

How to reproduce

1. Run MCPJam Inspector locally using npx -y @mcpjam/inspector@latest (currently v2.6.1)
2. Configure a provider in Settings > Organisation Models
3. Configure connection to a local MCP server on e.g. http://localhost:8080/mcp
4. Connect to the local MCP server
5. Go to Playground
6. Select a model from Your providers section
7. Send any prompt
8. See "An error occurred: Hosted mode requires HTTPS server URLs"

Expected Behaviour

MCP server replies

Platform

• npx

Additional Context

Everything works fine with free models though.
I fell back to version 2.5.0 because of the issue where the exact same custom provider configuration still works correctly.

[dosubot]

Hi @reBirthLab! I'm Dosu and I’m helping the inspector team.

This looks like a legitimate bug related to how organization-configured model providers route chat requests.

Root cause: When you configure a provider in Settings > Organisation Models and select one of those models in the Playground, the client sets a flag (shouldUseOrgAwareChatApi = true) that routes the chat request through the /api/web/chat-v2 endpoint [1]. This endpoint uses isSupportedHostedHttpUrl to validate MCP server URLs, which unconditionally requires HTTPS — even when running locally [2]. Your http://localhost:8080/mcp server URL fails this check and gets skipped/rejected.

Why free models work: Free (MCPJam-provided) models also route through /api/web/chat-v2, but they use a different server authorization path. Organization BYOK models trigger validation that rejects non-HTTPS MCP server URLs with the message you're seeing.

Workaround: Instead of configuring your provider under "Organisation Models," try adding it as a user-level custom provider where you manually enter your API key. User-provided models route through /api/mcp/chat-v2 which does not enforce HTTPS, so your local HTTP MCP server should work [3].

The fix needed: The isSupportedHostedHttpUrl function has no localhost/local-mode bypass — it always demands HTTPS regardless of whether the Inspector is running locally or in hosted mode [2]. This seems unintentional for local npx usage where HOSTED_MODE is false but org-managed models still trigger the web chat path.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[ignaciojimenezr]

Hey @reBirthLab, could you share which provider and model were you using?

[reBirthLab]

Hey @ignaciojimenezr, I tried adding my personal ChatGPT API key and using different models as well as setting up a custom provider (AWS Bedrock API, Anthropic Sonnet 4.6). In both cases, it doesn't work on 2.6.*, but the same setup works perfectly fine on 2.5.0 and earlier versions.

[ignaciojimenezr]

Hey @reBirthLab, just fixed, changes should be live tomorrow. Thanks for catching this bug!!