Preserve TLS certificate causes in MCP connection diagnostics #292

Problem

The MCP connection probe in #291 classifies every httpx2.ConnectError as connection_unreachable. TLS certificate failures also arrive as ConnectError, so an HTTPS certificate problem loses its original diagnostic and instead tells the user to check the service, URL and port. Both Plugins and Settings → Providers → MCP share this handler.

This is a low-priority diagnostic regression, accepted as a non-blocking follow-up to #291. The reviewed GUI Runtime connector uses loopback HTTP and is unaffected.

Upstream check

Checked canonical repository Code-Amadeus/Amadeus, PR #291 head cd4ab09ced88d6813613c966ba6b1406c0fb6f28 on 2026-11-05 NZDT. The reviewed change was subsequently merged as c09d000eff01e428032b5c6d7ca9f3b40ebea319; the pre-merge main baseline was ffb1037b6a4cc8bcbf768d51111b108361952cb0. No production files were changed for this reproduction.

• Probe classification returns the generic unreachable message for all ConnectError leaves.
• Installed httpcore2 2.12.0, _backends/anyio.py:65–67, maps ssl.SSLError during start_tls to ConnectError; the exception cause is retained through the transport layers.
• A search for existing MCP TLS/certificate issues found no existing targeted report.

Environment and evidence (sanitized)

Windows, CPython 3.12.10, MCP 2.2.0, httpx2 2.12.0, httpcore2 2.12.0.

The following bounded reproduction builds a synthetic exception chain and calls the unchanged PR handler. It performs no network request:

import ssl
import httpx2
from agent_host.mcp_connections import McpConnectionSpec
from server.handlers.mcp_connection_handler import _probe_error, _safe_error

connection = McpConnectionSpec("tls-fixture", "TLS fixture", "http",
    url="https://example.invalid/mcp")
try:
    try:
        raise ssl.SSLCertVerificationError(1,
            "[SSL: CERTIFICATE_VERIFY_FAILED] synthetic certificate hostname mismatch")
    except ssl.SSLError as cause:
        raise httpx2.ConnectError(str(cause),
            request=httpx2.Request("POST", connection.url)) from cause
except httpx2.ConnectError as error:
    print(_probe_error(error, connection))
    print(_safe_error(error, connection))

Observed: the new classifier returns connection_unreachable; the existing safe-error path retains CERTIFICATE_VERIFY_FAILED and the synthetic hostname-mismatch reason. Actual self-signed, expired and mismatched HTTPS endpoints were not exercised in this follow-up; their impact is inferred from the installed TLS exception mapping.

Suggested acceptance: an ssl.SSLError in the cause chain falls back to the existing redacted diagnostic, while an ordinary non-TLS connection failure still receives the actionable unreachable message. Add regression coverage for both paths and credential redaction; preserve current TLS validation.

简体中文

#291 把所有 ConnectError 归为“服务不可达”，但 TLS 证书错误也会被依赖库包装成这个异常，导致插件页和手动 MCP 测试丢失原本可见的证书原因。GUI Runtime 使用 loopback HTTP，不受影响；按外审意见作为低优先级后续项，不阻塞 #291。

已在未修改的 cd4ab09c 上用合成异常链复现，未联网、未测试真实 HTTPS 端点。建议检查原因链里的 ssl.SSLError，走现有脱敏错误回退，并覆盖 TLS 和普通连接失败两条路径。感谢外审指出该问题。