buildDispatcherOptions

buildDispatcherOptions(tls, readCert, baseRoots?): BuiltDispatcher | null

Defined in: _worktrees/docs-release/gaunt-sloth/packages/agent/src/mcp/tlsTrust.ts:62

Compute the undici dispatcher options from a tls config. Pure aside from the injected readCert (so unit tests stub file reads): resolves nothing about the environment itself.

Returns null only when NOTHING is configured — no tls block, or an empty tls with no cert entries and verification left at its secure default. When certs ARE configured it always returns the object (even if every read failed), so the caller can surface those failures rather than silently swallowing a bad cert path. Whether to actually install is the caller’s call: loadedCount > 0 || !rejectUnauthorized.

readCert receives each configured path verbatim and must return the PEM contents or throw.

Parameters

tls

{ extraCaCerts?: string[]; rejectUnauthorized?: boolean; } | undefined

Type Literal

{ extraCaCerts?: string[]; rejectUnauthorized?: boolean; }

extraCaCerts?

string[]

Extra CA certificate file(s) to trust IN ADDITION to Node’s built-in roots. Paths resolve relative to the project dir (or ~/absolute). Additive — never removes a default root.

rejectUnauthorized?

boolean

DANGER — false disables TLS certificate verification for ALL outbound HTTPS this process makes, not just MCP. Escape hatch only; a loud security warning is emitted every session.

---

undefined

readCert

(path) => string

baseRoots?

readonly string[] = rootCertificates

Returns

BuiltDispatcher | null