Tencent/WeKnora · error

builtin MCP services cannot have credentials modified

Error message

builtin MCP services cannot have credentials modified

What it means

Policy guard in ClearMCPCredential: the target MCP service is flagged builtin, and built-in services' credentials are managed by the platform and must not be modified or cleared through the tenant API. The input at fault is the service ID resolving to a builtin service.

Source

Thrown at internal/application/service/mcp_service.go:549

		secutils.SanitizeForLog(existing.Name), id,
	)
	return existing, nil
}

// ClearMCPCredential removes a single credential field. Idempotent: clearing
// an already-empty field returns nil without writing or reconnecting.
func (s *mcpServiceService) ClearMCPCredential(
	ctx context.Context, tenantID uint64, id, field string,
) error {
	existing, err := s.mcpServiceRepo.GetByID(ctx, tenantID, id)
	if err != nil {
		return fmt.Errorf("failed to get MCP service: %w", err)
	}
	if existing == nil {
		return fmt.Errorf("MCP service not found")
	}
	if existing.IsBuiltin {
		return fmt.Errorf("builtin MCP services cannot have credentials modified")
	}
	if existing.AuthConfig == nil {
		return nil // nothing to clear
	}

	changed := false
	switch field {
	case "api_key":
		if existing.AuthConfig.APIKey != "" {
			existing.AuthConfig.APIKey = ""
			changed = true
		}
	case "token":
		if existing.AuthConfig.Token != "" {
			existing.AuthConfig.Token = ""
			changed = true
		}
	default:

View on GitHub (pinned to 988cbb0330)

Solutions

1. Target a user-created (non-builtin) MCP service instead
2. Manage builtin service credentials via platform configuration
3. Guard in the UI by hiding credential actions for builtin services

When it happens

Trigger: Thrown at internal/application/service/mcp_service.go:549 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/0f35db70aabe76b9. Report an issue: GitHub.