Tencent/WeKnora · error

MCP service %s is not enabled

Error message

MCP service %s is not enabled

What it means

GetOrCreateClient rejects connections to MCP services whose Enabled flag is false, returning "MCP service %s is not enabled". This is a configuration gate: disabled services are intentionally blocked from creating clients. It fires before any transport or OAuth logic runs.

Source

Thrown at internal/mcp/manager.go:61

// keyed per principal (each identity connects with its own token); all other
// services share a single connection per service ID.
func cacheKey(service *types.MCPService, principal types.Principal) string {
	if service.AuthConfig.IsOAuth() {
		return service.ID + "\x00" + principal.Normalize().StorageID()
	}
	return service.ID
}

// GetOrCreateClient gets an existing client or creates a new one
// Caches and reuses existing connections for SSE/HTTP Streamable
// Note: Stdio transport is disabled for security reasons
//
// For OAuth-enabled services the connection is keyed per principal (derived from
// ctx) so each identity connects with its own token.
func (m *MCPManager) GetOrCreateClient(ctx context.Context, service *types.MCPService) (MCPClient, error) {
	// Check if service is enabled
	if !service.Enabled {
		return nil, fmt.Errorf("MCP service %s is not enabled", service.Name)
	}

	// Stdio transport is disabled for security reasons
	if service.TransportType == types.MCPTransportStdio {
		return nil, fmt.Errorf("stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead")
	}

	var tenantID uint64
	var principal types.Principal
	if service.AuthConfig.IsOAuth() {
		tenantID, _ = types.TenantIDFromContext(ctx)
		principal, _ = types.PrincipalFromContext(ctx)
		principal = types.MCPOAuthPrincipalFromContext(ctx)
		if !principal.Valid() {
			return nil, fmt.Errorf("principal context is required to connect to OAuth MCP service %s", service.Name)
		}
	}
	key := cacheKey(service, principal)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Enable the service: set service.Enabled=true in the admin UI or database and reload the service config
2. Skip disabled services in caller code before requesting tools/resources
3. Re-fetch the MCPService record to ensure you're not using a stale disabled copy

Example fix

// before
client, err := manager.GetOrCreateClient(ctx, svc)
// after
if !svc.Enabled {
    return nil, fmt.Errorf("service %q is disabled; enable it before use", svc.Name)
}
client, err := manager.GetOrCreateClient(ctx, svc)

if svc == nil { return errors.New("nil MCP service") }
if !svc.Enabled { return fmt.Errorf("service %q is disabled", svc.Name) }

func serviceUsable(svc *types.MCPService) bool { return svc != nil && svc.Enabled }

client, err := manager.GetOrCreateClient(ctx, svc)
if err != nil && strings.Contains(err.Error(), "is not enabled") {
    return fmt.Errorf("enable MCP service %q in settings first", svc.Name)
}

When it happens

Trigger: Passing a *types.MCPService with Enabled=false to GetOrCreateClient, directly or indirectly via GetMCPToolsInfo, GetMCPServiceTools, GetMCPServiceResources, or getOrCreateMCPClientWithOAuthRetry.

Common situations: An admin toggled the service off in the UI/DB while workers still reference it; a service was seeded into config disabled by default; stale cached service record after enablement change wasn't reloaded.

Related errors

• MCP client config and service are required
• URL is required for SSE transport
• URL is required for HTTP Streamable transport
• stdio transport is disabled for security reasons; please use
• OAuth repository is required for OAuth MCP services

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/c9bcbaa013c3fdea. Report an issue: GitHub.