{"record":{"id":"0f35db70aabe76b9","repo":"Tencent/WeKnora","slug":"builtin-mcp-services-cannot-have-credentials-modif","errorCode":null,"errorMessage":"builtin MCP services cannot have credentials modified","messagePattern":"builtin MCP services cannot have credentials modified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/mcp_service.go","lineNumber":549,"sourceCode":"\t\tsecutils.SanitizeForLog(existing.Name), id,\n\t)\n\treturn existing, nil\n}\n\n// ClearMCPCredential removes a single credential field. Idempotent: clearing\n// an already-empty field returns nil without writing or reconnecting.\nfunc (s *mcpServiceService) ClearMCPCredential(\n\tctx context.Context, tenantID uint64, id, field string,\n) error {\n\texisting, err := s.mcpServiceRepo.GetByID(ctx, tenantID, id)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get MCP service: %w\", err)\n\t}\n\tif existing == nil {\n\t\treturn fmt.Errorf(\"MCP service not found\")\n\t}\n\tif existing.IsBuiltin {\n\t\treturn fmt.Errorf(\"builtin MCP services cannot have credentials modified\")\n\t}\n\tif existing.AuthConfig == nil {\n\t\treturn nil // nothing to clear\n\t}\n\n\tchanged := false\n\tswitch field {\n\tcase \"api_key\":\n\t\tif existing.AuthConfig.APIKey != \"\" {\n\t\t\texisting.AuthConfig.APIKey = \"\"\n\t\t\tchanged = true\n\t\t}\n\tcase \"token\":\n\t\tif existing.AuthConfig.Token != \"\" {\n\t\t\texisting.AuthConfig.Token = \"\"\n\t\t\tchanged = true\n\t\t}\n\tdefault:","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/mcp_service.go#L531-L567","documentation":"Policy guard in ClearMCPCredential: the target MCP service is flagged builtin, and built-in services' credentials are managed by the platform and must not be modified or cleared through the tenant API. The input at fault is the service ID resolving to a builtin service.","triggerScenarios":"Thrown at internal/application/service/mcp_service.go:549 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Target a user-created (non-builtin) MCP service instead","Manage builtin service credentials via platform configuration","Guard in the UI by hiding credential actions for builtin services"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}