{"record":{"id":"5330e2d7f3832012","repo":"googleapis/mcp-toolbox","slug":"mcp-auth-cannot-be-enabled-together-with-the-legac","errorCode":null,"errorMessage":"MCP Auth cannot be enabled together with the legacy HTTP API (--enable-api)","messagePattern":"MCP Auth cannot be enabled together with the legacy HTTP API \\(--enable-api\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/root.go","lineNumber":450,"sourceCode":"\t}()\n\n\tisCustomConfigured, err := opts.LoadConfig(ctx, &internal.ConfigParser{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Validate ToolboxUrl if MCP Auth is enabled\n\tvar mcpAuthEnabled bool\n\tfor _, authSvc := range opts.Cfg.AuthServiceConfigs {\n\t\tif authSvc.IsMCPEnabled() {\n\t\t\tmcpAuthEnabled = true\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif mcpAuthEnabled {\n\t\tif opts.Cfg.EnableAPI {\n\t\t\terrMsg := fmt.Errorf(\"MCP Auth cannot be enabled together with the legacy HTTP API (--enable-api)\")\n\t\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\t\treturn errMsg\n\t\t}\n\t\tif opts.Cfg.ToolboxUrl == \"\" {\n\t\t\topts.Cfg.ToolboxUrl = os.Getenv(\"TOOLBOX_URL\")\n\t\t}\n\t\tif opts.Cfg.ToolboxUrl == \"\" {\n\t\t\terrMsg := fmt.Errorf(\"MCP Auth is enabled but Toolbox URL is missing. Please provide it via --toolbox-url flag or TOOLBOX_URL environment variable\")\n\t\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\t\treturn errMsg\n\t\t}\n\t}\n\n\t// start server\n\ts, err := server.NewServer(ctx, opts.Cfg)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"toolbox failed to initialize: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())","sourceCodeStart":432,"sourceCodeEnd":468,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/cmd/root.go#L432-L468","documentation":"MCP auth (tools authentication) and the legacy HTTP API (--enable-api) are mutually exclusive runtime modes in MCP Toolbox. When mcpAuthEnabled is true, the code checks opts.Cfg.EnableAPI and refuses to start, because the legacy API would expose tools without the MCP auth path. The command aborts before the server is created.","triggerScenarios":"Running toolbox with MCP auth flags enabled together with --enable-api (EnableAPI=true in the server config).","commonSituations":"Operators migrating from the legacy HTTP API to MCP-authenticated MCP servers who keep the old --enable-api flag in a script, systemd unit, or Dockerfile CMD alongside new auth flags.","solutions":["Remove the --enable-api flag from the command line or config when MCP auth is enabled","If both endpoints are needed, run two toolbox instances: one with MCP auth, one legacy","Update deployment scripts/compose files to drop legacy API usage"],"exampleFix":"// before\n./toolbox --enable-api --tools-file tools.yaml --auth ...\n// after\n./toolbox --tools-file tools.yaml --auth ...","handlingStrategy":"validation","validationCode":"// shell pre-check before launching toolbox\nif grep -q -- '--enable-api' <<< \"$TOOLBOX_ARGS\" && [[ \"$TOOLBOX_ARGS\" == *--mcp-auth* || -n \"$MCP_AUTH\" ]]; then\n  echo \"--enable-api conflicts with MCP auth; remove --enable-api\" >&2\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove --enable-api from all deployment templates once migrating to MCP auth","Document the mutual exclusion in runbooks","Use separate launch scripts for legacy vs MCP modes"],"tags":["configuration","mcp","auth","cli"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}