{"record":{"id":"58bde6e289aded43","repo":"googleapis/mcp-toolbox","slug":"scopesrequired-is-not-allowed-when-mcpenabled-58bde6","errorCode":null,"errorMessage":"`scopesRequired` is not allowed when `mcpEnabled` is false","messagePattern":"`scopesRequired` is not allowed when `mcpEnabled` is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/google/google.go","lineNumber":66,"sourceCode":"\treturn AuthServiceType\n}\n\nfunc (cfg Config) IsMCPEnabled() bool {\n\treturn cfg.McpEnabled\n}\n\n// Initialize a Google auth service\nfunc (cfg Config) Initialize() (auth.AuthService, error) {\n\tif cfg.McpEnabled {\n\t\tif cfg.Audience == \"\" && cfg.ClientID == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`audience` or `clientId` is required when `mcpEnabled` is true\")\n\t\t}\n\t} else {\n\t\tif cfg.Audience != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`audience` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := &http.Client{\n\t\tTimeout: 10 * time.Second,\n\t\tTransport: &http.Transport{\n\t\t\tForceAttemptHTTP2:     true,\n\t\t\tMaxIdleConns:          10,\n\t\t\tIdleConnTimeout:       90 * time.Second,\n\t\t\tTLSHandshakeTimeout:   5 * time.Second,\n\t\t\tExpectContinueTimeout: 1 * time.Second,\n\t\t},\n\t\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\t\treturn http.ErrUseLastResponse\n\t\t},\n\t}\n\ta := &AuthService{\n\t\tConfig: cfg,\n\t\tclient: httpClient,","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/google/google.go#L48-L84","documentation":"With McpEnabled false, Google auth does not perform MCP scope checks, so a configured scopesRequired list is rejected by Config.Initialize with this error. It prevents users from assuming scopes are enforced when the code path never checks them.","triggerScenarios":"YAML config with kind: google, mcpEnabled: false while supplying one or more scopesRequired entries; programmatically setting Config{McpEnabled: false, ScopesRequired: [...]}.","commonSituations":"Migrating from another auth kind (e.g. generic) that supports scopesRequired and keeping the field; adding scopes 'for later' without enabling mcpEnabled.","solutions":["Remove the scopesRequired field from the google auth config","Or set mcpEnabled: true so scopes become meaningful and validated"],"exampleFix":"// before\nauthServices:\n  google:\n    kind: google\n    mcpEnabled: false\n    scopesRequired: [\"https://www.googleapis.com/auth/cloud-platform\"]\n// after\nauthServices:\n  google:\n    kind: google\n    mcpEnabled: true\n    scopesRequired: [\"https://www.googleapis.com/auth/cloud-platform\"]","handlingStrategy":"validation","validationCode":"if !cfg.McpEnabled && len(cfg.ScopesRequired) > 0 {\n    return errors.New(\"google auth: scopesRequired requires mcpEnabled: true\")\n}","typeGuard":null,"tryCatchPattern":"svc, err := cfg.Initialize()\nif err != nil {\n    if strings.Contains(err.Error(), \"scopesRequired` is not allowed\") {\n        cfg.McpEnabled = true // or drop scopesRequired, then retry\n        svc, err = cfg.Initialize()\n    }\n}","preventionTips":["Only define scopesRequired when mcpEnabled is true","Reuse validated base configs instead of hand-editing fields per environment","Run config initialization in CI smoke tests to catch invalid combos early"],"tags":["go","auth","google","config-validation","scopes"],"backgroundTag":"invalid-config-combination","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}