{"record":{"id":"6413f27300251b3e","repo":"googleapis/mcp-toolbox","slug":"parameter-q-cannot-have-both-secure-set-to-true-6413f2","errorCode":null,"errorMessage":"parameter %q cannot have both 'secure' set to true and 'default' specified","messagePattern":"parameter %q cannot have both 'secure' set to true and 'default' specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/parameters/parameters.go","lineNumber":337,"sourceCode":"\t}\n\n\t// create Toolbox manifest\n\tparamManifest := allParameters.Manifest()\n\tif paramManifest == nil {\n\t\tparamManifest = make([]ParameterManifest, 0)\n\t}\n\n\treturn allParameters, paramManifest, nil\n}\n\n// validateParameter validates that parameter configuration adheres to system constraints.\nfunc validateParameter(p Parameter) error {\n\tif p.GetSecure() {\n\t\tif len(p.GetAuthServices()) > 0 {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'authServices' specified\", p.GetName())\n\t\t}\n\t\tif p.GetDefault() != nil {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'default' specified\", p.GetName())\n\t\t}\n\t\tif !p.GetRequired() {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'required' set to false\", p.GetName())\n\t\t}\n\t}\n\treturn nil\n}\n\ntype Parameter interface {\n\t// Note: It's typically not idiomatic to include \"Get\" in the function name,\n\t// but this is done to differentiate it from the fields in CommonParameter.\n\tGetName() string\n\tGetDesc() string\n\tGetType() string\n\tGetDefault() any\n\tGetRequired() bool\n\tGetAuthServices() []ParamAuthService\n\tGetEmbeddedBy() string","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/parameters/parameters.go#L319-L355","documentation":"validateParameter enforces a mutual-exclusion constraint: a parameter flagged 'secure' (its value is hidden/redacted) must not also declare a 'default' value, since persisting a default would defeat the secrecy guarantee. The error fires during config parsing when a parameter entry in tools.yaml combines secure: true with a default key.","triggerScenarios":"Thrown at internal/util/parameters/parameters.go:337 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the 'default' key from the secure parameter so callers must supply it at invocation time","Remove 'secure: true' if a default value is genuinely needed and the value is not sensitive"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}