{"record":{"id":"6a9ff5a3b3d35250","repo":"googleapis/mcp-toolbox","slug":"nested-items-should-not-have-auth-services","errorCode":null,"errorMessage":"nested items should not have auth services","messagePattern":"nested items should not have auth services","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/parameters/parameters.go","lineNumber":1118,"sourceCode":"}\n\nfunc (p *ArrayParameter) UnmarshalYAML(ctx context.Context, unmarshal func(interface{}) error) error {\n\tvar rawItem struct {\n\t\tCommonParameter `yaml:\",inline\"`\n\t\tDefault         *[]any                  `yaml:\"default\"`\n\t\tItems           util.DelayedUnmarshaler `yaml:\"items\"`\n\t}\n\tif err := unmarshal(&rawItem); err != nil {\n\t\treturn err\n\t}\n\tp.CommonParameter = rawItem.CommonParameter\n\tp.Default = rawItem.Default\n\ti, err := parseParamFromDelayedUnmarshaler(ctx, &rawItem.Items)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to parse 'items' field: %w\", err)\n\t}\n\tif i.GetAuthServices() != nil && len(i.GetAuthServices()) != 0 {\n\t\treturn fmt.Errorf(\"nested items should not have auth services\")\n\t}\n\tp.Items = i\n\n\treturn nil\n}\n\nfunc (p *ArrayParameter) IsAllowedValues(v []any) bool {\n\ta := p.GetAllowedValues()\n\tif len(a) == 0 {\n\t\treturn true\n\t}\n\tfor _, av := range a {\n\t\tif reflect.DeepEqual(v, av) {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","sourceCodeStart":1100,"sourceCodeEnd":1136,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/parameters/parameters.go#L1100-L1136","documentation":"When ArrayParameter unmarshals its nested 'items' schema, it rejects any items definition that declares authServices. Authentication can only be attached at the parameter level; attaching it to nested items is not supported, so the configuration is rejected at load time.","triggerScenarios":"Parsing a tools.yaml in which an array parameter's items block (or a doubly-nested array's items) contains a non-empty authServices list.","commonSituations":"Copying a top-level parameter with authServices into the items block; misunderstanding docs and thinking per-element auth is supported.","solutions":["Remove the authServices field from the items block in tools.yaml.","Move authServices to the parent array parameter itself if auth is required.","Redeploy the toolbox after fixing the YAML."],"exampleFix":"# before\nitems:\n  type: string\n  authServices: [google]\n# after\nitems:\n  type: string","handlingStrategy":"validation","validationCode":"# grep check before commit\ngrep -n 'authServices' tools.yaml  # must not appear under any items: block","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember auth applies at parameter level only.","Add a CI check that rejects authServices within items.","Document nested array schemas for your team."],"tags":["yaml-config","auth","array-parameter","mcp-toolbox"],"backgroundTag":"invalid-tool-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}