{"record":{"id":"9668c8a7f15fdcf5","repo":"googleapis/mcp-toolbox","slug":"introspectionparamname-is-not-allowed-when-mcpe","errorCode":null,"errorMessage":"`introspectionParamName` is not allowed when `mcpEnabled` is false","messagePattern":"`introspectionParamName` is not allowed when `mcpEnabled` is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":72,"sourceCode":"func (cfg Config) AuthServiceConfigType() string {\n\treturn AuthServiceType\n}\n\nfunc (cfg Config) IsMCPEnabled() bool {\n\treturn cfg.McpEnabled\n}\n\n// Initialize a generic auth service\nfunc (cfg Config) Initialize() (auth.AuthService, error) {\n\tif !cfg.McpEnabled {\n\t\tif cfg.IntrospectionEndpoint != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionEndpoint` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionMethod != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionMethod` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionParamName != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionParamName` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := newSecureHTTPClient()\n\n\t// Discover OIDC endpoints\n\tjwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to discover OIDC config: %w\", err)\n\t}\n\n\t// Override introspection URL if configured\n\tif cfg.IntrospectionEndpoint != \"\" {\n\t\tintrospectionURL = cfg.IntrospectionEndpoint\n\t}\n","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L54-L90","documentation":"introspectionParamName (the form/header parameter name sent to the introspection endpoint) is MCP-mode-only. Initialize validates this before building the HTTP client and discovering OIDC endpoints, rejecting the config when McpEnabled is false.","triggerScenarios":"kind: generic auth service with mcpEnabled: false and introspectionParamName set.","commonSituations":"Same as sibling errors: config drift after toggling mcpEnabled off, or inheriting a shared tools/auth YAML that includes introspection tuning parameters.","solutions":["Set mcpEnabled: true when introspection parameters are required","Remove introspectionParamName from legacy-mode auth configs","Audit generated/templated configs for MCP-only fields"],"exampleFix":"// before\nkind: generic\nmcpEnabled: false\nintrospectionParamName: token\n// after\nkind: generic\nmcpEnabled: true\nintrospectionParamName: token","handlingStrategy":"validation","validationCode":"mcp=$(yq '.authServices.my-auth.mcpEnabled' auth.yaml)\npname=$(yq '.authServices.my-auth.introspectionParamName' auth.yaml)\nif [ \"$mcp\" != \"true\" ] && [ \"$pname\" != \"null\" ]; then\n  echo \"introspectionParamName requires mcpEnabled: true\"; exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep a single source-of-truth auth template per mode (legacy vs MCP)","Automate config linting in CI","Document MCP-only keys in internal runbooks"],"tags":["configuration","auth","oidc","validation"],"backgroundTag":"invalid-auth-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}