{"record":{"id":"adbd8b35048b5855","repo":"googleapis/mcp-toolbox","slug":"introspectionmethod-is-not-allowed-when-mcpenab","errorCode":null,"errorMessage":"`introspectionMethod` is not allowed when `mcpEnabled` is false","messagePattern":"`introspectionMethod` is not allowed when `mcpEnabled` is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":69,"sourceCode":"}\n\n// Returns the auth service type\nfunc (cfg Config) AuthServiceConfigType() string {\n\treturn AuthServiceType\n}\n\nfunc (cfg Config) IsMCPEnabled() bool {\n\treturn cfg.McpEnabled\n}\n\n// Initialize a generic auth service\nfunc (cfg Config) Initialize() (auth.AuthService, error) {\n\tif !cfg.McpEnabled {\n\t\tif cfg.IntrospectionEndpoint != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionEndpoint` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionMethod != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionMethod` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionParamName != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionParamName` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := newSecureHTTPClient()\n\n\t// Discover OIDC endpoints\n\tjwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to discover OIDC config: %w\", err)\n\t}\n\n\t// Override introspection URL if configured\n\tif cfg.IntrospectionEndpoint != \"\" {","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L51-L87","documentation":"Like the endpoint field, introspectionMethod (HTTP verb used for token introspection, e.g. POST/GET) is only valid when the generic auth service runs in MCP mode. Initialize rejects it when McpEnabled is false so legacy-mode configs cannot carry dead introspection settings.","triggerScenarios":"kind: generic auth service with mcpEnabled: false and a non-empty introspectionMethod in the config.","commonSituations":"Legacy config left with introspection fields after downgrading from MCP mode; sample configs copied verbatim including mcp-related fields while keeping mcpEnabled disabled.","solutions":["Enable mcpEnabled: true if introspection is intended","Delete the introspectionMethod field for legacy-mode deployments","Review the authServices block for other leftover introspection fields"],"exampleFix":"// before\nkind: generic\nmcpEnabled: false\nintrospectionMethod: POST\n// after\nkind: generic\nmcpEnabled: false  # introspectionMethod removed","handlingStrategy":"validation","validationCode":"# reject introspection fields without mcpEnabled\nmcp=$(yq '.authServices.my-auth.mcpEnabled' auth.yaml)\nmethod=$(yq '.authServices.my-auth.introspectionMethod' auth.yaml)\nif [ \"$mcp\" != \"true\" ] && [ \"$method\" != \"null\" ]; then\n  echo \"introspectionMethod requires mcpEnabled: true\"; exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip introspection* fields when mcpEnabled is false","Validate configs in CI with a small script or JSON schema","Review diffs toggling mcpEnabled for orphaned fields"],"tags":["configuration","auth","oidc","validation"],"backgroundTag":"invalid-auth-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}