{"record":{"id":"b2562a10ffa9fbef","repo":"googleapis/mcp-toolbox","slug":"parameter-q-cannot-have-both-secure-set-to-true","errorCode":null,"errorMessage":"parameter %q cannot have both 'secure' set to true and 'authServices' specified","messagePattern":"parameter %q cannot have both 'secure' set to true and 'authServices' specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/parameters/parameters.go","lineNumber":334,"sourceCode":"\t\tif err := validateParameter(p); err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t}\n\n\t// create Toolbox manifest\n\tparamManifest := allParameters.Manifest()\n\tif paramManifest == nil {\n\t\tparamManifest = make([]ParameterManifest, 0)\n\t}\n\n\treturn allParameters, paramManifest, nil\n}\n\n// validateParameter validates that parameter configuration adheres to system constraints.\nfunc validateParameter(p Parameter) error {\n\tif p.GetSecure() {\n\t\tif len(p.GetAuthServices()) > 0 {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'authServices' specified\", p.GetName())\n\t\t}\n\t\tif p.GetDefault() != nil {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'default' specified\", p.GetName())\n\t\t}\n\t\tif !p.GetRequired() {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'required' set to false\", p.GetName())\n\t\t}\n\t}\n\treturn nil\n}\n\ntype Parameter interface {\n\t// Note: It's typically not idiomatic to include \"Get\" in the function name,\n\t// but this is done to differentiate it from the fields in CommonParameter.\n\tGetName() string\n\tGetDesc() string\n\tGetType() string\n\tGetDefault() any","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/parameters/parameters.go#L316-L352","documentation":"validateParameter enforces that a parameter cannot simultaneously be secure (value injected from server-side secure storage) and declare authServices (value sourced from client authentication credentials). Both mechanisms control how the value is obtained, so they are mutually exclusive; the config is rejected at load/parse time before any invocation.","triggerScenarios":"Declaring a tool parameter with secure: true and a non-empty authServices list in the tools YAML — e.g. merging config fragments where one added secure:true and another added authServices. Fired by ProcessParameters or parseParamFromDelayedUnmarshaler during config load.","commonSituations":"Copying an authServices example onto an existing secure parameter; merging tool config files with overlapping definitions; porting a parameter between tools while keeping both fields; misunderstanding which sourcing mechanism to use.","solutions":["Remove one of the two fields: drop secure:true if the value should come from auth services, or remove authServices if it should come from secure storage.","Decide a single sourcing model per parameter and keep only the matching field.","Re-run the toolbox after editing so config validation confirms the parameter loads.","Check merge/config-layering tooling that may be re-adding the removed field."],"exampleFix":"# before\n- name: access_token\n  type: string\n  secure: true\n  authServices:\n    - kind: google\n\n# after (auth-service sourced)\n- name: access_token\n  type: string\n  authServices:\n    - kind: google","handlingStrategy":"validation","validationCode":"if p.GetSecure() && len(p.GetAuthServices()) > 0 {\n    return fmt.Errorf(\"parameter %q: choose either secure or authServices, not both\", p.GetName())\n}","typeGuard":null,"tryCatchPattern":"if err := toolbox.Start(ctx); err != nil {\n    if strings.Contains(err.Error(), \"cannot have both 'secure'\") {\n        // fix the tools YAML: remove one sourcing mechanism, then reload\n    }\n    return err\n}","preventionTips":["Pick one sourcing mechanism per parameter: secure storage OR auth services, never both.","Lint tool configs for conflicting fields before deployment.","Watch out for config merge tools that combine fragments and reintroduce the other field.","Add a config-load smoke test in CI that catches validation errors early."],"tags":["configuration","security","validation"],"backgroundTag":"conflicting-parameter-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}