{"record":{"id":"b7a9984e84cc3fac","repo":"googleapis/mcp-toolbox","slug":"introspectionendpoint-is-not-allowed-when-mcpen","errorCode":null,"errorMessage":"`introspectionEndpoint` is not allowed when `mcpEnabled` is false","messagePattern":"`introspectionEndpoint` is not allowed when `mcpEnabled` is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":66,"sourceCode":"\tIntrospectionEndpoint  string   `yaml:\"introspectionEndpoint\"`\n\tIntrospectionMethod    string   `yaml:\"introspectionMethod\"`\n\tIntrospectionParamName string   `yaml:\"introspectionParamName\"`\n}\n\n// Returns the auth service type\nfunc (cfg Config) AuthServiceConfigType() string {\n\treturn AuthServiceType\n}\n\nfunc (cfg Config) IsMCPEnabled() bool {\n\treturn cfg.McpEnabled\n}\n\n// Initialize a generic auth service\nfunc (cfg Config) Initialize() (auth.AuthService, error) {\n\tif !cfg.McpEnabled {\n\t\tif cfg.IntrospectionEndpoint != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionEndpoint` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionMethod != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionMethod` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionParamName != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionParamName` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := newSecureHTTPClient()\n\n\t// Discover OIDC endpoints\n\tjwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to discover OIDC config: %w\", err)\n\t}","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L48-L84","documentation":"The generic auth service Config supports OIDC token introspection fields only in MCP mode. When McpEnabled is false, Initialize rejects any non-empty IntrospectionEndpoint because token introspection is meaningless/unavailable in legacy mode, preventing a silently ignored setting.","triggerScenarios":"Configuring authServices with kind: generic, mcpEnabled: false (or unset), and introspectionEndpoint set in the YAML.","commonSituations":"Copying an MCP-mode auth config into a legacy deployment; leaving introspectionEndpoint in config after switching mcpEnabled off; typos in the mcpEnabled key so it defaults to false.","solutions":["Set mcpEnabled: true in the generic auth service config if you need introspection","Remove the introspectionEndpoint field when running without MCP","Verify the mcpEnabled key is correctly spelled and actually applied"],"exampleFix":"// before\nauthServices:\n  my-auth:\n    kind: generic\n    mcpEnabled: false\n    introspectionEndpoint: https://idp/introspect\n// after\nauthServices:\n  my-auth:\n    kind: generic\n    mcpEnabled: true\n    introspectionEndpoint: https://idp/introspect","handlingStrategy":"validation","validationCode":"# pre-validate generic auth config YAML\nif ! yq '.authServices[] | select(.kind==\"generic\") | .mcpEnabled' auth.yaml | grep -q true; then\n  if yq '.authServices[] | select(.kind==\"generic\") | .introspectionEndpoint' auth.yaml | grep -qve 'null\\|^$'; then\n    echo \"introspectionEndpoint requires mcpEnabled: true\"; exit 1\n  fi\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep MCP-only fields grouped and commented in config templates","Lint auth configs against a schema before deploy","Only copy introspection fields from MCP-mode examples"],"tags":["configuration","auth","oidc","validation"],"backgroundTag":"invalid-auth-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}