{"record":{"id":"bc6f68f0ab0dab8b","repo":"googleapis/mcp-toolbox","slug":"tls-insecureskipverify-is-set-on-source-q-but-tls","errorCode":null,"errorMessage":"tls.insecureSkipVerify is set on source %q but tls.enabled is false; enable TLS or remove the setting","messagePattern":"tls\\.insecureSkipVerify is set on source %q but tls\\.enabled is false; enable TLS or remove the setting","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/falkordb/falkordb.go","lineNumber":75,"sourceCode":"\tQueryTimeoutMs int       `yaml:\"queryTimeoutMs\"`\n\tTLS            TLSConfig `yaml:\"tls\"`\n}\n\ntype TLSConfig struct {\n\tEnabled            bool `yaml:\"enabled\"`\n\tInsecureSkipVerify bool `yaml:\"insecureSkipVerify\"`\n}\n\nfunc (r Config) SourceConfigType() string {\n\treturn SourceType\n}\n\n// validateTLS rejects a TLS configuration whose settings contradict each\n// other. Without TLS there is no certificate to verify, so insecureSkipVerify\n// would otherwise be accepted and silently ignored.\nfunc (r Config) validateTLS() error {\n\tif !r.TLS.Enabled && r.TLS.InsecureSkipVerify {\n\t\treturn fmt.Errorf(\"tls.insecureSkipVerify is set on source %q but tls.enabled is false; enable TLS or remove the setting\", r.Name)\n\t}\n\treturn nil\n}\n\nfunc (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {\n\tif err := r.validateTLS(); err != nil {\n\t\treturn nil, err\n\t}\n\n\tlogger, err := util.LoggerFromContext(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to get logger from ctx: %s\", err)\n\t}\n\tif r.TLS.InsecureSkipVerify {\n\t\tlogger.WarnContext(ctx, fmt.Sprintf(\"TLS certificate verification is skipped (insecureSkipVerify: true) for FalkorDB source %s. This exposes traffic for this source to man-in-the-middle attacks. Do not use in production.\", r.Name))\n\t}\n\n\tclient, err := initFalkorDBClient(ctx, tracer, r)","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/falkordb/falkordb.go#L57-L93","documentation":"Config validation in the falkordb source rejects a TLS block where insecureSkipVerify is true while tls.enabled is false. Without TLS there is no certificate to verify, so insecureSkipVerify would be silently ignored — a likely misconfiguration the source refuses instead of accepting.","triggerScenarios":"A falkordb source in tools.yaml sets `tls.insecureSkipVerify: true` but omits `tls.enabled` or sets it to false.","commonSituations":"Copy-pasting an insecure-TLS snippet meant for another source; intending to enable TLS but forgetting the `enabled: true` flag; templated configs where tls.enabled resolves to false.","solutions":["Set `tls.enabled: true` in the source's tls block if TLS is desired","Or remove the `insecureSkipVerify: true` line if the connection is intentionally plaintext"],"exampleFix":"// before (tools.yaml)\n  my-falkor:\n    kind: falkordb\n    tls:\n      insecureSkipVerify: true\n// after\n  my-falkor:\n    kind: falkordb\n    tls:\n      enabled: true\n      insecureSkipVerify: true","handlingStrategy":"validation","validationCode":"// Go: mirror of the source's own check\nfunc tlsConfigValid(c falkordb.Config) bool {\n    return c.TLS.Enabled || !c.TLS.InsecureSkipVerify\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never set insecureSkipVerify without tls.enabled: true","Lint tools.yaml for contradictory TLS flags before deploy","If the connection is plaintext, delete the whole tls block"],"tags":["config","tls","falkordb","validation"],"backgroundTag":"tls-config-validation","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}