{"record":{"id":"c7efb2c94c08b93e","repo":"googleapis/mcp-toolbox","slug":"parameter-q-cannot-have-both-secure-set-to-true-c7efb2","errorCode":null,"errorMessage":"parameter %q cannot have both 'secure' set to true and 'required' set to false","messagePattern":"parameter %q cannot have both 'secure' set to true and 'required' set to false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/parameters/parameters.go","lineNumber":340,"sourceCode":"\tparamManifest := allParameters.Manifest()\n\tif paramManifest == nil {\n\t\tparamManifest = make([]ParameterManifest, 0)\n\t}\n\n\treturn allParameters, paramManifest, nil\n}\n\n// validateParameter validates that parameter configuration adheres to system constraints.\nfunc validateParameter(p Parameter) error {\n\tif p.GetSecure() {\n\t\tif len(p.GetAuthServices()) > 0 {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'authServices' specified\", p.GetName())\n\t\t}\n\t\tif p.GetDefault() != nil {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'default' specified\", p.GetName())\n\t\t}\n\t\tif !p.GetRequired() {\n\t\t\treturn fmt.Errorf(\"parameter %q cannot have both 'secure' set to true and 'required' set to false\", p.GetName())\n\t\t}\n\t}\n\treturn nil\n}\n\ntype Parameter interface {\n\t// Note: It's typically not idiomatic to include \"Get\" in the function name,\n\t// but this is done to differentiate it from the fields in CommonParameter.\n\tGetName() string\n\tGetDesc() string\n\tGetType() string\n\tGetDefault() any\n\tGetRequired() bool\n\tGetAuthServices() []ParamAuthService\n\tGetEmbeddedBy() string\n\tGetValueFromParam() string\n\tParse(any) (any, error)\n\tManifest() ParameterManifest","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/parameters/parameters.go#L322-L358","documentation":"validateParameter enforces a constraint on secure parameters: a 'secure' parameter (value hidden/redacted) must always be required, because an omitted secure value has no safe fallback. The error fires during config parsing when a parameter entry in tools.yaml sets secure: true together with required: false.","triggerScenarios":"Thrown at internal/util/parameters/parameters.go:340 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set 'required: true' on the secure parameter","Remove 'secure: true' if the parameter is genuinely optional and not sensitive"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}