googleapis/mcp-toolbox · error

`introspectionEndpoint` is not allowed when `mcpEnabled` is

Error message

`introspectionEndpoint` is not allowed when `mcpEnabled` is false

What it means

The generic auth service Config supports OIDC token introspection fields only in MCP mode. When McpEnabled is false, Initialize rejects any non-empty IntrospectionEndpoint because token introspection is meaningless/unavailable in legacy mode, preventing a silently ignored setting.

Source

Thrown at internal/auth/generic/generic.go:66

	IntrospectionEndpoint  string   `yaml:"introspectionEndpoint"`
	IntrospectionMethod    string   `yaml:"introspectionMethod"`
	IntrospectionParamName string   `yaml:"introspectionParamName"`
}

// Returns the auth service type
func (cfg Config) AuthServiceConfigType() string {
	return AuthServiceType
}

func (cfg Config) IsMCPEnabled() bool {
	return cfg.McpEnabled
}

// Initialize a generic auth service
func (cfg Config) Initialize() (auth.AuthService, error) {
	if !cfg.McpEnabled {
		if cfg.IntrospectionEndpoint != "" {
			return nil, fmt.Errorf("`introspectionEndpoint` is not allowed when `mcpEnabled` is false")
		}
		if cfg.IntrospectionMethod != "" {
			return nil, fmt.Errorf("`introspectionMethod` is not allowed when `mcpEnabled` is false")
		}
		if cfg.IntrospectionParamName != "" {
			return nil, fmt.Errorf("`introspectionParamName` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := newSecureHTTPClient()

	// Discover OIDC endpoints
	jwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)
	if err != nil {
		return nil, fmt.Errorf("failed to discover OIDC config: %w", err)
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set mcpEnabled: true in the generic auth service config if you need introspection
2. Remove the introspectionEndpoint field when running without MCP
3. Verify the mcpEnabled key is correctly spelled and actually applied

Example fix

// before
authServices:
  my-auth:
    kind: generic
    mcpEnabled: false
    introspectionEndpoint: https://idp/introspect
// after
authServices:
  my-auth:
    kind: generic
    mcpEnabled: true
    introspectionEndpoint: https://idp/introspect

# pre-validate generic auth config YAML
if ! yq '.authServices[] | select(.kind=="generic") | .mcpEnabled' auth.yaml | grep -q true; then
  if yq '.authServices[] | select(.kind=="generic") | .introspectionEndpoint' auth.yaml | grep -qve 'null\|^$'; then
    echo "introspectionEndpoint requires mcpEnabled: true"; exit 1
  fi
fi

When it happens

Trigger: Configuring authServices with kind: generic, mcpEnabled: false (or unset), and introspectionEndpoint set in the YAML.

Common situations: Copying an MCP-mode auth config into a legacy deployment; leaving introspectionEndpoint in config after switching mcpEnabled off; typos in the mcpEnabled key so it defaults to false.

Related errors

• `introspectionMethod` is not allowed when `mcpEnabled` is fa
• `introspectionParamName` is not allowed when `mcpEnabled` is
• `scopesRequired` is not allowed when `mcpEnabled` is false
• failed to check auth requirements: %w
• MCP Auth cannot be enabled together with the legacy HTTP API

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/b7a9984e84cc3fac. Report an issue: GitHub.