googleapis/mcp-toolbox · error

`introspectionMethod` is not allowed when `mcpEnabled` is fa

Error message

`introspectionMethod` is not allowed when `mcpEnabled` is false

What it means

Like the endpoint field, introspectionMethod (HTTP verb used for token introspection, e.g. POST/GET) is only valid when the generic auth service runs in MCP mode. Initialize rejects it when McpEnabled is false so legacy-mode configs cannot carry dead introspection settings.

Source

Thrown at internal/auth/generic/generic.go:69

}

// Returns the auth service type
func (cfg Config) AuthServiceConfigType() string {
	return AuthServiceType
}

func (cfg Config) IsMCPEnabled() bool {
	return cfg.McpEnabled
}

// Initialize a generic auth service
func (cfg Config) Initialize() (auth.AuthService, error) {
	if !cfg.McpEnabled {
		if cfg.IntrospectionEndpoint != "" {
			return nil, fmt.Errorf("`introspectionEndpoint` is not allowed when `mcpEnabled` is false")
		}
		if cfg.IntrospectionMethod != "" {
			return nil, fmt.Errorf("`introspectionMethod` is not allowed when `mcpEnabled` is false")
		}
		if cfg.IntrospectionParamName != "" {
			return nil, fmt.Errorf("`introspectionParamName` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := newSecureHTTPClient()

	// Discover OIDC endpoints
	jwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)
	if err != nil {
		return nil, fmt.Errorf("failed to discover OIDC config: %w", err)
	}

	// Override introspection URL if configured
	if cfg.IntrospectionEndpoint != "" {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Enable mcpEnabled: true if introspection is intended
2. Delete the introspectionMethod field for legacy-mode deployments
3. Review the authServices block for other leftover introspection fields

Example fix

// before
kind: generic
mcpEnabled: false
introspectionMethod: POST
// after
kind: generic
mcpEnabled: false  # introspectionMethod removed

# reject introspection fields without mcpEnabled
mcp=$(yq '.authServices.my-auth.mcpEnabled' auth.yaml)
method=$(yq '.authServices.my-auth.introspectionMethod' auth.yaml)
if [ "$mcp" != "true" ] && [ "$method" != "null" ]; then
  echo "introspectionMethod requires mcpEnabled: true"; exit 1
fi

When it happens

Trigger: kind: generic auth service with mcpEnabled: false and a non-empty introspectionMethod in the config.

Common situations: Legacy config left with introspection fields after downgrading from MCP mode; sample configs copied verbatim including mcp-related fields while keeping mcpEnabled disabled.

Related errors

• `introspectionEndpoint` is not allowed when `mcpEnabled` is
• `introspectionParamName` is not allowed when `mcpEnabled` is
• `scopesRequired` is not allowed when `mcpEnabled` is false
• failed to check auth requirements: %w
• MCP Auth cannot be enabled together with the legacy HTTP API

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/adbd8b35048b5855. Report an issue: GitHub.