What causes "ipType invalid: must be one of "public", "private", or "psc"" in googleapis/mcp-toolbox?

Set ipType to exactly one of: public, private, or psc (any casing is accepted).

ipType invalid: must be one of "public", "private", or "psc"

Error message

ipType invalid: must be one of "public", "private", or "psc"

What it means

IPType.UnmarshalYAML validates the YAML string against the allowed values "public", "private", or "psc" (case-insensitive). Any other string fails unmarshaling with this error. It guards the Cloud SQL connection ipType config field from invalid values.

Source

Thrown at internal/sources/ip_type.go:42

func (i *IPType) String() string {
	if string(*i) != "" {
		return strings.ToLower(string(*i))
	}
	return "public"
}

func (i *IPType) UnmarshalYAML(ctx context.Context, unmarshal func(interface{}) error) error {
	var ipType string
	if err := unmarshal(&ipType); err != nil {
		return err
	}
	switch strings.ToLower(ipType) {
	case "private", "public", "psc":
		*i = IPType(strings.ToLower(ipType))
		return nil
	default:
		return fmt.Errorf(`ipType invalid: must be one of "public", "private", or "psc"`)
	}
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

Set ipType to exactly one of: public, private, or psc (any casing is accepted).
Remove the ipType field to use the default instead of an invalid value.
Re-run the toolbox after fixing the YAML and watch for a clean startup.

Example fix

# before
sources:
  my-cloud-sql-pg:
    kind: cloud-sql-postgres
    ipType: internal
# after
sources:
  my-cloud-sql-pg:
    kind: cloud-sql-postgres
    ipType: private

Defensive patterns

Strategy: validation

Validate before calling

function validateIpType(v) {
  if (v == null) return true; // optional
  return ['public', 'private', 'psc'].includes(String(v).toLowerCase());
}
// run before applying the YAML config
if (!validateIpType(cfg.sources['my-cloud-sql-pg'].ipType)) throw new Error('ipType must be public, private, or psc');

Try / catch

try {
  toolbox.start(configYaml);
} catch (err) {
  if (String(err).includes('ipType invalid')) {
    console.error('Fix the ipType field in YAML: allowed values are public, private, psc.');
  } else throw err;
}

Prevention

Keep a schema/lint check on toolbox YAML configs in CI.
Only copy ipType values from the current official docs for the Cloud SQL source.
Remember matching is case-insensitive but the vocabulary is fixed to three values.

When it happens

Trigger: A toolbox YAML config where a source's ipType field is set to something other than public/private/psc, e.g. ipType: internal or a typo like ipType: privte.

Common situations: Typo in config; copying a config from an older/other product using different ipType vocabulary; setting PSC type where it isn't supported in that spelling (e.g. "PSC" works, "psc-" doesn't).

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/719836fc22c46297. Report an issue: GitHub.