googleapis/mcp-toolbox · error

missing required secure parameter %q in secureArguments

Error message

missing required secure parameter %q in secureArguments

What it means

The tool defines a required secure parameter that gets its value from the request (valueFromParam is empty) and it is not bound by any URL parameter. When the request has no secureArguments object at all, the required secure value is missing, so a protocol error is raised naming the parameter.

Source

Thrown at internal/server/mcp/v20260728/method.go:910

		}
	}

	// Validate that non-secure parameters are not passed in secureArguments (Protocol error)
	for argName := range req.Params.SecureArguments {
		if !secureParamMap[argName] {
			return nil, nil, fmt.Errorf("parameter %q is not secure and must not be passed in secureArguments", argName)
		}
	}

	// Validate that required secure parameters are present in secureArguments (Protocol error)
	for _, p := range paramDefs {
		if p != nil && p.GetSecure() {
			name := p.GetName()
			if p.GetValueFromParam() == "" {
				if _, bound := urlParams[name]; !bound {
					if parameters.CheckParamRequired(p.GetRequired(), p.GetDefault()) {
						if req.Params.SecureArguments == nil {
							return nil, nil, fmt.Errorf("missing required secure parameter %q in secureArguments", name)
						}
						if _, ok := req.Params.SecureArguments[name]; !ok {
							return nil, nil, fmt.Errorf("missing required secure parameter %q in secureArguments", name)
						}
					}
				}
			}
		}
	}

	// Merge standard arguments and secure arguments.
	toolArgument := make(map[string]any)
	maps.Copy(toolArgument, req.Params.Arguments)
	maps.Copy(toolArgument, req.Params.SecureArguments)

	return toolArgument, nil, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Add params.secureArguments containing the required parameter, e.g. {"api_key": "..."}
2. Have the user provide the value via the secure parameter prompt/flow so the client populates secureArguments
3. Bind the value as a URL parameter if the deployment supports it (urlParams), e.g. pass it in the server's authenticated endpoint query
4. Add a default to the parameter in tools.yaml so it is no longer required, or mark it not required

Example fix

// before
{"method": "tools/call", "params": {"name": "run_query", "arguments": {"sql": "SELECT 1"}}}
// after
{"method": "tools/call", "params": {"name": "run_query", "arguments": {"sql": "SELECT 1"}, "secureArguments": {"api_key": "<key>"}}}

const requiredSecure = toolParams.filter(p => p.secure && p.required && p.default === undefined && !p.valueFromParam && !boundUrlParams.has(p.name));
if (!req.secureArguments && requiredSecure.length) {
  throw new Error(`secureArguments required for: ${requiredSecure.map(p => p.name).join(', ')}`);
}

function hasRequiredSecureArgs(req, requiredSecure) {
  return requiredSecure.every(p => req.secureArguments && p.name in req.secureArguments);
}

try {
  await mcp.toolsCall({ name: tool, arguments: args, secureArguments: secureArgs });
} catch (e) {
  if (/missing required secure parameter/.test(e.message)) {
    const name = e.message.match(/parameter "([^"]+)"/)?.[1];
    const value = await promptUserForSecret(name);
    return mcp.toolsCall({ name: tool, arguments: args, secureArguments: { ...secureArgs, [name]: value } });
  } else { throw e; }
}

When it happens

Trigger: A tools/call to a tool whose params include a required secure parameter (secure: true, required: true or required-by-default with no default), where the request omits params.secureArguments entirely, and the parameter is not supplied via URL params.

Common situations: Older clients without the com.google.cloud/toolbox.v1 extension never populate secureArguments; server config added a new required secure parameter that the client doesn't know about; agent invocation template omits the secure argument.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• parameter %q is secure and must not be passed in standard ar
• parameter %q is not secure and must not be passed in secureA
• MCP Auth cannot be enabled together with the legacy HTTP API
• MCP Auth is enabled but Toolbox URL is missing. Please provi
• failed to parse and verify JWT token: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/d5542b0e46a2b1ea. Report an issue: GitHub.