multiple authServices with mcpEnabled=true detected: %s. Onl

Error message

multiple authServices with mcpEnabled=true detected: %s. Only one MCP authorization server is currently supported

What it means

Only one MCP authorization server may have mcpEnabled=true. mergeConfigs scans all generic authServices after merging and throws this error listing every authService with mcpEnabled=true when more than one is found.

Source

Thrown at cmd/internal/config.go:498

			}
		}
	}

	// If conflicts were detected, return an error
	if len(conflicts) > 0 {
		return Config{}, fmt.Errorf("resource conflicts detected:\n  - %s\n\nPlease ensure each source, authService, tool, prompt and group has a unique name across all files", strings.Join(conflicts, "\n  - "))
	}

	// Ensure only one authService has mcpEnabled = true
	var mcpEnabledAuthServers []string
	for name, authService := range merged.AuthServices {
		// Only generic type has McpEnabled right now
		if genericService, ok := authService.(generic.Config); ok && genericService.McpEnabled {
			mcpEnabledAuthServers = append(mcpEnabledAuthServers, name)
		}
	}
	if len(mcpEnabledAuthServers) > 1 {
		return Config{}, fmt.Errorf("multiple authServices with mcpEnabled=true detected: %s. Only one MCP authorization server is currently supported", strings.Join(mcpEnabledAuthServers, ", "))
	}

	return merged, nil
}

// LoadAndMergeConfigs loads multiple YAML files and merges them
func (p *ConfigParser) LoadAndMergeConfigs(ctx context.Context, filePaths []string) (Config, error) {
	var configs []Config

	for _, filePath := range filePaths {
		buf, err := os.ReadFile(filePath)
		if err != nil {
			return Config{}, fmt.Errorf("unable to read config file at %q: %w", filePath, err)
		}

		config, err := p.ParseConfig(ctx, buf)
		if err != nil {
			return Config{}, fmt.Errorf("unable to parse config file at %q: %w", filePath, err)

View on GitHub (pinned to 8cc6e09de2)

Solutions

Set mcpEnabled: true on only one authService and false (or omit) on all others
Remove the redundant authService with mcpEnabled: true
Merge the auth configuration into a single authService definition

Example fix

// before
authServices:
  a: {kind: generic, mcpEnabled: true}
  b: {kind: generic, mcpEnabled: true}
// after
authServices:
  a: {kind: generic, mcpEnabled: true}
  b: {kind: generic}

Defensive patterns

Strategy: validation

Validate before calling

count := 0
for _, c := range configs {
  for name, s := range c.AuthServices {
    if g, ok := s.(generic.Config); ok && g.McpEnabled {
      count++
      if count > 1 { return fmt.Errorf("multiple mcpEnabled authServices") }
    }
  }
}

Try / catch

cfg, err := parser.LoadAndMergeConfigs(ctx, files)
if err != nil {
  if strings.Contains(err.Error(), "mcpEnabled=true") {
    // disable mcpEnabled on all but one authService
  }
  return err
}

Prevention

Enable mcpEnabled on exactly one authService, ideally in a single dedicated file
Grep configs for 'mcpEnabled: true' before deploying
Document which authService owns MCP authorization

When it happens

Trigger: Two or more files passed to LoadAndMergeConfigs each define a generic authService with mcpEnabled: true.

Common situations: Splitting config across files where each file's author enabled mcpEnabled on their authService; copying an authService block (with mcpEnabled: true) into an additional config file.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/adebfc9a08eec54b. Report an issue: GitHub.