googleapis/mcp-toolbox · error
nested items should not have auth services
Error message
nested items should not have auth services
What it means
When ArrayParameter unmarshals its nested 'items' schema, it rejects any items definition that declares authServices. Authentication can only be attached at the parameter level; attaching it to nested items is not supported, so the configuration is rejected at load time.
Source
Thrown at internal/util/parameters/parameters.go:1118
}
func (p *ArrayParameter) UnmarshalYAML(ctx context.Context, unmarshal func(interface{}) error) error {
var rawItem struct {
CommonParameter `yaml:",inline"`
Default *[]any `yaml:"default"`
Items util.DelayedUnmarshaler `yaml:"items"`
}
if err := unmarshal(&rawItem); err != nil {
return err
}
p.CommonParameter = rawItem.CommonParameter
p.Default = rawItem.Default
i, err := parseParamFromDelayedUnmarshaler(ctx, &rawItem.Items)
if err != nil {
return fmt.Errorf("unable to parse 'items' field: %w", err)
}
if i.GetAuthServices() != nil && len(i.GetAuthServices()) != 0 {
return fmt.Errorf("nested items should not have auth services")
}
p.Items = i
return nil
}
func (p *ArrayParameter) IsAllowedValues(v []any) bool {
a := p.GetAllowedValues()
if len(a) == 0 {
return true
}
for _, av := range a {
if reflect.DeepEqual(v, av) {
return true
}
}
return false
}View on GitHub (pinned to 8cc6e09de2)
Solutions
- Remove the authServices field from the items block in tools.yaml.
- Move authServices to the parent array parameter itself if auth is required.
- Redeploy the toolbox after fixing the YAML.
Example fix
# before items: type: string authServices: [google] # after items: type: string
Defensive patterns
Strategy: validation
Validate before calling
# grep check before commit grep -n 'authServices' tools.yaml # must not appear under any items: block
Prevention
- Remember auth applies at parameter level only.
- Add a CI check that rejects authServices within items.
- Document nested array schemas for your team.
When it happens
Trigger: Parsing a tools.yaml in which an array parameter's items block (or a doubly-nested array's items) contains a non-empty authServices list.
Common situations: Copying a top-level parameter with authServices into the items block; misunderstanding docs and thinking per-element auth is supported.
Related errors
- unable to parse 'items' field: %w
- invalid source for %q tool: source %q is not a compatible ty
- unsupported valueType %q for map parameter
- multiple authServices with mcpEnabled=true detected: %s. Onl
- failed to check auth requirements: %w
AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05).
Data as JSON: /api/errors/6a9ff5a3b3d35250.
Report an issue: GitHub.