googleapis/mcp-toolbox · error

no field named %s in claims

Error message

no field named %s in claims

What it means

When a tool parameter is sourced from auth service claims (myAuthFieldName/field), parseFromAuthService looks up the configured field in the verified JWT claims map. If the claims token does not contain that field, it returns this error; if no auth service matches at all, a 401 client error is returned instead.

Source

Thrown at internal/util/parameters/parameters.go:118

			key = "$" + key
		}
		params[key] = param.Value
	}
	return params
}

func parseFromAuthService(paramAuthServices []ParamAuthService, claimsMap map[string]map[string]any) (any, error) {
	// parse a parameter from claims using its specified auth services
	for _, a := range paramAuthServices {
		claims, ok := claimsMap[a.Name]
		if !ok {
			// not validated for this authservice, skip to the next one
			continue
		}
		v, ok := claims[a.Field]
		if !ok {
			// claims do not contain specified field
			return nil, fmt.Errorf("no field named %s in claims", a.Field)
		}
		return v, nil
	}
	return nil, util.NewClientServerError("missing or invalid authentication header", http.StatusUnauthorized, nil)
}

// CheckParamRequired checks if a parameter is required based on the required and default field.
func CheckParamRequired(required bool, defaultV any) bool {
	return required && defaultV == nil
}

// ParseParams is a helper function for parsing Parameters from an arbitraryJSON object.
func ParseParams(ps Parameters, data map[string]any, claimsMap map[string]map[string]any) (ParamValues, error) {
	params := make([]ParamValue, 0, len(ps))
	for _, p := range ps {
		var v, newV any
		var err error
		paramAuthServices := p.GetAuthServices()

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Update the tool's auth parameter `field` to a claim that exists in the token (e.g. `sub`)
2. Fix the IdP/client so the token includes the required claim
3. Add/enable the missing claim scope in the auth service configuration
4. Check the decoded JWT payload to confirm the exact field name and casing

Example fix

// before
authServices:
  - name: my-auth
    jwt:
      claim: "user_email" # token has no such field
// after
authServices:
  - name: my-auth
    jwt:
      claim: "sub"

func claimExists(claims map[string]any, field string) bool {
    _, ok := claims[field]
    return ok
}
// verify the configured field is present in a sample decoded token

func claimString(claims map[string]any, field string) (string, bool) {
    v, ok := claims[field].(string)
    return v, ok
}

params, err := ParseParams(...)
if err != nil {
    if strings.Contains(err.Error(), "no field named") {
        return nil, fmt.Errorf("token missing required claim: %w", err)
    }
    return nil, err
}

When it happens

Trigger: A request presents a valid authenticated token, but the JWT lacks the claim field configured for a parameter (e.g. parameter uses field "email" but the token's payload has no `email` claim).

Common situations: IdP misconfiguration where optional claims (email, sub) aren't issued; switching auth providers whose token payloads differ; tool config referencing a custom claim the client's token never includes.

Related errors

• invalid JWT claims format
• failed to parse and verify JWT token: %w
• invalid JWT token
• could not parse audience from token: %w
• audience validation failed: expected %s, got %v

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/57d09b9247eb036b. Report an issue: GitHub.