googleapis/mcp-toolbox · error

parameter %q cannot have both 'secure' set to true and 'defa

Error message

parameter %q cannot have both 'secure' set to true and 'default' specified

What it means

validateParameter enforces a mutual-exclusion constraint: a parameter flagged 'secure' (its value is hidden/redacted) must not also declare a 'default' value, since persisting a default would defeat the secrecy guarantee. The error fires during config parsing when a parameter entry in tools.yaml combines secure: true with a default key.

Source

Thrown at internal/util/parameters/parameters.go:337

	}

	// create Toolbox manifest
	paramManifest := allParameters.Manifest()
	if paramManifest == nil {
		paramManifest = make([]ParameterManifest, 0)
	}

	return allParameters, paramManifest, nil
}

// validateParameter validates that parameter configuration adheres to system constraints.
func validateParameter(p Parameter) error {
	if p.GetSecure() {
		if len(p.GetAuthServices()) > 0 {
			return fmt.Errorf("parameter %q cannot have both 'secure' set to true and 'authServices' specified", p.GetName())
		}
		if p.GetDefault() != nil {
			return fmt.Errorf("parameter %q cannot have both 'secure' set to true and 'default' specified", p.GetName())
		}
		if !p.GetRequired() {
			return fmt.Errorf("parameter %q cannot have both 'secure' set to true and 'required' set to false", p.GetName())
		}
	}
	return nil
}

type Parameter interface {
	// Note: It's typically not idiomatic to include "Get" in the function name,
	// but this is done to differentiate it from the fields in CommonParameter.
	GetName() string
	GetDesc() string
	GetType() string
	GetDefault() any
	GetRequired() bool
	GetAuthServices() []ParamAuthService
	GetEmbeddedBy() string

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Remove the 'default' key from the secure parameter so callers must supply it at invocation time
2. Remove 'secure: true' if a default value is genuinely needed and the value is not sensitive

When it happens

Trigger: Thrown at internal/util/parameters/parameters.go:337 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/6413f27300251b3e. Report an issue: GitHub.