googleapis/mcp-toolbox · error

%s is not a valid type of auth service

Error message

%s is not a valid type of auth service

What it means

During YAML config parsing, an authServices entry had a `type` value that is not one of the supported auth service kinds (`google` or `generic`). UnmarshalYAMLAuthServiceConfig switches on the `type` string and the default branch rejects anything unrecognized. This is a config-level validation error thrown before any server startup work.

Source

Thrown at internal/server/config.go:433

			return nil, fmt.Errorf("unable to parse as %s: %w", name, err)
		}
		if !actual.McpEnabled {
			if actual.IntrospectionEndpoint != "" {
				return nil, fmt.Errorf("`introspectionEndpoint` is not allowed when `mcpEnabled` is false")
			}
			if actual.IntrospectionMethod != "" {
				return nil, fmt.Errorf("`introspectionMethod` is not allowed when `mcpEnabled` is false")
			}
			if actual.IntrospectionParamName != "" {
				return nil, fmt.Errorf("`introspectionParamName` is not allowed when `mcpEnabled` is false")
			}
			if len(actual.ScopesRequired) > 0 {
				return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
			}
		}
		return actual, nil
	default:
		return nil, fmt.Errorf("%s is not a valid type of auth service", resourceType)
	}
}

func UnmarshalYAMLEmbeddingModelConfig(ctx context.Context, name string, r map[string]any) (embeddingmodels.EmbeddingModelConfig, error) {
	resourceType, ok := r["type"].(string)
	if !ok {
		return nil, fmt.Errorf("missing 'type' field or it is not a string")
	}
	if resourceType != gemini.EmbeddingModelType {
		return nil, fmt.Errorf("%s is not a valid type of embedding model", resourceType)
	}
	dec, err := util.NewStrictDecoder(r)
	if err != nil {
		return nil, fmt.Errorf("error creating decoder: %s", err)
	}
	actual := gemini.Config{Name: name}
	if err := dec.DecodeContext(ctx, &actual); err != nil {
		return nil, fmt.Errorf("unable to parse as %q: %w", name, err)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Change the auth service `type` to a supported value: `google` or `generic`
2. Check the config docs for the exact supported auth service type strings and their required fields
3. If the intent was no auth service, remove the authServices entry entirely

Example fix

// before
authServices:
  my-google:
    type: google-oauth
    clientId: ... 
// after
authServices:
  my-google:
    type: google
    clientId: ...

const validAuthTypes = []string{"google", "generic"}
func validateAuthService(cfg map[string]any) error {
  t, ok := cfg["type"].(string)
  if !ok { return fmt.Errorf("auth service missing string 'type'") }
  for _, v := range validAuthTypes { if t == v { return nil } }
  return fmt.Errorf("unsupported auth service type %q", t)
}

func isAuthServiceType(v any) bool {
  s, ok := v.(string)
  return ok && (s == "google" || s == "generic")
}

When it happens

Trigger: Calling UnmarshalPrimitiveConfig (via server startup from a tools.yaml) with an authServices entry whose `type` field is a string other than "google" or "generic" (e.g. "google_oauth", "oidc", a typo like "Googel", or a copy-paste from another product).

Common situations: Typo in the type name; copying an auth config from another MCP framework that supports more auth types; older configs using a type name that was renamed or removed; hand-writing YAML instead of using documented examples.

Related errors

• doc %d: unexpected non-string key in input: %v
• doc %d: invalid config format at key %q: %w
• doc %d: invalid config format at key %q: expected nested for
• %s missing 'kind' field or it is not a string
• missing 'kind' field or it is not a string: %v

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/4874299e3e35293b. Report an issue: GitHub.