googleapis/mcp-toolbox · error

`scopesRequired` is not allowed when `mcpEnabled` is false

Error message

`scopesRequired` is not allowed when `mcpEnabled` is false

What it means

With McpEnabled false, Google auth does not perform MCP scope checks, so a configured scopesRequired list is rejected by Config.Initialize with this error. It prevents users from assuming scopes are enforced when the code path never checks them.

Solutions

1. Remove the scopesRequired field from the google auth config
2. Or set mcpEnabled: true so scopes become meaningful and validated

Example fix

// before
authServices:
  google:
    kind: google
    mcpEnabled: false
    scopesRequired: ["https://www.googleapis.com/auth/cloud-platform"]
// after
authServices:
  google:
    kind: google
    mcpEnabled: true
    scopesRequired: ["https://www.googleapis.com/auth/cloud-platform"]

if !cfg.McpEnabled && len(cfg.ScopesRequired) > 0 {
    return errors.New("google auth: scopesRequired requires mcpEnabled: true")
}

svc, err := cfg.Initialize()
if err != nil {
    if strings.Contains(err.Error(), "scopesRequired` is not allowed") {
        cfg.McpEnabled = true // or drop scopesRequired, then retry
        svc, err = cfg.Initialize()
    }
}

When it happens

Trigger: YAML config with kind: google, mcpEnabled: false while supplying one or more scopesRequired entries; programmatically setting Config{McpEnabled: false, ScopesRequired: [...]}.

Common situations: Migrating from another auth kind (e.g. generic) that supports scopesRequired and keeping the field; adding scopes 'for later' without enabling mcpEnabled.

Related errors

• `audience` is not allowed when `mcpEnabled` is false
• `audience` or `clientId` is required when `mcpEnabled` is…
• failed to create Google tokeninfo request
• failed to decode Google tokeninfo response
• failed to read Google tokeninfo response

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/58bde6e289aded43. Report an issue: GitHub.

Appendix: source

Thrown at internal/auth/google/google.go:66

	return AuthServiceType
}

func (cfg Config) IsMCPEnabled() bool {
	return cfg.McpEnabled
}

// Initialize a Google auth service
func (cfg Config) Initialize() (auth.AuthService, error) {
	if cfg.McpEnabled {
		if cfg.Audience == "" && cfg.ClientID == "" {
			return nil, fmt.Errorf("`audience` or `clientId` is required when `mcpEnabled` is true")
		}
	} else {
		if cfg.Audience != "" {
			return nil, fmt.Errorf("`audience` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := &http.Client{
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          10,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   5 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}
	a := &AuthService{
		Config: cfg,
		client: httpClient,

View on GitHub (pinned to 8cc6e09de2)