googleapis/mcp-toolbox · error

`scopesRequired` is not allowed when `mcpEnabled` is false

Error message

`scopesRequired` is not allowed when `mcpEnabled` is false

What it means

With McpEnabled false, Google auth does not perform MCP scope checks, so a configured scopesRequired list is rejected by Config.Initialize with this error. It prevents users from assuming scopes are enforced when the code path never checks them.

Source

Thrown at internal/auth/google/google.go:66

	return AuthServiceType
}

func (cfg Config) IsMCPEnabled() bool {
	return cfg.McpEnabled
}

// Initialize a Google auth service
func (cfg Config) Initialize() (auth.AuthService, error) {
	if cfg.McpEnabled {
		if cfg.Audience == "" && cfg.ClientID == "" {
			return nil, fmt.Errorf("`audience` or `clientId` is required when `mcpEnabled` is true")
		}
	} else {
		if cfg.Audience != "" {
			return nil, fmt.Errorf("`audience` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := &http.Client{
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          10,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   5 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}
	a := &AuthService{
		Config: cfg,
		client: httpClient,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Remove the scopesRequired field from the google auth config
2. Or set mcpEnabled: true so scopes become meaningful and validated

Example fix

// before
authServices:
  google:
    kind: google
    mcpEnabled: false
    scopesRequired: ["https://www.googleapis.com/auth/cloud-platform"]
// after
authServices:
  google:
    kind: google
    mcpEnabled: true
    scopesRequired: ["https://www.googleapis.com/auth/cloud-platform"]

if !cfg.McpEnabled && len(cfg.ScopesRequired) > 0 {
    return errors.New("google auth: scopesRequired requires mcpEnabled: true")
}

svc, err := cfg.Initialize()
if err != nil {
    if strings.Contains(err.Error(), "scopesRequired` is not allowed") {
        cfg.McpEnabled = true // or drop scopesRequired, then retry
        svc, err = cfg.Initialize()
    }
}

When it happens

Trigger: YAML config with kind: google, mcpEnabled: false while supplying one or more scopesRequired entries; programmatically setting Config{McpEnabled: false, ScopesRequired: [...]}.

Common situations: Migrating from another auth kind (e.g. generic) that supports scopesRequired and keeping the field; adding scopes 'for later' without enabling mcpEnabled.

Related errors

• `audience` or `clientId` is required when `mcpEnabled` is tr
• `audience` is not allowed when `mcpEnabled` is false
• google ID token verification failure: %w
• failed to create Google tokeninfo request: %w
• failed to read Google tokeninfo response: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/58bde6e289aded43. Report an issue: GitHub.