tls.insecureSkipVerify is set on source %q but tls.enabled i

Error message

tls.insecureSkipVerify is set on source %q but tls.enabled is false; enable TLS or remove the setting

What it means

Config validation in the falkordb source rejects a TLS block where insecureSkipVerify is true while tls.enabled is false. Without TLS there is no certificate to verify, so insecureSkipVerify would be silently ignored — a likely misconfiguration the source refuses instead of accepting.

Source

Thrown at internal/sources/falkordb/falkordb.go:75

	QueryTimeoutMs int       `yaml:"queryTimeoutMs"`
	TLS            TLSConfig `yaml:"tls"`
}

type TLSConfig struct {
	Enabled            bool `yaml:"enabled"`
	InsecureSkipVerify bool `yaml:"insecureSkipVerify"`
}

func (r Config) SourceConfigType() string {
	return SourceType
}

// validateTLS rejects a TLS configuration whose settings contradict each
// other. Without TLS there is no certificate to verify, so insecureSkipVerify
// would otherwise be accepted and silently ignored.
func (r Config) validateTLS() error {
	if !r.TLS.Enabled && r.TLS.InsecureSkipVerify {
		return fmt.Errorf("tls.insecureSkipVerify is set on source %q but tls.enabled is false; enable TLS or remove the setting", r.Name)
	}
	return nil
}

func (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {
	if err := r.validateTLS(); err != nil {
		return nil, err
	}

	logger, err := util.LoggerFromContext(ctx)
	if err != nil {
		return nil, fmt.Errorf("unable to get logger from ctx: %s", err)
	}
	if r.TLS.InsecureSkipVerify {
		logger.WarnContext(ctx, fmt.Sprintf("TLS certificate verification is skipped (insecureSkipVerify: true) for FalkorDB source %s. This exposes traffic for this source to man-in-the-middle attacks. Do not use in production.", r.Name))
	}

	client, err := initFalkorDBClient(ctx, tracer, r)

View on GitHub (pinned to 8cc6e09de2)

Solutions

Set `tls.enabled: true` in the source's tls block if TLS is desired
Or remove the `insecureSkipVerify: true` line if the connection is intentionally plaintext

Example fix

// before (tools.yaml)
  my-falkor:
    kind: falkordb
    tls:
      insecureSkipVerify: true
// after
  my-falkor:
    kind: falkordb
    tls:
      enabled: true
      insecureSkipVerify: true

Defensive patterns

Strategy: validation

Validate before calling

// Go: mirror of the source's own check
func tlsConfigValid(c falkordb.Config) bool {
    return c.TLS.Enabled || !c.TLS.InsecureSkipVerify
}

Prevention

Never set insecureSkipVerify without tls.enabled: true
Lint tools.yaml for contradictory TLS flags before deploy
If the connection is plaintext, delete the whole tls block

When it happens

Trigger: A falkordb source in tools.yaml sets `tls.insecureSkipVerify: true` but omits `tls.enabled` or sets it to false.

Common situations: Copy-pasting an insecure-TLS snippet meant for another source; intending to enable TLS but forgetting the `enabled: true` flag; templated configs where tls.enabled resolves to false.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/bc6f68f0ab0dab8b. Report an issue: GitHub.