ruvnet/ruflo · error · Error

tool authorization is required and cannot be disabled

Error message

tool authorization is required and cannot be disabled

What it means

setToolAuthorizer() was called with no authorizer while the server config still has requireToolAuthorization enabled. Disabling the authorizer under mandatory authorization is refused — flip requireToolAuthorization off first if authorization is truly meant to be dropped.

Source

Thrown at v3/@claude-flow/mcp/src/server.ts:318

      this.emit('server:stopped');

    } catch (error) {
      this.logger.error('Error stopping MCP server', { error });
      throw error;
    }
  }

  registerTool(tool: MCPTool): boolean {
    return this.toolRegistry.register(tool);
  }

  registerTools(tools: MCPTool[]): { registered: number; failed: string[] } {
    return this.toolRegistry.registerBatch(tools);
  }

  setToolAuthorizer(authorizer?: ToolAuthorizer): void {
    if (this.config.requireToolAuthorization && !authorizer) {
      throw new Error('tool authorization is required and cannot be disabled');
    }
    this.toolRegistry.setAuthorizer(authorizer);
  }

  unregisterTool(name: string): boolean {
    return this.toolRegistry.unregister(name);
  }

  async getHealthStatus(): Promise<{
    healthy: boolean;
    error?: string;
    metrics?: Record<string, number>;
  }> {
    try {
      const transportHealth = this.transports.length > 0
        ? await Promise.all(this.transports.map((transport) => transport.getHealthStatus()))
        : [{ healthy: false, error: 'Transport not initialized' }];

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Keep tool authorization enabled; supply a permissive authorizer if all tools should be allowed.
2. Recreate the server without the mandatory-authorization constraint if the deployment genuinely does not need it.

When it happens

Trigger: Configuration or a call attempts to disable tool authorization on a server where it is mandatory.

Common situations: A caller sets requireToolAuthorization=false after the server was created with authorization enforced.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/8ba14c8d0bcfd226. Report an issue: GitHub.