{"record":{"id":"466d29be58f91c61","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-gda-http-client-w","errorCode":null,"errorMessage":"failed to create GDA HTTP client: %w","messagePattern":"failed to create GDA HTTP client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/util/gda.go","lineNumber":63,"sourceCode":"\t\treturn gdaMTLSEndpoint\n\t}\n\treturn gdaDefaultEndpoint\n}\n\n// NewGDAClient returns an HTTP client configured for Gemini Data Analytics.\n// It handles mTLS and authentication if a token source is provided.\nfunc NewGDAClient(ctx context.Context, opts ...option.ClientOption) (*http.Client, error) {\n\t// Default options for GDA\n\tdefaultOpts := []option.ClientOption{\n\t\toption.WithEndpoint(GetGDAEndpoint()),\n\t\toption.WithScopes(\"https://www.googleapis.com/auth/cloud-platform\"),\n\t}\n\n\tallOpts := append(defaultOpts, opts...)\n\n\tclient, _, err := htransport.NewClient(ctx, allOpts...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create GDA HTTP client: %w\", err)\n\t}\n\treturn client, nil\n}\n\nfunc isClientCertificateEnabled() bool {\n\treturn strings.ToLower(os.Getenv(\"GOOGLE_API_USE_CLIENT_CERTIFICATE\")) == \"true\"\n}\n\nfunc getMTLSMode() string {\n\tmode := os.Getenv(\"GOOGLE_API_USE_MTLS_ENDPOINT\")\n\tif mode == \"\" {\n\t\tmode = os.Getenv(\"GOOGLE_API_USE_MTLS\") // Deprecated\n\t}\n\tif mode == \"\" {\n\t\treturn \"auto\"\n\t}\n\treturn strings.ToLower(mode)\n}","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/gda.go#L45-L81","documentation":"NewGDAClient in internal/util/gda.go builds an HTTP client for the Gemini Data Agent (GDA) via htransport.NewClient, using defaults plus caller-supplied options. If the underlying OAuth2/transport construction fails (bad credentials, missing/unreadable Application Default Credentials, invalid option, or client-certificate setup failure), the error is wrapped with this message.","triggerScenarios":"Calling NewGDAClient (directly, from a tool's Invoke, or in tests via TestNewGDAClient/setupDataAgent) when GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no ADC is available in the environment, the credentials JSON is malformed, or GOOGLE_API_USE_CLIENT_CERTIFICATE misconfiguration breaks mTLS setup.","commonSituations":"Running locally without `gcloud auth application-default login`; deploying to an environment without a service-account attachment; a typo'd GOOGLE_APPLICATION_CREDENTIALS path; quota-project or scope misconfiguration.","solutions":["Set up Application Default Credentials: run `gcloud auth application-default login` locally, or attach a service account in the runtime environment","Verify GOOGLE_APPLICATION_CREDENTIALS points to an existing, valid service-account JSON key file","Unset or fix GOOGLE_API_USE_CLIENT_CERTIFICATE unless client certificates (mTLS) are genuinely required","Inspect the wrapped cause (%w) in the error message to identify whether it is credential loading, token fetch, or transport failure"],"exampleFix":"// before (no credentials configured)\nclient, err := NewGDAClient(ctx)\n// after (configure ADC first: gcloud auth application-default login)\nopts := []option.ClientOption{option.WithScopes(\"https://www.googleapis.com/auth/cloud-platform\")}\nclient, err := NewGDAClient(ctx, opts...)","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") != \"\" {\n    if _, err := os.Stat(os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")); err != nil {\n        return fmt.Errorf(\"GOOGLE_APPLICATION_CREDENTIALS points to an unreadable file: %v\", err)\n    }\n}\ncreds, err := google.FindDefaultCredentials(context.Background())\nif err != nil {\n    return fmt.Errorf(\"no Application Default Credentials available: %w\", err)\n}","typeGuard":"func hasCredentials(ctx context.Context) bool {\n    _, err := google.FindDefaultCredentials(ctx)\n    return err == nil\n}","tryCatchPattern":"client, err := NewGDAClient(ctx, opts...)\nif err != nil {\n    return nil, fmt.Errorf(\"GDA client init failed: %w (check ADC: gcloud auth application-default login, or GOOGLE_APPLICATION_CREDENTIALS)\", err)\n}","preventionTips":["Run `gcloud auth application-default login` in local dev environments before starting the service","Ensure runtime environments (GCE/GKE/Cloud Run) have a service account attached","Validate credential file paths and JSON at startup with a fail-fast check","Avoid setting GOOGLE_API_USE_CLIENT_CERTIFICATE unless mTLS is required"],"tags":["gcp","authentication","http-client","credentials"],"backgroundTag":"missing-application-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}