{"record":{"id":"49fb17484a2ea068","repo":"googleapis/mcp-toolbox","slug":"failed-to-check-auth-requirements-w","errorCode":null,"errorMessage":"failed to check auth requirements: %w","messagePattern":"failed to check auth requirements: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/internal/invoke/command.go","lineNumber":141,"sourceCode":"\n\tparsedParams, err := parameters.ParseParams(toolParams, params, nil)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"invalid parameters: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\tparsedParams, err = tool.EmbedParams(ctx, parsedParams, primitiveMgr)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"error embedding parameters: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\t// Client Auth not supported for ephemeral CLI call\n\trequiresAuth, err := tool.RequiresClientAuthorization(src)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"failed to check auth requirements: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\tif requiresAuth {\n\t\terrMsg := fmt.Errorf(\"client authorization is not supported\")\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\tresult, err := tool.Invoke(ctx, src, parsedParams, \"\")\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"tool execution failed: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\t// Print Result\n\toutput, err := json.MarshalIndent(result, \"\", \"  \")","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/cmd/internal/invoke/command.go#L123-L159","documentation":"Thrown by runInvoke (cmd/internal/invoke/command.go:141) when tool.RequiresClientAuthorization(src) returns an error while determining whether the tool requires client-supplied authorization (OAuth/OIDC bearer based on its authRequired services). This is a resolution failure inside the auth service lookup, not a rejection of the call itself. The CLI treats it as fatal because client auth is not supported for ephemeral CLI invocations.","triggerScenarios":"Invoking a tool whose authRequired list references an auth service that failed to initialize or does not exist in authServicesMap, so RequiresClientAuthorization cannot resolve the service's requirements.","commonSituations":"Typo in the auth service name under the tool's `authRequired` field, an authServices entry with invalid OIDC/OAuth config that failed at InitializeConfigs, or copying a tool definition between config files without copying its authServices block.","solutions":["Check startup logs for 'failed to initialize resources' — fix the authServices entry that failed to initialize.","Verify each name in the tool's `authRequired` list matches a defined authServices key in your config.","Validate the auth service configuration (clientID, issuer, etc.) against the docs for that auth kind.","Remove the authRequired entry if the tool does not actually require client authorization for local use."],"exampleFix":"# before (auth service name mismatch)\ntools:\n  my-tool:\n    kind: postgres-sql\n    authRequired: [google_oidc]\nauthServices:\n  google-oauth:\n    kind: google\n# after (names match)\ntools:\n  my-tool:\n    kind: postgres-sql\n    authRequired: [google-oauth]\nauthServices:\n  google-oauth:\n    kind: google","handlingStrategy":"validation","validationCode":"# Verify every authRequired name has a matching authServices entry:\npython3 -c \"\nimport yaml,sys\nc=yaml.safe_load(open('tools.yaml'))\nfor n,t in c.get('tools',{}).items():\n    for a in t.get('authRequired',[]):\n        assert a in c.get('authServices',{}), f'{n}: missing auth service {a}'\nprint('ok')\"","typeGuard":null,"tryCatchPattern":"if err := runInvoke(...); err != nil {\n  if strings.Contains(err.Error(), \"failed to check auth requirements\") ||\n     strings.Contains(err.Error(), \"client authorization is not supported\") {\n    // fall back to the MCP server path, which supports client auth\n  }\n}","preventionTips":["Keep authRequired names consistent with authServices keys (exact strings).","Validate OIDC/OAuth auth service config at startup before invoking tools.","Remember the CLI does not support client authorization — use `toolbox serve` for tools requiring it."],"tags":["cli","auth","configuration"],"backgroundTag":"auth-service-resolution-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}