{"record":{"id":"4bc6c949c45be9f3","repo":"googleapis/mcp-toolbox","slug":"unable-to-create-storage-newclient-for-project-q","errorCode":null,"errorMessage":"unable to create storage.NewClient for project %q: %w","messagePattern":"unable to create storage\\.NewClient for project %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/sources/cloudstorage/cloudstorage.go","lineNumber":633,"sourceCode":"\treturn map[string]any{\n\t\t\"bucket\":  bucket,\n\t\t\"deleted\": true,\n\t}, nil\n}\n\nfunc initGCSClient(ctx context.Context, tracer trace.Tracer, name, project string) (*storage.Client, error) {\n\t//nolint:all // Reassigned ctx\n\tctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)\n\tdefer span.End()\n\n\tuserAgent, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tclient, err := storage.NewClient(ctx, option.WithUserAgent(userAgent))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create storage.NewClient for project %q: %w\", project, err)\n\t}\n\treturn client, nil\n}\n","sourceCodeStart":615,"sourceCodeEnd":637,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudstorage/cloudstorage.go#L615-L637","documentation":"initGCSClient wraps failures from storage.NewClient (Google Cloud Storage SDK) when establishing a client for the configured project. This happens before any API call, typically due to bad credentials, missing ADC, invalid project, or transport/option errors.","triggerScenarios":"Source Initialize → initGCSClient runs storage.NewClient(ctx, option.WithUserAgent(userAgent)) and it errors: no Application Default Credentials found, malformed GOOGLE_APPLICATION_CREDENTIALS key file, unsupported/invalid credential file, failure constructing an HTTP client (e.g. custom options), or network issues resolving metadata endpoints.","commonSituations":"Deployed without a service account (no metadata server), GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted/invalid JSON key, GCE metadata server unreachable, duplicate option conflicts, or missing cloud-platform scope in restricted environments.","solutions":["Set up Application Default Credentials: gcloud auth application-default login locally, or attach a service account in GCP runtimes","Verify GOOGLE_APPLICATION_CREDENTIALS points to a valid, readable service-account JSON key","Test credentials independently: gcloud auth application-default print-access-token or a minimal storage.NewClient snippet","Ensure the environment can reach the OAuth2/metadata endpoints (check proxy/firewall settings)","Confirm the client option list is valid (user agent string, no conflicting options)"],"exampleFix":"// before (deployment)\n// no credentials configured\n// after\ngcloud auth application-default login\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json","handlingStrategy":"validation","validationCode":"func credsAvailable() error {\n    if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" {\n        if _, err := credentials.DetectDefault(&credentials.Options{}); err != nil {\n            return fmt.Errorf(\"no ADC: %w\", err)\n        }\n    } else if _, err := os.Stat(os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")); err != nil {\n        return fmt.Errorf(\"key file missing: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil {\n    if strings.Contains(err.Error(), \"unable to create storage.NewClient\") {\n        // credentials/environment problem: check ADC and key file\n        return fmt.Errorf(\"check GOOGLE_APPLICATION_CREDENTIALS/ADC: %w\", err)\n    }\n    return err\n}","preventionTips":["Run gcloud auth application-default login in local/dev environments","Attach a service account with storage access in GCP deployments","Validate GOOGLE_APPLICATION_CREDENTIALS path and file readability at startup","Ensure egress to oauth2.googleapis.com and the metadata server"],"tags":["gcs","authentication","client-init","wrap-error"],"backgroundTag":"missing-application-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}