{"record":{"id":"62afffeebd4f07c4","repo":"googleapis/mcp-toolbox","slug":"client-side-oauth-is-enabled-but-no-access-token-w-62afff","errorCode":null,"errorMessage":"client-side OAuth is enabled but no access token was provided","messagePattern":"client-side OAuth is enabled but no access token was provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudmonitoring/cloud_monitoring.go","lineNumber":129,"sourceCode":"\treturn s.Config\n}\n\nfunc (s *Source) BaseURL() string {\n\treturn s.baseURL\n}\n\nfunc (s *Source) Client() *http.Client {\n\treturn s.client\n}\n\nfunc (s *Source) UserAgent() string {\n\treturn s.userAgent\n}\n\nfunc (s *Source) GetClient(ctx context.Context, accessToken string) (*http.Client, error) {\n\tif s.UseClientOAuth {\n\t\tif accessToken == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"client-side OAuth is enabled but no access token was provided\")\n\t\t}\n\t\ttoken := &oauth2.Token{AccessToken: accessToken}\n\t\treturn oauth2.NewClient(ctx, oauth2.StaticTokenSource(token)), nil\n\t}\n\treturn s.client, nil\n}\n\nfunc (s *Source) UseClientAuthorization() bool {\n\treturn s.UseClientOAuth\n}\n\nfunc (s *Source) RunQuery(projectID, query string) (any, error) {\n\turl := fmt.Sprintf(\"%s/v1/projects/%s/location/global/prometheus/api/v1/query\", s.BaseURL(), projectID)\n\n\treq, err := http.NewRequest(http.MethodGet, url, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudmonitoring/cloud_monitoring.go#L111-L147","documentation":"GetClient is called per-request when the source uses client-side OAuth (UseClientOAuth=true). In that mode the caller must pass the end user's access token; if the accessToken argument is empty, the source refuses to build a client rather than silently falling back to server credentials.","triggerScenarios":"Invoking a tool on a cloudmonitoring source configured with useClientOAuth: true while the request carries no client access token (or the auth middleware drops it before GetClient is called).","commonSituations":"Clients connecting without attaching the OAuth access token header; misconfigured client auth in the MCP host so the token is never forwarded; testing with empty token strings.","solutions":["Send a valid OAuth access token with the request (via the configured auth token header)","Check the client/host auth configuration so the token is captured and forwarded to GetClient","If client-side OAuth is not intended, set useClientOAuth: false and use server credentials (ADC) instead"],"exampleFix":"// before\nclient, err := src.GetClient(ctx, \"\") // empty token\n// after\nclient, err := src.GetClient(ctx, accessToken) // token from request auth header","handlingStrategy":"validation","validationCode":"if accessToken == \"\" {\n    return fmt.Errorf(\"useClientOAuth requires an access token on every request\")\n}","typeGuard":null,"tryCatchPattern":"client, err := src.GetClient(ctx, accessToken)\nif err != nil {\n    http.Error(w, \"client OAuth token required\", http.StatusUnauthorized)\n    return\n}","preventionTips":["Configure the MCP client/host to send the access token on each request","Use the same auth-token header name configured on the source","Return 401 to clients that omit the token","Only enable useClientOAuth when clients can supply tokens"],"tags":["gcp","cloud-monitoring","oauth","client-auth"],"backgroundTag":"missing-access-token","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}