{"record":{"id":"640d5a21119edd6a","repo":"googleapis/mcp-toolbox","slug":"call-is-not-allowed-when-dataset-restrictions-are","errorCode":null,"errorMessage":"CALL is not allowed when dataset restrictions are in place, as the called procedure's contents cannot be safely analyzed","messagePattern":"CALL is not allowed when dataset restrictions are in place, as the called procedure's contents cannot be safely analyzed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/tools/bigquery/bigquerycommon/table_name_parser.go","lineNumber":264,"sourceCode":"\t\t\t\tif infoSchemaIdx != -1 {\n\t\t\t\t\tviewName := parts[len(parts)-1]\n\t\t\t\t\tif !datasetLevelInformationSchemaViews[strings.ToLower(viewName)] {\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"querying non-dataset-level INFORMATION_SCHEMA view %q is not allowed when dataset restrictions are in place\", viewName)\n\t\t\t\t\t}\n\t\t\t\t\tif infoSchemaIdx == 0 {\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"querying INFORMATION_SCHEMA views without a dataset prefix is not allowed when dataset restrictions are in place\")\n\t\t\t\t\t}\n\t\t\t\t\tif infoSchemaIdx > 2 {\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"invalid INFORMATION_SCHEMA query path %q\", strings.Join(parts, \".\"))\n\t\t\t\t\t}\n\t\t\t\t\tparts = parts[:infoSchemaIdx+1]\n\t\t\t\t}\n\n\t\t\t\tif len(parts) == 1 {\n\t\t\t\t\tkeyword := strings.ToLower(parts[0])\n\t\t\t\t\tswitch keyword {\n\t\t\t\t\tcase \"call\":\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"CALL is not allowed when dataset restrictions are in place, as the called procedure's contents cannot be safely analyzed\")\n\t\t\t\t\tcase \"immediate\":\n\t\t\t\t\t\tif lastToken == \"execute\" {\n\t\t\t\t\t\t\treturn 0, fmt.Errorf(\"EXECUTE IMMEDIATE is not allowed when dataset restrictions are in place, as its contents cannot be safely analyzed\")\n\t\t\t\t\t\t}\n\t\t\t\t\tcase \"procedure\", \"function\":\n\t\t\t\t\t\tif lastToken == \"create\" || lastToken == \"create or replace\" {\n\t\t\t\t\t\t\treturn 0, fmt.Errorf(\"unanalyzable statements like '%s %s' are not allowed\", strings.ToUpper(lastToken), strings.ToUpper(keyword))\n\t\t\t\t\t\t}\n\t\t\t\t\tcase verbCreate, verbAlter, verbDrop, verbSelect, verbInsert, verbUpdate, verbDelete, verbMerge:\n\t\t\t\t\t\tif statementVerb == \"\" {\n\t\t\t\t\t\t\tstatementVerb = keyword\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\tif statementVerb == verbCreate || statementVerb == verbAlter || statementVerb == verbDrop {\n\t\t\t\t\t\tif keyword == \"schema\" || keyword == \"dataset\" {\n\t\t\t\t\t\t\treturn 0, fmt.Errorf(\"dataset-level operations like '%s %s' are not allowed when dataset restrictions are in place\", strings.ToUpper(statementVerb), strings.ToUpper(keyword))\n\t\t\t\t\t\t}","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/tools/bigquery/bigquerycommon/table_name_parser.go#L246-L282","documentation":"The SQL scanner found a CALL statement while dataset restrictions are active — the contents of the called procedure cannot be statically analyzed, so it might access datasets outside the allowed set.","triggerScenarios":"Thrown at internal/tools/bigquery/bigquerycommon/table_name_parser.go:264 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inline the procedure's logic as a plain query","Only use CALL with tools that have no dataset restrictions","Audit the procedure and relax restrictions if safe"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}