{"record":{"id":"6c12be78a5cd400d","repo":"googleapis/mcp-toolbox","slug":"client-authorization-is-not-supported","errorCode":null,"errorMessage":"client authorization is not supported","messagePattern":"client authorization is not supported","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/internal/invoke/command.go","lineNumber":146,"sourceCode":"\t\treturn errMsg\n\t}\n\n\tparsedParams, err = tool.EmbedParams(ctx, parsedParams, primitiveMgr)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"error embedding parameters: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\t// Client Auth not supported for ephemeral CLI call\n\trequiresAuth, err := tool.RequiresClientAuthorization(src)\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"failed to check auth requirements: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\tif requiresAuth {\n\t\terrMsg := fmt.Errorf(\"client authorization is not supported\")\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\tresult, err := tool.Invoke(ctx, src, parsedParams, \"\")\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"tool execution failed: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}\n\n\t// Print Result\n\toutput, err := json.MarshalIndent(result, \"\", \"  \")\n\tif err != nil {\n\t\terrMsg := fmt.Errorf(\"failed to marshal result: %w\", err)\n\t\topts.Logger.ErrorContext(ctx, errMsg.Error())\n\t\treturn errMsg\n\t}","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/cmd/internal/invoke/command.go#L128-L164","documentation":"The `toolbox invoke` CLI runs tools ephemerally without an HTTP request context, so per-request client authorization (authRequired/auth services) cannot be fulfilled. When the resolved tool reports RequiresClientAuthorization(src) == true, runInvoke aborts before invoking the tool with this error (cmd/internal/invoke/command.go:139-149).","triggerScenarios":"Running `toolbox invoke <tool-name> ...` where the tool's config declares authRequired[] (client auth services) so RequiresClientAuthorization returns true; also when the tool's RequiresClientAuthorization implementation itself is customized to demand client auth.","commonSituations":"Users copy a tool config intended for the HTTP/MCP server (which requires Google-signed ID tokens etc.) and try to invoke it directly from the CLI; tools configured with authRequired: [my-google-auth-service] in tools.yaml.","solutions":["Remove the authRequired field (or its entries) from the tool's YAML config if client auth is not actually needed.","Invoke the tool through the running toolbox server instead (POST /mcp or the API endpoint with proper Authorization headers), which supports client authorization.","Create a separate unauthenticated copy of the tool in the config for CLI use.","Check tool.RequiresClientAuthorization for the tool kind to confirm whether it hardcodes client auth."],"exampleFix":"// before (tools.yaml)\ntools:\n  search-items:\n    kind: postgres-sql\n    source: my-pg-instance\n    authRequired:\n      - my-google-auth-service\n    statement: \"SELECT * FROM items;\"\n// after\ntools:\n  search-items:\n    kind: postgres-sql\n    source: my-pg-instance\n    statement: \"SELECT * FROM items;\"","handlingStrategy":"validation","validationCode":"// Before invoking via CLI, check the tool config for client auth requirements:\nfunc toolRequiresClientAuth(cfg map[string]any) bool {\n    auth, ok := cfg[\"authRequired\"].([]any)\n    return ok && len(auth) > 0\n}","typeGuard":"func hasAuthRequired(cfg map[string]any) bool {\n    v, ok := cfg[\"authRequired\"]\n    if !ok || v == nil { return false }\n    list, ok := v.([]any)\n    return ok && len(list) > 0\n}","tryCatchPattern":null,"preventionTips":["Keep authRequired only on tools meant to be served over HTTP/MCP with client auth.","Maintain a separate unauthenticated tool entry for CLI/debug invocation.","Inspect `toolbox tools list` output/auth metadata before invoking from the CLI.","Remember: the invoke subcommand passes an empty auth token and cannot perform client auth."],"tags":["cli","authentication","configuration"],"backgroundTag":"client-authorization-unsupported","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}