{"record":{"id":"7a9e50bd34fcd7e4","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-authenticated-http-client-w","errorCode":null,"errorMessage":"failed to create authenticated HTTP client: %w","messagePattern":"failed to create authenticated HTTP client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/sources/firestore/firestore.go","lineNumber":875,"sourceCode":"\tcase *firestore.DocumentRef:\n\t\treturn \"reference\"\n\tcase []byte:\n\t\treturn \"bytes\"\n\tdefault:\n\t\treturn fmt.Sprintf(\"%T\", v)\n\t}\n}\n\n// ExecuteMQL sends an MQL query to the Firestore executePipeline API via the iql stage or as a raw structured pipeline.\nfunc (s *Source) ExecuteMQL(ctx context.Context, query string) (any, error) {\n\tuserAgent, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\tuserAgent = \"mcp-toolbox\"\n\t}\n\n\thttpClient, err := google.DefaultClient(ctx, \"https://www.googleapis.com/auth/datastore\", \"https://www.googleapis.com/auth/cloud-platform\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create authenticated HTTP client: %w\", err)\n\t}\n\n\turl := fmt.Sprintf(\"https://firestore.googleapis.com/v1/projects/%s/databases/%s/documents:executePipeline\", s.GetProjectId(), s.GetDatabaseId())\n\n\ttrimmed := strings.TrimSpace(query)\n\tvar bodyBytes []byte\n\n\t// If the query is already formatted as a full structuredPipeline JSON payload\n\tif strings.HasPrefix(trimmed, \"{\") && (strings.Contains(trimmed, \"structuredPipeline\") || strings.Contains(trimmed, \"pipeline\")) {\n\t\tbodyBytes = []byte(trimmed)\n\t} else {\n\t\tmqlQuery := trimmed\n\t\tif !strings.HasPrefix(mqlQuery, \"db.\") && !strings.HasPrefix(mqlQuery, \"db[\") {\n\t\t\tmqlQuery = \"db.\" + mqlQuery\n\t\t}\n\n\t\t// Construct the structuredPipeline payload with \"iql\" stage\n\t\tpayload := map[string]any{","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/firestore/firestore.go#L857-L893","documentation":"ExecuteMQL uses google.DefaultClient (Application Default Credentials) with the datastore and cloud-platform scopes to build an authenticated HTTP client for the Firestore REST executePipeline endpoint. This error wraps the ADC failure — no credentials found, malformed credential files, or unsupported credential types.","triggerScenarios":"google.DefaultClient fails because GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no ADC is available (gcloud auth application-default login never run, no metadata server), or the credentials cannot be refreshed / scopes cannot be granted.","commonSituations":"Running the toolbox locally without gcloud ADC; CI containers without a mounted service-account key; GOOGLE_APPLICATION_CREDENTIALS set to a wrong path or corrupt JSON; workload identity/metadata server unavailable outside GCP; GCE VM missing cloud-platform access scope.","solutions":["Run gcloud auth application-default login, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key path.","Validate the key file: it must be parseable JSON with type, client_email, and private_key fields.","On GCE/GKE, ensure the instance/service account has the cloud-platform and datastore scopes and roles/datastore.user.","Check that the project has the Cloud Firestore API enabled."],"exampleFix":"// before (shell): no credentials\ngo run .\n// after (shell): provide ADC\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json\ngo run .","handlingStrategy":"validation","validationCode":"// Validate credentials before calling ExecuteMQL\ncredsPath := os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")\nif credsPath == \"\" {\n    if _, err := exec.LookPath(\"gcloud\"); err != nil {\n        return errors.New(\"no ADC: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\")\n    }\n} else if _, err := os.Stat(credsPath); err != nil {\n    return fmt.Errorf(\"GOOGLE_APPLICATION_CREDENTIALS points to missing file: %w\", err)\n}","typeGuard":"func hasValidADC(ctx context.Context) error {\n    _, err := google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/datastore\")\n    return err\n}","tryCatchPattern":"result, err := src.ExecuteMQL(ctx, query)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to create authenticated HTTP client\") {\n        // credentials problem: check GOOGLE_APPLICATION_CREDENTIALS / gcloud ADC\n        // on GCE: check VM access scopes include cloud-platform\n    }\n    return err\n}","preventionTips":["Always set GOOGLE_APPLICATION_CREDENTIALS or run gcloud auth application-default login in local/dev environments.","In CI, mount the service-account key as a secret and reference it via the env var.","On GCE/GKE, verify VM access scopes include cloud-platform and the service account has datastore roles.","Probe credentials at startup (google.FindDefaultCredentials) to fail fast with a clear message."],"tags":["firestore","authentication","adc","google-cloud","http-client"],"backgroundTag":"application-default-credentials-not-found","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}