{"record":{"id":"9238c4d43cb1f038","repo":"googleapis/mcp-toolbox","slug":"failed-to-build-token-scoped-compute-engine-client","errorCode":null,"errorMessage":"failed to build token-scoped Compute Engine client: %w","messagePattern":"failed to build token-scoped Compute Engine client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/cloudsqlconnect/gce.go","lineNumber":92,"sourceCode":"// evaluated as the caller (matching how cloudsqladmin.Source.GetService\n// treats its accessToken). When accessToken is empty the function\n// returns the process-wide client backed by Application Default\n// Credentials, built once on first call.\n//\n// The ADC-backed initializer runs with context.Background() on purpose:\n// a request-scoped ctx cached inside sync.Once would poison every\n// subsequent invocation if the first caller cancelled. Callers still\n// propagate their request ctx to individual API calls via\n// Instances.Get(...).Context(ctx).Do().\nfunc GetComputeService(ctx context.Context, accessToken string) (*compute.Service, error) {\n\tif accessToken != \"\" {\n\t\tts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})\n\t\tsvc, err := compute.NewService(ctx,\n\t\t\toption.WithTokenSource(ts),\n\t\t\toption.WithScopes(compute.ComputeReadonlyScope),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to build token-scoped Compute Engine client: %w\", err)\n\t\t}\n\t\treturn svc, nil\n\t}\n\tcomputeOnce.Do(func() {\n\t\tcomputeService, computeErr = compute.NewService(context.Background(), option.WithScopes(compute.ComputeReadonlyScope))\n\t})\n\treturn computeService, computeErr\n}\n\n// ExtractSQLInfo lifts the fields the connect tools need out of a\n// Cloud SQL Admin DatabaseInstance.\nfunc ExtractSQLInfo(inst *sqladmin.DatabaseInstance) *CloudSQLInstanceInfo {\n\tinfo := &CloudSQLInstanceInfo{\n\t\tName:            inst.Name,\n\t\tProject:         inst.Project,\n\t\tRegion:          inst.Region,\n\t\tConnectionName:  inst.ConnectionName,\n\t\tDatabaseVersion: inst.DatabaseVersion,","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/cloudsqlconnect/gce.go#L74-L110","documentation":"GetComputeService builds a Compute Engine API client. When an explicit access token is provided, it constructs compute.NewService with a static token source and compute.ComputeReadonlyScope; any failure from the Google API client constructor is wrapped in this error. It usually indicates bad credentials, broken token configuration, or a missing/failing metadata/universe setup.","triggerScenarios":"Calling GetComputeService with an access token for which compute.NewService fails — malformed/expired token string, restricted network preventing API client initialization, or invalid option configuration.","commonSituations":"Running on GCE without the proper OAuth scopes; passing a revoked or syntactically invalid access token; corporate proxies/firewalls blocking googleapis.com; outdated google-api-go-client versions.","solutions":["Regenerate the access token with the compute.readonly scope (e.g. from the metadata server) and pass a valid, unexpired token","Ensure the VM/service account has the Compute Engine API enabled and compute.viewer permissions","Check network/proxy access to compute.googleapis.com; set HTTPS_PROXY if needed","Upgrade google.golang.org/api and rerun; inspect the wrapped %w error for root cause"],"exampleFix":"// before\ntoken := os.Getenv(\"STALE_TOKEN\") // expired\nsvc, err := cloudsqlconnect.GetComputeService(ctx, token)\n// after\ntoken, err := metadata.Get(\"instance/service-accounts/default/token?scopes=https://www.googleapis.com/auth/compute.readonly\")\nif err != nil { return err }\nsvc, err := cloudsqlconnect.GetComputeService(ctx, token.AccessToken)","handlingStrategy":"try-catch","validationCode":"if accessToken == \"\" {\n    return fmt.Errorf(\"access token is empty; refresh it before calling GetComputeService\")\n}","typeGuard":null,"tryCatchPattern":"svc, err := cloudsqlconnect.GetComputeService(ctx, token)\nif err != nil {\n    var oe *googleapi.Error\n    if errors.As(err, &oe) {\n        // inspect oe.Code / oe.Message for root cause\n    }\n    return fmt.Errorf(\"refresh token with compute.readonly scope and retry: %w\", err)\n}","preventionTips":["Fetch tokens from the metadata server with the compute.readonly scope","Check token expiry before use; refresh on 401","Ensure VM service accounts have compute scopes and the API is enabled"],"tags":["gcp","compute-engine","authentication","oauth"],"backgroundTag":"compute-client-initialization-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}