googleapis/mcp-toolbox · error

allowedDataset '%s' not found in project '%s'

Error message

allowedDataset '%s' not found in project '%s'

What it means

During Initialize, the source verifies each allowedDataset exists by fetching its metadata via the BigQuery client (dataset.Metadata). If the API returns HTTP 404 (googleapi.Error), the dataset (or project) does not exist or is not visible to the credentials, producing this error and aborting initialization.

Source

Thrown at internal/sources/bigquery/bigquery.go:245

				if len(parts) != 2 {
					return nil, fmt.Errorf("invalid allowedDataset format: %q, expected 'project.dataset' or 'dataset'", allowed)
				}
				projectID = parts[0]
				datasetID = parts[1]
				allowedFullID = allowed
			} else {
				projectID = r.Project
				datasetID = allowed
				allowedFullID = fmt.Sprintf("%s.%s", projectID, datasetID)
			}

			if s.Client != nil {
				dataset := s.Client.DatasetInProject(projectID, datasetID)
				_, err := dataset.Metadata(ctx)
				if err != nil {
					s.Client.Close()
					if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == http.StatusNotFound {
						return nil, fmt.Errorf("allowedDataset '%s' not found in project '%s'", datasetID, projectID)
					}
					return nil, fmt.Errorf("failed to verify allowedDataset '%s' in project '%s': %w", datasetID, projectID, err)
				}
			}
			allowedDatasets[allowedFullID] = struct{}{}
		}
	}

	s.AllowedDatasets = allowedDatasets
	s.SessionProvider = s.newBigQuerySessionProvider()
	s.makeDataplexCatalogClient = s.lazyInitDataplexClient(ctx, tracer)
	return s, nil
}

// setupClientCaching initializes caches and wraps the base client creator with caching logic.
func setupClientCaching(s *Source, baseCreator BigqueryClientCreator) {
	// Define eviction handlers
	onBqEvict := func(key string, value interface{}) {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Verify the dataset exists: `bq ls --project_id=<project>` or the Cloud Console.
2. Prefix the entry with the owning project ('project.dataset') if it is not in the source's project.
3. Grant the configured credentials BigQuery Data Viewer (roles/bigquery.dataViewer) on the dataset — permission gaps surface as 404.
4. Check for typos and case sensitivity in the dataset name.

Example fix

// before
allowedDatasets:
  - analytics   # dataset lives in another project
// after
allowedDatasets:
  - my-gcp-project.analytics

for _, ds := range allowedDatasets {
	proj, name := splitProjectDataset(ds, cfg.Project)
	if _, err := bqClient.DatasetInProject(proj, name).Metadata(ctx); err != nil {
		log.Printf("warning: allowedDataset %s in project %s is not visible: %v", name, proj, err)
	}
}

src, err := sourceRegistry.Initialize(ctx, cfg)
if err != nil {
	if strings.Contains(err.Error(), "not found in project") {
		log.Printf("dataset missing or hidden; verify existence and grants: %v", err)
		return err
	}
	return err
}

When it happens

Trigger: allowedDatasets entry naming a dataset that doesn't exist, a dataset in a different project than assumed, or one the ADC/service account cannot see (404 is also returned for permission-hidden resources in BigQuery).

Common situations: Typos in dataset names; referencing datasets in another project without the 'project.' prefix so they resolve against the wrong project; service account lacking BigQuery Data Viewer on the dataset; deleted datasets still listed in config.

Related errors

• failed to verify allowedDataset '%s' in project '%s': %w
• error getting AlloyDB cluster: %w
• error getting AlloyDB instance: %w
• error getting AlloyDB user: %w
• cannot unmarshal %T into StringOrStringSlice

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/bd8d662d098f428d. Report an issue: GitHub.