googleapis/mcp-toolbox · error

directory %q is invalid: %w

Error message

directory %q is invalid: %w

What it means

Wrap of a ValidateLocalPath failure on the configured base directory inside ResolveWithinDir: the directory passed as `dir` (typically destination_dir) is not a valid cleaned absolute local path, so containment checking cannot proceed.

Source

Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:126

// escapes reports whether target lies outside dir. Both are expected to be
// cleaned absolute paths.
func escapes(dir, target string) (bool, error) {
	within, err := filepath.Rel(dir, target)
	if err != nil {
		return true, err
	}
	return within == ".." || strings.HasPrefix(within, ".."+string(filepath.Separator)) || filepath.IsAbs(within), nil
}

// ResolveWithinDir joins rel onto dir and returns the result only if it stays
// inside dir, both as written and after symlinks are resolved. The returned
// path is the cleaned join, not the symlink-resolved target, so callers keep
// reporting the location the user asked for.
func ResolveWithinDir(dir, rel string) (string, error) {
	cleanDir, err := ValidateLocalPath(dir)
	if err != nil {
		return "", fmt.Errorf("directory %q is invalid: %w", dir, err)
	}
	if rel == "" {
		return "", fmt.Errorf("relative path is empty")
	}
	if filepath.IsAbs(rel) {
		return "", fmt.Errorf("path %q must be relative", rel)
	}

	cleanDest := filepath.Clean(filepath.Join(cleanDir, rel))
	out, err := escapes(cleanDir, cleanDest)
	if err != nil {
		return "", fmt.Errorf("path %q cannot be resolved within %q: %w", rel, cleanDir, err)
	}
	if out {
		return "", fmt.Errorf("path %q escapes configured directory %q", rel, cleanDir)
	}

	// Repeat the check against the real targets. A symlink under cleanDir can

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set destination_dir to a cleaned absolute filesystem path in the tool configuration
2. Ensure the directory exists and contains no symlinks or components that fail local path validation

When it happens

Trigger: Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:126 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/e60f1433bcae11cd. Report an issue: GitHub.