googleapis/mcp-toolbox · critical

error creating new sqladmin service: %w

Error message

error creating new sqladmin service: %w

What it means

Thrown in Source.Initialize when constructing the Cloud SQL Admin API client via sqladmin.NewService fails. This is the last step of source initialization, so any failure building the HTTP client wrapped around the ADC (Application Default Credentials) or the explicitly provided client surfaces here.

Source

Thrown at internal/sources/cloudsqladmin/cloud_sql_admin.go:99

	var client *http.Client
	if r.UseClientOAuth {
		client = &http.Client{
			Transport: util.NewUserAgentRoundTripper(ua, http.DefaultTransport),
		}
	} else {
		// Use Application Default Credentials
		creds, err := google.FindDefaultCredentials(ctx, sqladmin.SqlserviceAdminScope)
		if err != nil {
			return nil, fmt.Errorf("failed to find default credentials: %w", err)
		}
		baseClient := oauth2.NewClient(ctx, creds.TokenSource)
		baseClient.Transport = util.NewUserAgentRoundTripper(ua, baseClient.Transport)
		client = baseClient
	}

	service, err := sqladmin.NewService(ctx, option.WithHTTPClient(client))
	if err != nil {
		return nil, fmt.Errorf("error creating new sqladmin service: %w", err)
	}

	s := &Source{
		Config:  r,
		BaseURL: "https://sqladmin.googleapis.com",
		Service: service,
	}
	return s, nil
}

var _ sources.Source = &Source{}

type Source struct {
	Config
	BaseURL string
	Service *sqladmin.Service
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run `gcloud auth application-default login` locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key path.
2. Validate the credentials JSON file exists and parses (e.g. `python -c "import json;json.load(open('key.json'))"`).
3. When using MyCBCredentials/client injection, verify the custom http.Client passed via option.WithHTTPClient is non-nil and has a working transport.
4. Check network/proxy access to oauth2.googleapis.com, since token fetching happens during client construction/first use.

Example fix

// before (broken env)
os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/path/to/missing.json")
// after
os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/secure/path/service-account.json") // file exists + valid JSON

credPath := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if credPath == "" {
    // rely on ADC/metadata server; verify one exists
    if _, err := google.FindDefaultCredentials(context.Background(), sqladmin.CloudPlatformScope); err != nil {
        return fmt.Errorf("no GCP credentials available for Cloud SQL admin: %w", err)
    }
} else if _, err := os.Stat(credPath); err != nil {
    return fmt.Errorf("credential file not found: %w", err)
}

func hasValidGCPCreds(ctx context.Context) bool {
    _, err := google.FindDefaultCredentials(ctx, sqladmin.CloudPlatformScope)
    return err == nil
}

src, err := cloudsqladminSource.Initialize(ctx, cfg)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) {
        log.Printf("sqladmin init failed [%d]: %s", gerr.Code, gerr.Message)
    }
    return fmt.Errorf("cloudsqladmin source init failed: %w", err)
}

When it happens

Trigger: Calling Initialize (e.g. at toolbox startup parsing the cloudsql-postgres/cloudsql-mysql source config) when sqladmin.NewService cannot build a base HTTP client: invalid ADC, malformed GOOGLE_APPLICATION_CREDENTIALS file, or a bad option.WithHTTPClient composition.

Common situations: Deploying without gcloud auth application-default login; a service-account key JSON file that is missing, unreadable, or has invalid JSON; running in an environment with no metadata server and no credentials configured.

Related errors

• unable to create bigtable.NewClient: %w
• failed to find default credentials: %w
• failed to find default Google Cloud credentials for project
• failed to initialize Firebase Rules client: %w
• failed to create Firestore client for project %q and databas

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/70505c941dd6e7d7. Report an issue: GitHub.