googleapis/mcp-toolbox · error

error creating service from ADC: %w

Error message

error creating service from ADC: %w

What it means

CloudHealthcare's Initialize calls initHealthcareConnection, which builds a healthcare.Service from Application Default Credentials (ADC). Any failure there is re-wrapped with this message, aborting source initialization.

Source

Thrown at internal/sources/cloudhealthcare/cloud_healthcare.go:90

	Region             string   `yaml:"region" validate:"required"`
	Dataset            string   `yaml:"dataset" validate:"required"`
	AllowedFHIRStores  []string `yaml:"allowedFhirStores"`
	AllowedDICOMStores []string `yaml:"allowedDicomStores"`
	UseClientOAuth     bool     `yaml:"useClientOAuth"`
}

func (c Config) SourceConfigType() string {
	return SourceType
}

func (c Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {
	var service *healthcare.Service
	var serviceCreator HealthcareServiceCreator
	var tokenSource oauth2.TokenSource

	svc, tok, err := initHealthcareConnection(ctx, tracer, c.Name)
	if err != nil {
		return nil, fmt.Errorf("error creating service from ADC: %w", err)
	}
	if c.UseClientOAuth {
		serviceCreator, err = newHealthcareServiceCreator(ctx, tracer, c.Name)
		if err != nil {
			return nil, fmt.Errorf("error constructing service creator: %w", err)
		}
	} else {
		service = svc
		tokenSource = tok
	}

	dsName := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", c.Project, c.Region, c.Dataset)
	if _, err = svc.Projects.Locations.Datasets.FhirStores.Get(dsName).Do(); err != nil {
		if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == http.StatusNotFound {
			return nil, fmt.Errorf("dataset '%s' not found", dsName)
		}
		return nil, fmt.Errorf("failed to verify existence of dataset '%s': %w", dsName, err)
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set up ADC: gcloud auth application-default login or GOOGLE_APPLICATION_CREDENTIALS pointing to a valid service-account key
2. Enable the Cloud Healthcare API for the project
3. Verify the healthcare dataset/FHIR store names in the source config are correct
4. Consider UseClientOAuth: true so the caller's token is used instead of ADC

Example fix

// before
# shell
./toolbox --sources healthcare.yaml
# error creating service from ADC
// after
gcloud auth application-default login \
  --scopes=https://www.googleapis.com/auth/cloud-platform
./toolbox --sources healthcare.yaml

import "google.golang.org/api/healthcare"
// verify ADC + API access before starting toolbox
creds, err := google.FindDefaultCredentials(ctx, healthcare.CloudPlatformScope)
if err != nil { return fmt.Errorf("ADC missing for Cloud Healthcare: %w", err) }

// Go: classify initialization failure at startup
src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "ADC") {
    return fmt.Errorf("fix credentials before retrying: %w", err)
}

When it happens

Trigger: Declaring a cloud-healthcare source without UseClientOAuth; Initialize -> initHealthcareConnection fails because ADC are missing/invalid, the Cloud Healthcare API is disabled, or the project/location/dataset/store values are rejected during service setup.

Common situations: Local runs without 'gcloud auth application-default login', CI containers lacking a mounted service-account key, or GCP projects where the Healthcare API hasn't been enabled.

Related errors

• failed to find default credentials: %w
• failed to find default Google Cloud credentials with scope %
• failed to create authenticated HTTP client: %w
• failed to find default credentials (run 'gcloud auth applica
• failed to find default Google Cloud credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/fba59197efbbb0b7. Report an issue: GitHub.