googleapis/mcp-toolbox · error

EXTERNAL_QUERY is not allowed when dataset restrictions are

Error message

EXTERNAL_QUERY is not allowed when dataset restrictions are in place

What it means

The SQL scanner found the EXTERNAL_QUERY function in a statement while dataset restrictions are active for this BigQuery tool — EXTERNAL_QUERY escapes BigQuery and its target cannot be analyzed against the allowed datasets.

Source

Thrown at internal/tools/bigquery/bigquerycommon/table_name_parser.go:234

			if char == '"' {
				state = stateInDoubleQuoteString
				i++
				continue
			}

			if unicode.IsLetter(char) || char == '`' {
				parts, consumed, err := parseIdentifierSequence(remaining)
				if err != nil {
					return 0, err
				}
				if consumed == 0 {
					i++
					continue
				}

				for _, part := range parts {
					if strings.EqualFold(part, "EXTERNAL_QUERY") {
						return 0, fmt.Errorf("EXTERNAL_QUERY is not allowed when dataset restrictions are in place")
					}
				}

				// Check for INFORMATION_SCHEMA
				infoSchemaIdx := -1
				for idx, part := range parts {
					if strings.EqualFold(part, "INFORMATION_SCHEMA") {
						infoSchemaIdx = idx
						break
					}
				}
				if infoSchemaIdx != -1 {
					viewName := parts[len(parts)-1]
					if !datasetLevelInformationSchemaViews[strings.ToLower(viewName)] {
						return 0, fmt.Errorf("querying non-dataset-level INFORMATION_SCHEMA view %q is not allowed when dataset restrictions are in place", viewName)
					}
					if infoSchemaIdx == 0 {
						return 0, fmt.Errorf("querying INFORMATION_SCHEMA views without a dataset prefix is not allowed when dataset restrictions are in place")

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Remove EXTERNAL_QUERY from the statement
2. Query the external data through a permitted BigQuery dataset instead
3. Relax dataset restrictions if federated access is intended

When it happens

Trigger: Thrown at internal/tools/bigquery/bigquerycommon/table_name_parser.go:234 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/7ff15c4b14d981d6. Report an issue: GitHub.