googleapis/mcp-toolbox · error

failed to build token-scoped Compute Engine client: %w

Error message

failed to build token-scoped Compute Engine client: %w

What it means

GetComputeService builds a Compute Engine API client. When an explicit access token is provided, it constructs compute.NewService with a static token source and compute.ComputeReadonlyScope; any failure from the Google API client constructor is wrapped in this error. It usually indicates bad credentials, broken token configuration, or a missing/failing metadata/universe setup.

Source

Thrown at internal/util/cloudsqlconnect/gce.go:92

// evaluated as the caller (matching how cloudsqladmin.Source.GetService
// treats its accessToken). When accessToken is empty the function
// returns the process-wide client backed by Application Default
// Credentials, built once on first call.
//
// The ADC-backed initializer runs with context.Background() on purpose:
// a request-scoped ctx cached inside sync.Once would poison every
// subsequent invocation if the first caller cancelled. Callers still
// propagate their request ctx to individual API calls via
// Instances.Get(...).Context(ctx).Do().
func GetComputeService(ctx context.Context, accessToken string) (*compute.Service, error) {
	if accessToken != "" {
		ts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})
		svc, err := compute.NewService(ctx,
			option.WithTokenSource(ts),
			option.WithScopes(compute.ComputeReadonlyScope),
		)
		if err != nil {
			return nil, fmt.Errorf("failed to build token-scoped Compute Engine client: %w", err)
		}
		return svc, nil
	}
	computeOnce.Do(func() {
		computeService, computeErr = compute.NewService(context.Background(), option.WithScopes(compute.ComputeReadonlyScope))
	})
	return computeService, computeErr
}

// ExtractSQLInfo lifts the fields the connect tools need out of a
// Cloud SQL Admin DatabaseInstance.
func ExtractSQLInfo(inst *sqladmin.DatabaseInstance) *CloudSQLInstanceInfo {
	info := &CloudSQLInstanceInfo{
		Name:            inst.Name,
		Project:         inst.Project,
		Region:          inst.Region,
		ConnectionName:  inst.ConnectionName,
		DatabaseVersion: inst.DatabaseVersion,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Regenerate the access token with the compute.readonly scope (e.g. from the metadata server) and pass a valid, unexpired token
2. Ensure the VM/service account has the Compute Engine API enabled and compute.viewer permissions
3. Check network/proxy access to compute.googleapis.com; set HTTPS_PROXY if needed
4. Upgrade google.golang.org/api and rerun; inspect the wrapped %w error for root cause

Example fix

// before
token := os.Getenv("STALE_TOKEN") // expired
svc, err := cloudsqlconnect.GetComputeService(ctx, token)
// after
token, err := metadata.Get("instance/service-accounts/default/token?scopes=https://www.googleapis.com/auth/compute.readonly")
if err != nil { return err }
svc, err := cloudsqlconnect.GetComputeService(ctx, token.AccessToken)

if accessToken == "" {
    return fmt.Errorf("access token is empty; refresh it before calling GetComputeService")
}

svc, err := cloudsqlconnect.GetComputeService(ctx, token)
if err != nil {
    var oe *googleapi.Error
    if errors.As(err, &oe) {
        // inspect oe.Code / oe.Message for root cause
    }
    return fmt.Errorf("refresh token with compute.readonly scope and retry: %w", err)
}

When it happens

Trigger: Calling GetComputeService with an access token for which compute.NewService fails — malformed/expired token string, restricted network preventing API client initialization, or invalid option configuration.

Common situations: Running on GCE without the proper OAuth scopes; passing a revoked or syntactically invalid access token; corporate proxies/firewalls blocking googleapis.com; outdated google-api-go-client versions.

Related errors

• error getting email from ADC: %v
• failed to initialize dataplex client: %w
• error parsing access token: %w
• error creating client from OAuth access token: %w
• failed to create impersonated credentials for %q: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/9238c4d43cb1f038. Report an issue: GitHub.