googleapis/mcp-toolbox · error

failed to check auth requirements: %w

Error message

failed to check auth requirements: %w

What it means

Thrown by runInvoke (cmd/internal/invoke/command.go:141) when tool.RequiresClientAuthorization(src) returns an error while determining whether the tool requires client-supplied authorization (OAuth/OIDC bearer based on its authRequired services). This is a resolution failure inside the auth service lookup, not a rejection of the call itself. The CLI treats it as fatal because client auth is not supported for ephemeral CLI invocations.

Source

Thrown at cmd/internal/invoke/command.go:141

	parsedParams, err := parameters.ParseParams(toolParams, params, nil)
	if err != nil {
		errMsg := fmt.Errorf("invalid parameters: %w", err)
		opts.Logger.ErrorContext(ctx, errMsg.Error())
		return errMsg
	}

	parsedParams, err = tool.EmbedParams(ctx, parsedParams, primitiveMgr)
	if err != nil {
		errMsg := fmt.Errorf("error embedding parameters: %w", err)
		opts.Logger.ErrorContext(ctx, errMsg.Error())
		return errMsg
	}

	// Client Auth not supported for ephemeral CLI call
	requiresAuth, err := tool.RequiresClientAuthorization(src)
	if err != nil {
		errMsg := fmt.Errorf("failed to check auth requirements: %w", err)
		opts.Logger.ErrorContext(ctx, errMsg.Error())
		return errMsg
	}
	if requiresAuth {
		errMsg := fmt.Errorf("client authorization is not supported")
		opts.Logger.ErrorContext(ctx, errMsg.Error())
		return errMsg
	}

	result, err := tool.Invoke(ctx, src, parsedParams, "")
	if err != nil {
		errMsg := fmt.Errorf("tool execution failed: %w", err)
		opts.Logger.ErrorContext(ctx, errMsg.Error())
		return errMsg
	}

	// Print Result
	output, err := json.MarshalIndent(result, "", "  ")

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check startup logs for 'failed to initialize resources' — fix the authServices entry that failed to initialize.
2. Verify each name in the tool's `authRequired` list matches a defined authServices key in your config.
3. Validate the auth service configuration (clientID, issuer, etc.) against the docs for that auth kind.
4. Remove the authRequired entry if the tool does not actually require client authorization for local use.

Example fix

# before (auth service name mismatch)
tools:
  my-tool:
    kind: postgres-sql
    authRequired: [google_oidc]
authServices:
  google-oauth:
    kind: google
# after (names match)
tools:
  my-tool:
    kind: postgres-sql
    authRequired: [google-oauth]
authServices:
  google-oauth:
    kind: google

# Verify every authRequired name has a matching authServices entry:
python3 -c "
import yaml,sys
c=yaml.safe_load(open('tools.yaml'))
for n,t in c.get('tools',{}).items():
    for a in t.get('authRequired',[]):
        assert a in c.get('authServices',{}), f'{n}: missing auth service {a}'
print('ok')"

if err := runInvoke(...); err != nil {
  if strings.Contains(err.Error(), "failed to check auth requirements") ||
     strings.Contains(err.Error(), "client authorization is not supported") {
    // fall back to the MCP server path, which supports client auth
  }
}

When it happens

Trigger: Invoking a tool whose authRequired list references an auth service that failed to initialize or does not exist in authServicesMap, so RequiresClientAuthorization cannot resolve the service's requirements.

Common situations: Typo in the auth service name under the tool's `authRequired` field, an authServices entry with invalid OIDC/OAuth config that failed at InitializeConfigs, or copying a tool definition between config files without copying its authServices block.

Related errors

• MCP Auth cannot be enabled together with the legacy HTTP API
• client authorization is not supported
• error retrieving configuration file: %w
• invalid prebuilt config format '%s'. Did you mean '%s/%s'? U
• toolset '%s' not found in prebuilt configuration '%s'. Avail

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/49fb17484a2ea068. Report an issue: GitHub.