googleapis/mcp-toolbox · critical

failed to create authenticated HTTP client: %w

Error message

failed to create authenticated HTTP client: %w

What it means

ExecuteMQL uses google.DefaultClient (Application Default Credentials) with the datastore and cloud-platform scopes to build an authenticated HTTP client for the Firestore REST executePipeline endpoint. This error wraps the ADC failure — no credentials found, malformed credential files, or unsupported credential types.

Source

Thrown at internal/sources/firestore/firestore.go:875

	case *firestore.DocumentRef:
		return "reference"
	case []byte:
		return "bytes"
	default:
		return fmt.Sprintf("%T", v)
	}
}

// ExecuteMQL sends an MQL query to the Firestore executePipeline API via the iql stage or as a raw structured pipeline.
func (s *Source) ExecuteMQL(ctx context.Context, query string) (any, error) {
	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		userAgent = "mcp-toolbox"
	}

	httpClient, err := google.DefaultClient(ctx, "https://www.googleapis.com/auth/datastore", "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return nil, fmt.Errorf("failed to create authenticated HTTP client: %w", err)
	}

	url := fmt.Sprintf("https://firestore.googleapis.com/v1/projects/%s/databases/%s/documents:executePipeline", s.GetProjectId(), s.GetDatabaseId())

	trimmed := strings.TrimSpace(query)
	var bodyBytes []byte

	// If the query is already formatted as a full structuredPipeline JSON payload
	if strings.HasPrefix(trimmed, "{") && (strings.Contains(trimmed, "structuredPipeline") || strings.Contains(trimmed, "pipeline")) {
		bodyBytes = []byte(trimmed)
	} else {
		mqlQuery := trimmed
		if !strings.HasPrefix(mqlQuery, "db.") && !strings.HasPrefix(mqlQuery, "db[") {
			mqlQuery = "db." + mqlQuery
		}

		// Construct the structuredPipeline payload with "iql" stage
		payload := map[string]any{

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run gcloud auth application-default login, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key path.
2. Validate the key file: it must be parseable JSON with type, client_email, and private_key fields.
3. On GCE/GKE, ensure the instance/service account has the cloud-platform and datastore scopes and roles/datastore.user.
4. Check that the project has the Cloud Firestore API enabled.

Example fix

// before (shell): no credentials
go run .
// after (shell): provide ADC
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json
go run .

// Validate credentials before calling ExecuteMQL
credsPath := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if credsPath == "" {
    if _, err := exec.LookPath("gcloud"); err != nil {
        return errors.New("no ADC: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS")
    }
} else if _, err := os.Stat(credsPath); err != nil {
    return fmt.Errorf("GOOGLE_APPLICATION_CREDENTIALS points to missing file: %w", err)
}

func hasValidADC(ctx context.Context) error {
    _, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/datastore")
    return err
}

result, err := src.ExecuteMQL(ctx, query)
if err != nil {
    if strings.Contains(err.Error(), "failed to create authenticated HTTP client") {
        // credentials problem: check GOOGLE_APPLICATION_CREDENTIALS / gcloud ADC
        // on GCE: check VM access scopes include cloud-platform
    }
    return err
}

When it happens

Trigger: google.DefaultClient fails because GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no ADC is available (gcloud auth application-default login never run, no metadata server), or the credentials cannot be refreshed / scopes cannot be granted.

Common situations: Running the toolbox locally without gcloud ADC; CI containers without a mounted service-account key; GOOGLE_APPLICATION_CREDENTIALS set to a wrong path or corrupt JSON; workload identity/metadata server unavailable outside GCP; GCE VM missing cloud-platform access scope.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• failed to find default credentials: %w
• error creating service from ADC: %w
• failed to find default Google Cloud credentials with scope %
• failed to find default credentials (run 'gcloud auth applica
• failed to find default Google Cloud credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/7a9e50bd34fcd7e4. Report an issue: GitHub.