googleapis/mcp-toolbox · critical

failed to create Firebase Rules client for project %q: %w

Error message

failed to create Firebase Rules client for project %q: %w

What it means

This error is returned by initFirebaseRulesConnection when firebaserules.NewService fails to construct the Firebase Rules API client. The Rules API client needs valid credentials and an endpoint connection; failures are almost always authentication/ADC related or network access to firebaserules.googleapis.com. The project string in the message is context only — it is not passed to NewService.

Source

Thrown at internal/sources/firestore/firestore.go:983

	}

	// Create the Firestore client
	client, err := firestore.NewClientWithDatabase(ctx, project, database, option.WithUserAgent(userAgent))
	if err != nil {
		return nil, fmt.Errorf("failed to create Firestore client for project %q and database %q: %w", project, database, err)
	}

	return client, nil
}

func initFirebaseRulesConnection(
	ctx context.Context,
	project string,
) (*firebaserules.Service, error) {
	// Create the Firebase Rules client
	rulesClient, err := firebaserules.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to create Firebase Rules client for project %q: %w", project, err)
	}

	return rulesClient, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Provide valid ADC: set GOOGLE_APPLICATION_CREDENTIALS to a service-account key or run `gcloud auth application-default login`
2. Enable the Firebase Rules API (firebaserules.googleapis.com) for the project
3. Verify network egress to googleapis.com (proxy/firewall) from the runtime environment

Example fix

// before
# container runs with no credential mount
rulesSrc, err := cfg.Initialize(ctx, tracer) // fails
// after
# docker run -v $PWD/sa.json:/sa.json -e GOOGLE_APPLICATION_CREDENTIALS=/sa.json ...

if _, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform"); err != nil {
    log.Fatal("no valid ADC for Firebase Rules API")
}

src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "failed to create Firebase Rules client") {
    log.Fatalf("Firebase Rules client init failed — check ADC/API access: %v", err)
}

When it happens

Trigger: firebaserules.NewService(ctx) returns non-nil err during Initialize of a Firebase Rules-oriented source: no Application Default Credentials available, invalid service-account key file, or blocked network access to the Firebase Rules API endpoint.

Common situations: Missing GOOGLE_APPLICATION_CREDENTIALS in local/container environments; disabled firebaserules.googleapis.com API on the project; outbound firewall rules blocking googleapis.com; corrupt or wrong-type credential file referenced by ADC.

Related errors

• unable to create bigtable.NewClient: %w
• error creating new sqladmin service: %w
• failed to find default Google Cloud credentials for project
• failed to initialize Firebase Rules client: %w
• failed to create Firestore client for project %q and databas

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/6da83185f8c86afb. Report an issue: GitHub.