googleapis/mcp-toolbox · critical

failed to create Firestore client for project %q and databas

Error message

failed to create Firestore client for project %q and database %q: %w

What it means

This error is returned by initFirestoreConnection when firestore.NewClientWithDatabase fails to build a Firestore client for the configured project and database. It means the SDK could not establish the client — most often credential resolution failed (no Application Default Credentials), the project ID is invalid, or default scopes/quota project settings are wrong. No queries can run until this succeeds.

Source

Thrown at internal/sources/firestore/firestore.go:970

	database string,
) (*firestore.Client, error) {
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)
	defer span.End()

	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, err
	}

	// If database is not specified, use the default database
	if database == "" {
		database = "(default)"
	}

	// Create the Firestore client
	client, err := firestore.NewClientWithDatabase(ctx, project, database, option.WithUserAgent(userAgent))
	if err != nil {
		return nil, fmt.Errorf("failed to create Firestore client for project %q and database %q: %w", project, database, err)
	}

	return client, nil
}

func initFirebaseRulesConnection(
	ctx context.Context,
	project string,
) (*firebaserules.Service, error) {
	// Create the Firebase Rules client
	rulesClient, err := firebaserules.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to create Firebase Rules client for project %q: %w", project, err)
	}

	return rulesClient, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key, or run `gcloud auth application-default login` locally
2. Verify the project ID and database ID in the source config exist in Google Cloud (database must be created in advance; '(default)' is used when omitted)
3. Ensure the Firestore Admin/API is enabled and the host can reach Google's OAuth/metadata endpoints

Example fix

// before
# config uses project: "my-prjoject" (typo), no credentials in env
// after
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json
# project: "my-project", database: "(default)"

// run before initializing the source
if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" {
    if _, err := google.FindDefaultCredentials(ctx); err != nil {
        log.Fatal("no Application Default Credentials available")
    }
}
// also verify project/database exist:
// gcloud firestore databases describe --project=MY_PROJECT

src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "failed to create Firestore client") {
    log.Fatalf("Firestore init failed — check credentials/project/database: %v", err)
}

When it happens

Trigger: firestore.NewClientWithDatabase(ctx, project, database, option.WithUserAgent(userAgent)) returns non-nil err during source Initialize: missing/invalid GOOGLE_APPLICATION_CREDENTIALS, malformed project ID, nonexistent database ID, or network failure reaching the metadata/token endpoints.

Common situations: Running locally without GOOGLE_APPLICATION_CREDENTIALS pointing at a service-account key; typos in the project or database id in the toolbox config (including a database other than '(default)' that was never created); workload identity/metadata server unreachable on GKE/Cloud Run; ADC找不到 valid quotas.

Related errors

• failed to initialize Firebase Rules client: %w
• unable to create bigtable.NewClient: %w
• error creating new sqladmin service: %w
• failed to find default Google Cloud credentials for project
• failed to create Firebase Rules client for project %q: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/75369ac6dafb877e. Report an issue: GitHub.