googleapis/mcp-toolbox · critical

failed to create GDA HTTP client: %w

Error message

failed to create GDA HTTP client: %w

What it means

NewGDAClient in internal/util/gda.go builds an HTTP client for the Gemini Data Agent (GDA) via htransport.NewClient, using defaults plus caller-supplied options. If the underlying OAuth2/transport construction fails (bad credentials, missing/unreadable Application Default Credentials, invalid option, or client-certificate setup failure), the error is wrapped with this message.

Source

Thrown at internal/util/gda.go:63

		return gdaMTLSEndpoint
	}
	return gdaDefaultEndpoint
}

// NewGDAClient returns an HTTP client configured for Gemini Data Analytics.
// It handles mTLS and authentication if a token source is provided.
func NewGDAClient(ctx context.Context, opts ...option.ClientOption) (*http.Client, error) {
	// Default options for GDA
	defaultOpts := []option.ClientOption{
		option.WithEndpoint(GetGDAEndpoint()),
		option.WithScopes("https://www.googleapis.com/auth/cloud-platform"),
	}

	allOpts := append(defaultOpts, opts...)

	client, _, err := htransport.NewClient(ctx, allOpts...)
	if err != nil {
		return nil, fmt.Errorf("failed to create GDA HTTP client: %w", err)
	}
	return client, nil
}

func isClientCertificateEnabled() bool {
	return strings.ToLower(os.Getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE")) == "true"
}

func getMTLSMode() string {
	mode := os.Getenv("GOOGLE_API_USE_MTLS_ENDPOINT")
	if mode == "" {
		mode = os.Getenv("GOOGLE_API_USE_MTLS") // Deprecated
	}
	if mode == "" {
		return "auto"
	}
	return strings.ToLower(mode)
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set up Application Default Credentials: run `gcloud auth application-default login` locally, or attach a service account in the runtime environment
2. Verify GOOGLE_APPLICATION_CREDENTIALS points to an existing, valid service-account JSON key file
3. Unset or fix GOOGLE_API_USE_CLIENT_CERTIFICATE unless client certificates (mTLS) are genuinely required
4. Inspect the wrapped cause (%w) in the error message to identify whether it is credential loading, token fetch, or transport failure

Example fix

// before (no credentials configured)
client, err := NewGDAClient(ctx)
// after (configure ADC first: gcloud auth application-default login)
opts := []option.ClientOption{option.WithScopes("https://www.googleapis.com/auth/cloud-platform")}
client, err := NewGDAClient(ctx, opts...)

if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") != "" {
    if _, err := os.Stat(os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")); err != nil {
        return fmt.Errorf("GOOGLE_APPLICATION_CREDENTIALS points to an unreadable file: %v", err)
    }
}
creds, err := google.FindDefaultCredentials(context.Background())
if err != nil {
    return fmt.Errorf("no Application Default Credentials available: %w", err)
}

func hasCredentials(ctx context.Context) bool {
    _, err := google.FindDefaultCredentials(ctx)
    return err == nil
}

client, err := NewGDAClient(ctx, opts...)
if err != nil {
    return nil, fmt.Errorf("GDA client init failed: %w (check ADC: gcloud auth application-default login, or GOOGLE_APPLICATION_CREDENTIALS)", err)
}

When it happens

Trigger: Calling NewGDAClient (directly, from a tool's Invoke, or in tests via TestNewGDAClient/setupDataAgent) when GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no ADC is available in the environment, the credentials JSON is malformed, or GOOGLE_API_USE_CLIENT_CERTIFICATE misconfiguration breaks mTLS setup.

Common situations: Running locally without `gcloud auth application-default login`; deploying to an environment without a service-account attachment; a typo'd GOOGLE_APPLICATION_CREDENTIALS path; quota-project or scope misconfiguration.

Related errors

• failed to find default Google Cloud credentials with scope %
• failed to find default Google Cloud credentials with scope %
• error getting email from ADC: %v
• error creating client from ADC: %w
• failed to initialize dataplex client: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/466d29be58f91c61. Report an issue: GitHub.