googleapis/mcp-toolbox · error

failed to create Google tokeninfo request: %w

Error message

failed to create Google tokeninfo request: %w

What it means

ValidateMCPAuth verifies opaque Google access tokens by POSTing to Google's tokeninfo endpoint. This error wraps a failure to construct that outbound http.Request (http.NewRequestWithContext), which is almost always a malformed URL or an invalid context.

Source

Thrown at internal/auth/google/google.go:184

			for _, s := range tokenScopes {
				scopeMap[s] = true
			}

			for _, requiredScope := range a.ScopesRequired {
				if !scopeMap[requiredScope] {
					return nil, &auth.MCPAuthError{Code: http.StatusForbidden, Message: "insufficient scopes", ScopesRequired: a.ScopesRequired}
				}
			}
		}
		return payload.Claims, nil
	}

	// Validate opaque Google access token via tokeninfo
	data := url.Values{}
	data.Set("access_token", tokenStr)
	req, err := http.NewRequestWithContext(ctx, "POST", "https://oauth2.googleapis.com/tokeninfo", strings.NewReader(data.Encode()))
	if err != nil {
		return nil, fmt.Errorf("failed to create Google tokeninfo request: %w", err)
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	client := a.client
	if client == nil {
		client = http.DefaultClient
	}

	resp, err := client.Do(req)
	if err != nil {
		return nil, &auth.MCPAuthError{Code: http.StatusInternalServerError, Message: fmt.Sprintf("failed to call Google tokeninfo: %v", err), ScopesRequired: a.ScopesRequired}
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, &auth.MCPAuthError{Code: http.StatusUnauthorized, Message: fmt.Sprintf("Google token validation failed with status: %d", resp.StatusCode), ScopesRequired: a.ScopesRequired}
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Inspect the wrapped inner error for the exact cause
2. Confirm the tokeninfo endpoint URL constant has not been overridden/altered
3. Retry after upgrading the library; a stock build should never hit this

claims, err := svc.ValidateMCPAuth(ctx, h)
if err != nil && strings.Contains(err.Error(), "failed to create Google tokeninfo request") {
    return fmt.Errorf("google auth request construction failed: %w", err) // non-retryable; escalate
}

When it happens

Trigger: http.NewRequestWithContext returns error before the request is sent — practically only if the hardcoded URL 'https://oauth2.googleapis.com/tokeninfo' is invalid or the request body reader fails; rare, typically indicates a code-level bug or exotic ctx misuse.

Common situations: Very rare in practice; could surface in tests that replace the endpoint constant, or in restricted environments instrumenting http.NewRequest.

Related errors

• failed to read Google tokeninfo response: %w
• failed to decode Google tokeninfo response: %w
• `audience` or `clientId` is required when `mcpEnabled` is tr
• `audience` is not allowed when `mcpEnabled` is false
• `scopesRequired` is not allowed when `mcpEnabled` is false

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/a6e7afcdfabab3c6. Report an issue: GitHub.