What causes "failed to find default credentials: %w" in googleapis/mcp-toolbox?

Run 'gcloud auth application-default login' for local development

failed to find default credentials: %w

Error message

failed to find default credentials: %w

What it means

This error wraps google.FindDefaultCredentials failing to locate Application Default Credentials for the Cloud Monitoring scope. It occurs in Initialize when UseClientOAuth is false and the source must use ADC, but no credential chain can be found in the environment.

Source

Thrown at internal/sources/cloudmonitoring/cloud_monitoring.go:77

}

// Initialize initializes a Cloud Monitoring Source instance.
func (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {
	ua, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, fmt.Errorf("error in User Agent retrieval: %s", err)
	}

	var client *http.Client
	if r.UseClientOAuth {
		client = &http.Client{
			Transport: util.NewUserAgentRoundTripper(ua, http.DefaultTransport),
		}
	} else {
		// Use Application Default Credentials
		creds, err := google.FindDefaultCredentials(ctx, monitoring.MonitoringScope)
		if err != nil {
			return nil, fmt.Errorf("failed to find default credentials: %w", err)
		}
		baseClient := oauth2.NewClient(ctx, creds.TokenSource)
		baseClient.Transport = util.NewUserAgentRoundTripper(ua, baseClient.Transport)
		client = baseClient
	}

	s := &Source{
		Config:    r,
		baseURL:   "https://monitoring.googleapis.com",
		client:    client,
		userAgent: ua,
	}
	return s, nil
}

var _ sources.Source = &Source{}

type Source struct {

View on GitHub (pinned to 8cc6e09de2)

Solutions

Run 'gcloud auth application-default login' for local development
Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key
Enable UseClientOAuth and supply a client access token instead of server ADC
Verify Cloud Monitoring API access/permissions for the credential

Example fix

// before
google.FindDefaultCredentials(ctx, monitoring.MonitoringScope) // fails: no ADC
// after
gcloud auth application-default login
// or:
creds, err := google.FindDefaultCredentials(ctx, monitoring.MonitoringScope)

Defensive patterns

Strategy: fallback

Validate before calling

creds, err := google.FindDefaultCredentials(ctx, monitoring.MonitoringScope)
if err != nil {
    return fmt.Errorf("ADC unavailable before init: %w", err)
}

Try / catch

if err != nil {
    if strings.Contains(err.Error(), "could not find default credentials") {
        log.Fatal("run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS")
    }
    return err
}

Prevention

Set GOOGLE_APPLICATION_CREDENTIALS in deployment manifests
Run ADC login in dev onboarding docs
Health-check credentials at process startup
On GCP runtimes rely on the attached service account instead of key files

When it happens

Trigger: Initializing a cloudmonitoring source with UseClientOAuth=false while no ADC source is available: GOOGLE_APPLICATION_CREDENTIALS unset/unreadable, no gcloud user credentials, no metadata server (e.g. running locally or in a non-GCP environment).

Common situations: Running the toolbox locally without 'gcloud auth application-default login'; missing service-account key file; key file path pointing to a nonexistent file; container without the metadata service.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/8527286f111319dd. Report an issue: GitHub.