googleapis/mcp-toolbox · error

failed to find default credentials: %w

Error message

failed to find default credentials: %w

What it means

GoogleCloudTokenSourceWithScope calls google.FindDefaultCredentials to obtain a token source for calling Gemini Data Analytics, wrapping any failure. It means no Application Default Credentials could be located for the given scope.

Source

Thrown at internal/sources/cloudgda/cloud_gda.go:119

	return SourceType
}

func (s *Source) ToConfig() sources.SourceConfig {
	return s.Config
}

func (s *Source) GetProjectID() string {
	return s.ProjectID
}

func (s *Source) GoogleCloudTokenSourceWithScope(ctx context.Context, scope string) (oauth2.TokenSource, error) {
	if scope == "" {
		scope = CloudPlatformScope
	}

	creds, err := google.FindDefaultCredentials(ctx, scope)
	if err != nil {
		return nil, fmt.Errorf("failed to find default credentials: %w", err)
	}
	return creds.TokenSource, nil
}

func (s *Source) UseClientAuthorization() bool {
	return s.UseClientOAuth
}

func (s *Source) GetClient(ctx context.Context, tokenStr string) (*geminidataanalytics.DataChatClient, func(), error) {
	if s.UseClientOAuth {
		if tokenStr == "" {
			return nil, nil, fmt.Errorf("client-side OAuth is enabled but no access token was provided")
		}
		token := &oauth2.Token{AccessToken: tokenStr}
		opts := []option.ClientOption{
			option.WithUserAgent(s.userAgent),
			option.WithTokenSource(oauth2.StaticTokenSource(token)),
		}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' on dev machines
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key in containers/CI
3. Verify the key file is readable and valid JSON with the required scopes
4. Alternatively configure the source with UseClientOAuth so the caller supplies the token

Example fix

// before
# container has no credentials
export GOOGLE_APPLICATION_CREDENTIALS=/missing/key.json
// after
gcloud auth application-default login
# or in Docker
docker run -v $HOME/.config/gcloud/application_default_credentials.json:/adc.json -e GOOGLE_APPLICATION_CREDENTIALS=/adc.json ...

import "google.golang.org/api/option"
// pre-check before calling the tool
if _, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform"); err != nil {
    return fmt.Errorf("run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS: %w", err)
}

// Go: detect ADC failure distinctly
if err != nil {
    var adcErr *google.Error
    if strings.Contains(err.Error(), "default credentials") {
        return fmt.Errorf("ADC not configured: %w", err)
    }
    return err
}

When it happens

Trigger: Calling RunQuery on a cloudgda source (server-OAuth path) in an environment where neither GOOGLE_APPLICATION_CREDENTIALS points to a valid key file, gcloud ADC exist, nor a GCE metadata server is reachable; scope falls back to CloudPlatformScope when empty.

Common situations: Local development outside GCP without running 'gcloud auth application-default login', Docker containers without the service-account key mounted, or a malformed credentials JSON file.

Related errors

• failed to create DataChatClient: %w
• error creating service from ADC: %w
• failed to find default Google Cloud credentials with scope %
• failed to create authenticated HTTP client: %w
• failed to find default credentials (run 'gcloud auth applica

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/da8babbdf7168b11. Report an issue: GitHub.