googleapis/mcp-toolbox · error

failed to find default Google Cloud credentials with scope %

Error message

failed to find default Google Cloud credentials with scope %q: %w

What it means

This error is wrapped when google.FindDefaultCredentials fails to locate Application Default Credentials (ADC) with the cloud-platform scope during source initialization. The databaseinsights source requires authenticated Google Cloud credentials to call the Database Insights REST API, so initialization aborts if none can be found.

Source

Thrown at internal/sources/databaseinsights/databaseinsights.go:122

}

func (s *Source) ProjectID() string {
	return s.Project
}

func initConnection(
	ctx context.Context,
	tracer trace.Tracer,
	name string,
	project string,
	endpoint string,
) (*http.Client, string, error) {
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceKind, name)
	defer span.End()

	cred, err := google.FindDefaultCredentials(ctx, sources.CloudPlatformScope)
	if err != nil {
		return nil, "", fmt.Errorf("failed to find default Google Cloud credentials with scope %q: %w", sources.CloudPlatformScope, err)
	}

	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, "", err
	}

	// Create authenticated HTTP client using the credentials token source
	httpClient := oauth2.NewClient(ctx, cred.TokenSource)
	httpClient.Transport = &authHeadersRoundTripper{
		configProject: project,
		adcProject:    cred.ProjectID,
		userAgent:     userAgent,
		next:          httpClient.Transport,
	}

	if endpoint == "" {
		endpoint = "https://databaseinsights.googleapis.com"

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' locally to create ADC
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account JSON key file
3. Deploy on GCP (GCE, Cloud Run, GKE) so the metadata server supplies credentials automatically
4. Verify the credentials file exists, is readable, and is valid JSON with the cloud-platform scope

Example fix

// before
cred, err := google.FindDefaultCredentials(ctx, sources.CloudPlatformScope) // fails: no ADC
// after
// terminal: export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json
cred, err := google.FindDefaultCredentials(ctx, sources.CloudPlatformScope)

func hasADC() error {
  if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") != "" {
    if _, err := os.Stat(os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")); err != nil {
      return fmt.Errorf("GOOGLE_APPLICATION_CREDENTIALS file missing: %w", err)
    }
    return nil
  }
  if b, _ := exec.Command("gcloud", "auth", "application-default", "print-access-token").Output(); len(b) > 0 {
    return nil
  }
  return errors.New("no ADC found: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS")
}

When it happens

Trigger: Calling Initialize (via initConnection) when no ADC are present: no GOOGLE_APPLICATION_CREDENTIALS env var, no gcloud user/application-default credentials, no attached service account (GCE/Cloud Run/GKE metadata), and no well-known credentials file.

Common situations: Running the toolbox locally without ever running 'gcloud auth application-default login'; deploying outside GCP without mounting a service account key; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing or invalid file path.

Related errors

• failed to find default Google Cloud credentials with scope %
• error creating client from ADC: %w
• failed to find default Google Cloud credentials: %w
• failed to find default Google Cloud credentials with scope %
• failed to find default credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/aeef178325604739. Report an issue: GitHub.