googleapis/mcp-toolbox · error

failed to read Google tokeninfo response: %w

Error message

failed to read Google tokeninfo response: %w

What it means

After a successful (HTTP 200) call to Google's tokeninfo endpoint, ValidateMCPAuth reads up to 1 MiB of the response body. If io.ReadAll fails (connection reset mid-read, context canceled, TLS error during body streaming), the error is wrapped with this message.

Source

Thrown at internal/auth/google/google.go:205

	client := a.client
	if client == nil {
		client = http.DefaultClient
	}

	resp, err := client.Do(req)
	if err != nil {
		return nil, &auth.MCPAuthError{Code: http.StatusInternalServerError, Message: fmt.Sprintf("failed to call Google tokeninfo: %v", err), ScopesRequired: a.ScopesRequired}
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, &auth.MCPAuthError{Code: http.StatusUnauthorized, Message: fmt.Sprintf("Google token validation failed with status: %d", resp.StatusCode), ScopesRequired: a.ScopesRequired}
	}

	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	if err != nil {
		return nil, fmt.Errorf("failed to read Google tokeninfo response: %w", err)
	}

	var tokenInfo struct {
		Aud   string `json:"aud"`
		Azp   string `json:"azp"`
		Scope string `json:"scope"`
	}
	if err := json.Unmarshal(body, &tokenInfo); err != nil {
		return nil, fmt.Errorf("failed to decode Google tokeninfo response: %w", err)
	}

	aud := tokenInfo.Aud
	if aud == "" {
		aud = tokenInfo.Azp
	}

	audLimit := a.Audience
	if audLimit == "" {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Retry the request; tokeninfo reads are usually transient failures
2. Increase the request/context timeout
3. Check proxy/firewall stability for oauth2.googleapis.com
4. Verify network egress in the deployment environment

claims, err := svc.ValidateMCPAuth(ctx, h)
if err != nil && strings.Contains(err.Error(), "failed to read Google tokeninfo response") {
    time.Sleep(200 * time.Millisecond)
    claims, err = svc.ValidateMCPAuth(ctx, h) // retry once on transient read failure
}

When it happens

Trigger: Google tokeninfo response body read interrupted: network drop, ctx deadline exceeded during read, proxy closing connection prematurely.

Common situations: Flaky network or corporate proxy between the toolbox and oauth2.googleapis.com; request context timeout set too tight; transient GCP API incidents.

Related errors

• failed to create Google tokeninfo request: %w
• failed to decode Google tokeninfo response: %w
• `audience` or `clientId` is required when `mcpEnabled` is tr
• `audience` is not allowed when `mcpEnabled` is false
• `scopesRequired` is not allowed when `mcpEnabled` is false

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/a24fad902a7a5e49. Report an issue: GitHub.