googleapis/mcp-toolbox · error

failed to verify allowedDataset '%s' in project '%s': %w

Error message

failed to verify allowedDataset '%s' in project '%s': %w

What it means

This is the non-404 branch of the allowedDataset verification: when dataset.Metadata fails with any error other than googleapi 404 (network failure, 403 permission errors, 500s, quota issues), initialization aborts and wraps the underlying error with this message. The client is closed before returning.

Source

Thrown at internal/sources/bigquery/bigquery.go:247

				}
				projectID = parts[0]
				datasetID = parts[1]
				allowedFullID = allowed
			} else {
				projectID = r.Project
				datasetID = allowed
				allowedFullID = fmt.Sprintf("%s.%s", projectID, datasetID)
			}

			if s.Client != nil {
				dataset := s.Client.DatasetInProject(projectID, datasetID)
				_, err := dataset.Metadata(ctx)
				if err != nil {
					s.Client.Close()
					if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == http.StatusNotFound {
						return nil, fmt.Errorf("allowedDataset '%s' not found in project '%s'", datasetID, projectID)
					}
					return nil, fmt.Errorf("failed to verify allowedDataset '%s' in project '%s': %w", datasetID, projectID, err)
				}
			}
			allowedDatasets[allowedFullID] = struct{}{}
		}
	}

	s.AllowedDatasets = allowedDatasets
	s.SessionProvider = s.newBigQuerySessionProvider()
	s.makeDataplexCatalogClient = s.lazyInitDataplexClient(ctx, tracer)
	return s, nil
}

// setupClientCaching initializes caches and wraps the base client creator with caching logic.
func setupClientCaching(s *Source, baseCreator BigqueryClientCreator) {
	// Define eviction handlers
	onBqEvict := func(key string, value interface{}) {
		if client, ok := value.(*bigqueryapi.Client); ok && client != nil {
			client.Close()

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Inspect the wrapped underlying error for the real cause (403 vs network vs 5xx).
2. Ensure the BigQuery API (bigquery.googleapis.com) is enabled on the project.
3. Fix connectivity/egress to googleapis.com (proxies, VPC, firewall rules).
4. Grant the credentials basic BigQuery permissions so metadata lookups aren't denied.
5. Retry initialization if the failure was transient (5xx/rate limit).

Example fix

// before (no connectivity check)
./toolbox
// after
gcloud services list --enabled | grep bigquery
curl -sI https://bigquery.googleapis.com && ./toolbox

if _, err := bqClient.DatasetInProject(proj, name).Metadata(ctx); err != nil {
	var gerr *googleapi.Error
	if !errors.As(err, &gerr) || gerr.Code != http.StatusNotFound {
		log.Printf("pre-flight metadata check failed (non-404): %v", err)
	}
}

func isNotFound(err error) bool {
	var gerr *googleapi.Error
	return errors.As(err, &gerr) && gerr.Code == 404
}

src, err := sourceRegistry.Initialize(ctx, cfg)
if err != nil {
	if strings.Contains(err.Error(), "failed to verify allowedDataset") {
		if isTransient(err) { // network/5xx
			return retryWithBackoff(func() error { return initializeSource(ctx, cfg) }, 3)
		}
		log.Printf("permanent metadata failure, check API enablement and permissions: %v", err)
	}
	return err
}

When it happens

Trigger: Verifying an allowedDataset when the BigQuery API call fails transiently or permanently for reasons other than not-found: connectivity/DNS issues, 403 denied, API not enabled on the project, rate limiting, or invalid project causing non-404 API errors.

Common situations: Network egress blocked in the deployment environment; BigQuery API disabled in the target project; service account lacking any BigQuery permission producing 403; transient backend errors during startup.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• allowedDataset '%s' not found in project '%s'
• failed to create BigQuery client for project %q: %w
• error listing AlloyDB clusters: %w
• error listing AlloyDB instances: %w
• error listing AlloyDB users: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/6253475d3336a2c8. Report an issue: GitHub.