googleapis/mcp-toolbox · error

path is empty

Error message

path is empty

What it means

ValidateLocalPath's empty-string guard fired: the path passed to a Cloud Storage download/upload tool is "", which cannot be a valid local filesystem target.

Source

Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:35

import (
	"errors"
	"fmt"
	"io/fs"
	"os"
	"path/filepath"
	"strings"
)

// ValidateLocalPath enforces the local-filesystem path contract used by
// download_object and upload_object: non-empty, absolute after filepath.Clean,
// and free of ".." components. It returns the cleaned path. OS permissions
// remain the real isolation boundary; this check just prevents obvious
// traversal mistakes and forces callers to be explicit about where they want
// bytes to land. Confining a path to a configured directory is a separate
// concern; see ResolveWithinDir and ResolveSymlinks.
func ValidateLocalPath(p string) (string, error) {
	if p == "" {
		return "", fmt.Errorf("path is empty")
	}
	// Reject any ".." segment in the raw input. We check the raw input
	// (not just the cleaned output) so that escapes like
	// "/legit/../../etc/passwd" — which filepath.Clean collapses to an
	// innocuous-looking absolute path — are still rejected. Legitimate
	// names that happen to *contain* two dots (e.g. "foo..bar") are fine;
	// only a standalone ".." segment is disallowed.
	for _, seg := range strings.FieldsFunc(p, func(r rune) bool {
		return r == '/' || r == '\\'
	}) {
		if seg == ".." {
			return "", fmt.Errorf("path %q contains '..'", p)
		}
	}
	clean := filepath.Clean(p)
	if !filepath.IsAbs(clean) {
		return "", fmt.Errorf("path %q must be absolute", p)
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Provide a non-empty local file path parameter
2. Check that the agent/tool call actually supplied the path argument
3. Validate input earlier in the tool flow

When it happens

Trigger: Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:35 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/f70fa8fe3c4db8e3. Report an issue: GitHub.