googleapis/mcp-toolbox · error

path %q must be absolute

Error message

path %q must be absolute

What it means

ValidateLocalPath requires absolute paths (after cleaning) for local file destinations; the given path is relative, so the tool refuses to guess where bytes would land.

Source

Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:52

	if p == "" {
		return "", fmt.Errorf("path is empty")
	}
	// Reject any ".." segment in the raw input. We check the raw input
	// (not just the cleaned output) so that escapes like
	// "/legit/../../etc/passwd" — which filepath.Clean collapses to an
	// innocuous-looking absolute path — are still rejected. Legitimate
	// names that happen to *contain* two dots (e.g. "foo..bar") are fine;
	// only a standalone ".." segment is disallowed.
	for _, seg := range strings.FieldsFunc(p, func(r rune) bool {
		return r == '/' || r == '\\'
	}) {
		if seg == ".." {
			return "", fmt.Errorf("path %q contains '..'", p)
		}
	}
	clean := filepath.Clean(p)
	if !filepath.IsAbs(clean) {
		return "", fmt.Errorf("path %q must be absolute", p)
	}
	return clean, nil
}

// ResolveSymlinks returns the final filesystem target of path, following every
// symbolic link along the way. Comparing *this* against a configured boundary —
// rather than the caller-supplied name — is what stops a path that merely looks
// like it sits inside the boundary from opening a file outside it.
//
// Paths whose trailing components do not exist yet (the normal case for a
// download destination) are resolved as deeply as the filesystem allows, and
// the missing components are appended literally.
//
// A component that exists as a symbolic link but does not resolve — a dangling
// link — is rejected rather than treated as a missing name. Creating a file at
// such a path follows the link, so accepting it on the strength of its literal
// name would reopen the very escape this function exists to close.
//

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Prefix the path with a leading slash / full absolute path
2. Resolve relative paths against a configured base directory before calling the tool
3. Update the tool invocation to use absolute paths

When it happens

Trigger: Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/7384508d1ce33a0a. Report an issue: GitHub.