What causes "status %d %s: %s" in googleapis/mcp-toolbox?

Inspect the response body embedded in the error message — Google returns a JSON {"error":{"code":...,"message":...,"status":...}} explaining the real cause

googleapis/mcp-toolbox · error

status %d %s: %s

Error message

status %d %s: %s

What it means

parseResults wraps every non-2xx HTTP response from the Cloud Healthcare API into a single error carrying the numeric status code, the textual status (e.g. "404 Not Found"), and the raw response body. This library method throws it because FHIR/DICOM requests can fail server-side for many reasons and the raw body usually contains Google's JSON error detail (error.code, error.message, error.status). The message is the generic catch-all for any failed HTTP call made through this source.

Source

Thrown at internal/sources/cloudhealthcare/cloud_healthcare.go:282

func (s *Source) IsDICOMStoreAllowed(storeID string) bool {
	if len(s.allowedDICOMStores) == 0 {
		return true
	}
	_, ok := s.allowedDICOMStores[storeID]
	return ok
}

func (s *Source) UseClientAuthorization() bool {
	return s.UseClientOAuth
}

func parseResults(resp *http.Response) (any, error) {
	respBytes, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("could not read response: %w", err)
	}
	if resp.StatusCode > 299 {
		return nil, fmt.Errorf("status %d %s: %s", resp.StatusCode, resp.Status, respBytes)
	}
	var jsonMap map[string]interface{}
	if err := json.Unmarshal(respBytes, &jsonMap); err != nil {
		return nil, fmt.Errorf("could not unmarshal response as json: %w", err)
	}
	return jsonMap, nil
}

func (s *Source) getService(tokenStr string) (*healthcare.Service, error) {
	svc := s.Service()
	var err error
	// Initialize new service if using user OAuth token
	if s.UseClientAuthorization() {
		svc, err = s.ServiceCreator()(tokenStr)
		if err != nil {
			return nil, fmt.Errorf("error creating service from OAuth access token: %w", err)
		}
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

Inspect the response body embedded in the error message — Google returns a JSON {"error":{"code":...,"message":...,"status":...}} explaining the real cause
Verify the dataset, FHIR store, project and location names used in the tool parameters exactly match the Cloud Healthcare resource
Check IAM: the caller's identity needs roles/healthcare.viewer (or fhirResourceViewer) on the store/dataset
For 429s, retry with exponential backoff; for 401/403 re-check credential expiry and scopes
Confirm the FHIR store's API version (v1/v1beta1) matches the URL path segment being requested

Example fix

// before: opaque failure
tool.Invoke(...) // -> status 404 Not Found: {"error":{"message":"FHIR store not found"}}
// after: validate store/config existence first
if _, err := healthcareClient.Projects.Locations.Datasets.FhirStores.Get(storeName).Do(); err != nil {
    return fmt.Errorf("FHIR store %s does not exist or is not accessible: %w", storeName, err)
}

Defensive patterns

Strategy: try-catch

Validate before calling

const isGoogleErr = (body) => { try { const j = JSON.parse(body); return j && j.error && typeof j.error.code === 'number'; } catch { return false; } }

Type guard

function isGoogleAPIError(e) { return e instanceof Error && /status \d{3} /.test(e.message) && e.message.includes('{"error"'); }

Try / catch

try {
  const result = await tool.invoke({ patientId });
} catch (e) {
  const m = /status (\d{3}) ([^:]+): ([\s\S]+)/.exec(e.message);
  if (m) {
    const [, code, status, body] = m;
    let detail; try { detail = JSON.parse(body).error.message; } catch { detail = body; }
    if (code === '429') { /* retry with backoff */ }
    else if (code === '403') { /* fix IAM */ }
    throw new Error(`Healthcare API ${code}: ${detail}`);
  }
  throw e;
}

Prevention

Validate FHIR store, dataset, project and location parameters against the actual Google resource hierarchy before invoking
Grant the caller identity roles/healthcare.viewer or finer-grained FHIR roles in IAM
Implement exponential backoff for 429/5xx responses
Log the embedded response body — it contains Google's canonical error.status for programmatic branching

When it happens

Trigger: Any Cloud Healthcare REST call routed through parseResults (FHIRFetchPage, FHIRPatientEverything, FHIRPatientSearch, GetFHIRResource) when resp.StatusCode > 299: invalid resource IDs, wrong dataset/store names, insufficient IAM permissions (403), missing resources (404), malformed FHIR queries (400), or quota/rate limiting (429).

Common situations: Typos in project/location/dataset/FHIR store configuration; a service account lacking roles/healthcare.viewer or healthcare.fhirResourceViewer; querying a FHIR store where the resource type or patient ID does not exist; passing an invalid search parameter that Google rejects with 400.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/dedbd971ec8d9ca6. Report an issue: GitHub.