What causes "store ID '%s' is not in the list of allowed stores" in googleapis/mcp-toolbox?

Use a store ID exactly matching one of the entries in the source's allowedStores config.

store ID '%s' is not in the list of allowed stores

Error message

store ID '%s' is not in the list of allowed stores

What it means

After reading the `storeID` string parameter, ValidateAndFetchStoreID checks it against the allowedStores set configured on the source. If the source declares an allowlist and the supplied store ID is not in it, this error is returned to prevent accessing stores outside the configured scope.

Source

Thrown at internal/tools/cloudhealthcare/common/util.go:53

const IncludeAttributesKey = "includefield"

// ValidateAndFetchStoreID validates the provided storeID against the allowedStores.
// If only one store is allowed, it returns that storeID.
// If multiple stores are allowed, it checks if the storeID parameter is in the allowed list.
func ValidateAndFetchStoreID(params parameters.ParamValues, allowedStores map[string]struct{}) (string, error) {
	if len(allowedStores) == 1 {
		for k := range allowedStores {
			return k, nil
		}
	}
	mapParams := params.AsMap()
	storeID, ok := mapParams[StoreKey].(string)
	if !ok {
		return "", fmt.Errorf("invalid or missing '%s' parameter; expected a string", StoreKey)
	}
	if len(allowedStores) > 0 {
		if _, ok := allowedStores[storeID]; !ok {
			return "", fmt.Errorf("store ID '%s' is not in the list of allowed stores", storeID)
		}
	}
	return storeID, nil
}

// ParseDICOMSearchParameters extracts the search parameters for various DICOM
// search methods.
func ParseDICOMSearchParameters(params parameters.ParamValues, paramKeys []string) ([]googleapi.CallOption, error) {
	var opts []googleapi.CallOption
	for k, v := range params.AsMap() {
		if k == IncludeAttributesKey {
			if _, ok := v.([]any); !ok {
				return nil, fmt.Errorf("invalid '%s' parameter; expected a string array", k)
			}
			attributeIDsSlice, err := parameters.ConvertAnySliceToTyped(v.([]any), "string")
			if err != nil {
				return nil, fmt.Errorf("can't convert '%s' to array of strings: %s", k, err)
			}

View on GitHub (pinned to 8cc6e09de2)

Solutions

Use a store ID exactly matching one of the entries in the source's allowedStores config.
Update the source's `allowedStores` list in the YAML to include the desired store.
Verify spelling/case of the store ID against `gcloud healthcare dicom-stores list`.
Omit/empty the allowlist if any store under the dataset should be permitted.

Example fix

// before (config)
source:
  kind: cloudhealthcare
  allowedDICOMStores: [store-a]
// invocation: storeID: store-b  -> rejected
// after
source:
  kind: cloudhealthcare
  allowedDICOMStores: [store-a, store-b]

Defensive patterns

Strategy: validation

Validate before calling

const allowed = new Set(["store-a", "store-b"]); // mirror of source allowedStores
if (!allowed.has(params.storeID)) {
  throw new Error(`storeID ${params.storeID} not in allowed list`);
}

Prevention

Copy store IDs from `gcloud healthcare dicom-stores list` to avoid typos
Update the source allowlist whenever stores are added/renamed in GCP
Keep allowlist comparisons case-sensitive and exact
Regenerate configs from a source of truth for store names

When it happens

Trigger: Invoking a healthcare tool with a storeID string that is valid but not present in the source's `allowedStores`/`allowedFHIRStores`/`allowedDICOMStores` configuration list.

Common situations: Typo in the store name (case-sensitive mismatch); store renamed in Google Cloud but config allowlist not updated; using a store from a different project/dataset than the source is configured for.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/0a1fefa89a8ffbb7. Report an issue: GitHub.