What causes "unable to connect successfully: %w" in googleapis/mcp-toolbox?

Verify Trino coordinator host/port and that SSL setting matches the server (8080 http vs 8443 https)

unable to connect successfully: %w

Error message

unable to connect successfully: %w

What it means

After creating the Trino pool, Initialize calls PingContext to verify the server is actually reachable. If the ping fails, the pool is closed and this error wraps the driver error. It means configuration was parseable but the Trino coordinator did not accept the connection or handshake.

Source

Thrown at internal/sources/trino/trino.go:83

	SSLCertPath            string `yaml:"sslCertPath"`
	SSLCert                string `yaml:"sslCert"`
	DisableSslVerification bool   `yaml:"disableSslVerification"`
}

func (r Config) SourceConfigType() string {
	return SourceType
}

func (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {
	pool, err := initTrinoConnectionPool(ctx, tracer, r.Name, r.Host, r.Port, r.User, r.Password, r.Catalog, r.Schema, r.QueryTimeout, r.AccessToken, r.KerberosEnabled, r.SSLEnabled, r.SSLCertPath, r.SSLCert, r.DisableSslVerification)
	if err != nil {
		return nil, fmt.Errorf("unable to create pool: %w", err)
	}

	err = pool.PingContext(ctx)
	if err != nil {
		pool.Close()
		return nil, fmt.Errorf("unable to connect successfully: %w", err)
	}

	s := &Source{
		Config: r,
		Pool:   pool,
	}
	return s, nil
}

var _ sources.Source = &Source{}

type Source struct {
	Config
	Pool *sql.DB
}

func (s *Source) IsReadOnly() bool {
	return false

View on GitHub (pinned to 8cc6e09de2)

Solutions

Verify Trino coordinator host/port and that SSL setting matches the server (8080 http vs 8443 https)
Test reachability: curl https://<host>:<port>/v1/info with the same auth from the same network
Check access token validity or Kerberos credentials (keytab path, principal, realm)
Confirm TLS CA trust — add the coordinator CA via sslCertPath if self-signed
Check context deadline if the ping timed out

Example fix

// before
port: "8080"
sslEnabled: true
// after
port: "8443"
sslEnabled: true

Defensive patterns

Strategy: validation

Validate before calling

// probe the coordinator before Initialize
u := fmt.Sprintf("http%s://%s:%s/v1/info", sslMap(true:"s"), host, port)
resp, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
// expect 200; non-200 or dial error predicts ping failure

Try / catch

src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "unable to connect successfully") {
    return fmt.Errorf("cannot reach Trino coordinator, check host/port/TLS/auth: %w", err)
}

Prevention

Match SSL flag to the coordinator port (8080=http, 8443=https)
Curl /v1/info from the deployment network as a preflight check
Provide the coordinator CA via sslCertPath for self-signed TLS
Verify token/Kerberos credentials before deployment and monitor expiry

When it happens

Trigger: pool.PingContext(ctx) returning an error during Trino source Initialize: DNS failure, connection refused, TLS handshake failure, invalid access token/kerberos credentials rejected by the coordinator, or context timeout.

Common situations: Wrong host/port (Trino default 8080 for HTTP, 8443 for HTTPS); SSL enabled but coordinator serves plain HTTP; expired/invalid access token; network/firewall blocking egress to the coordinator; Kerberos keytab/principal misconfiguration.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/e02abebb24e09603. Report an issue: GitHub.