googleapis/mcp-toolbox · critical

unable to create storage.NewClient for project %q: %w

Error message

unable to create storage.NewClient for project %q: %w

What it means

initGCSClient wraps failures from storage.NewClient (Google Cloud Storage SDK) when establishing a client for the configured project. This happens before any API call, typically due to bad credentials, missing ADC, invalid project, or transport/option errors.

Source

Thrown at internal/sources/cloudstorage/cloudstorage.go:633

	return map[string]any{
		"bucket":  bucket,
		"deleted": true,
	}, nil
}

func initGCSClient(ctx context.Context, tracer trace.Tracer, name, project string) (*storage.Client, error) {
	//nolint:all // Reassigned ctx
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)
	defer span.End()

	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, err
	}

	client, err := storage.NewClient(ctx, option.WithUserAgent(userAgent))
	if err != nil {
		return nil, fmt.Errorf("unable to create storage.NewClient for project %q: %w", project, err)
	}
	return client, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set up Application Default Credentials: gcloud auth application-default login locally, or attach a service account in GCP runtimes
2. Verify GOOGLE_APPLICATION_CREDENTIALS points to a valid, readable service-account JSON key
3. Test credentials independently: gcloud auth application-default print-access-token or a minimal storage.NewClient snippet
4. Ensure the environment can reach the OAuth2/metadata endpoints (check proxy/firewall settings)
5. Confirm the client option list is valid (user agent string, no conflicting options)

Example fix

// before (deployment)
// no credentials configured
// after
gcloud auth application-default login
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json

func credsAvailable() error {
    if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" {
        if _, err := credentials.DetectDefault(&credentials.Options{}); err != nil {
            return fmt.Errorf("no ADC: %w", err)
        }
    } else if _, err := os.Stat(os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")); err != nil {
        return fmt.Errorf("key file missing: %w", err)
    }
    return nil
}

src, err := cfg.Initialize(ctx, tracer)
if err != nil {
    if strings.Contains(err.Error(), "unable to create storage.NewClient") {
        // credentials/environment problem: check ADC and key file
        return fmt.Errorf("check GOOGLE_APPLICATION_CREDENTIALS/ADC: %w", err)
    }
    return err
}

When it happens

Trigger: Source Initialize → initGCSClient runs storage.NewClient(ctx, option.WithUserAgent(userAgent)) and it errors: no Application Default Credentials found, malformed GOOGLE_APPLICATION_CREDENTIALS key file, unsupported/invalid credential file, failure constructing an HTTP client (e.g. custom options), or network issues resolving metadata endpoints.

Common situations: Deployed without a service account (no metadata server), GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted/invalid JSON key, GCE metadata server unreachable, duplicate option conflicts, or missing cloud-platform scope in restricted environments.

Related errors

• unable to create client: %w
• failed to delete object %q in bucket %q: %w
• failed to delete bucket %q: %w
• unable to create new client: %w
• client authorization is not supported

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/4bc6c949c45be9f3. Report an issue: GitHub.