fix(tool/looker-conversational-analytics): OAuth token in GDA payload fix by flaviojdz · Pull Request #3058 · googleapis/mcp-toolbox

flaviojdz · 2026-04-14T18:18:26Z

When using per-user OAuth (use_client_oauth: true), the ask_data_insights tool fails to authenticate with the Gemini Data Analytics API, while get_models and get_explores work correctly with the same token.

The MCP server extracts the full Authorization header value (e.g., "Bearer abc123") and passes it as accessToken to each tool's Invoke() method. The get_models/get_explores tools pass this to GetLookerSDK(), which sets it as an HTTP Authorization header where the "Bearer " prefix is expected. However, ask_data_insights was embedding the full "Bearer abc123" string into the JSON payload's access_token field sent to the GDA API, which expects only the raw token value.

The fix calls accessToken.ParseBearerToken() to strip the "Bearer " prefix before placing the token into the TokenBased struct. This only affects the OAuth code path; the SecretBased (client_id/client_secret) path is unchanged.

Before

oauth_creds.Token = TokenBased{AccessToken: string(accessToken)}
// Produces: {"access_token": "Bearer abc123"} -- rejected by GDA API

After

rawToken, err := accessToken.ParseBearerToken()
oauth_creds.Token = TokenBased{AccessToken: rawToken}
// Produces: {"access_token": "abc123"} -- correct

Files Changed

internal/tools/looker/lookerconversationalanalytics/lookerconversationalanalytics.go

PR Checklist

Make sure you reviewed
CONTRIBUTING.md
Make sure to open an issue as a
bug/issue
before writing your code! That way we can discuss the change, evaluate
designs, and agree on the general idea
Ensure the tests and linter pass
Code coverage does not decrease (if any source code was changed)
Appropriate docs were updated (if necessary)
Make sure to add ! if this involve a breaking change

🛠️ Fixes #3057

drstrangelooker · 2026-04-14T18:19:49Z

/gcbrun

gemini-code-assist

Code Review

This pull request updates the Looker Conversational Analytics tool to properly parse bearer tokens using the ParseBearerToken method, replacing the previous direct string conversion. A review comment suggests simplifying the error handling by avoiding redundant error wrapping and instead returning the error directly if it satisfies the expected interface.

…ersationalanalytics.go gemini code assist feedback Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

drstrangelooker · 2026-04-14T18:49:02Z

/gcbrun

duwenxin99

@flaviojdz Could you fix the lint error? Thanks!

drstrangelooker · 2026-04-14T19:12:23Z

Here is the git diff after running golangci-lint run --fix

diff --git a/internal/tools/looker/lookerconversationalanalytics/lookerconversationalanalytics.go b/internal/tools/looker/lookerconversationalanalytics/lookerconversationalanalytics.go
index 6d5e90e70ae..adb0f2a3613 100644
--- a/internal/tools/looker/lookerconversationalanalytics/lookerconversationalanalytics.go
+++ b/internal/tools/looker/lookerconversationalanalytics/lookerconversationalanalytics.go
@@ -249,7 +249,7 @@ func (t Tool) Invoke(ctx context.Context, resourceMgr tools.SourceProvider, para
        }
        oauth_creds := OAuthCredentials{}
        if source.UseClientAuthorization() {
-rawToken, err := accessToken.ParseBearerToken()
+               rawToken, err := accessToken.ParseBearerToken()
                if err != nil {
                        return nil, err.(util.ToolboxError)
                }

drstrangelooker · 2026-04-14T19:13:19Z

@flaviojdz Also merge the latest changes in. Then we can merge.

drstrangelooker · 2026-04-15T14:45:04Z

/gcbrun

drstrangelooker · 2026-04-15T15:20:30Z

Just an FYI @flaviojdz we are currently in code freeze for Next26. This will be released after next week.

flaviojdz · 2026-04-15T15:58:18Z

No problem. We have a due date of May 7th. Hope we can meet on Next26 :)

…

On Wed, Apr 15, 2026 at 5:20 PM Dr. Strangelove ***@***.***> wrote: *drstrangelooker* left a comment (googleapis/mcp-toolbox#3058) <#3058 (comment)> Just an FYI @flaviojdz <https://github.com/flaviojdz> we are currently in code freeze for Next26. This will be released after next week. — Reply to this email directly, view it on GitHub <#3058 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFBGSK3FEBSSFHPVH4RY4Q34V6SFLAVCNFSM6AAAAACXZG2LQGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DENJTGI4TGMZVHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

🤖 I have created a release *beep* *boop* --- ## [1.2.0](v1.1.0...v1.2.0) (2026-05-07) ### Features * Add support for HTTPS/TLS listener ([#3126](#3126)) ([8bc385d](8bc385d)) * **source/bigquery:** Add maximumBytesBilled source config ([#2724](#2724)) ([42f2d07](42f2d07)) * **source/cloud-storage:** Add bucket and object management tools ([#3129](#3129)) ([8de9bcf](8de9bcf)) * **source/cloud-storage:** Add Cloud Storage source with list_objects and read_object tools ([#3081](#3081)) ([da27b37](da27b37)) * **source/cloud-storage:** Add write/copy/move/delete object tools ([#3139](#3139)) ([b225fc4](b225fc4)) * **tools/knowledge-catalog:** Search Data Quality Scans ([#2444](#2444)) ([1c63551](1c63551)) ### Bug Fixes * Allow converting string literal block with list ([#3050](#3050)) ([36ab2a9](36ab2a9)), closes [#3023](#3023) * **mcp:** Implement router-level logger injection for MCP auth ([#3067](#3067)) ([ccc7cf5](ccc7cf5)) * Prevent test.db from being created during unit tests ([#3042](#3042)) ([d10d2ca](d10d2ca)) * Remove hardcoded * allowed origin for sse ([#3054](#3054)) ([c4c7bd9](c4c7bd9)) * **sources/postgres:** Apply URL encoding to query string params ([#3020](#3020)) ([6b860f4](6b860f4)) * **tool/looker-conversational-analytics:** OAuth token in GDA payload fix ([#3058](#3058)) ([6632d96](6632d96)) * **tools/bigquery-execute-sql:** Avoid surfacing invalid queries as MCP 500s ([#3056](#3056)) ([7ed92c8](7ed92c8)) * **tools/looker:** Fix OAuth for Converational Analytics ([#3044](#3044)) ([f9e3e55](f9e3e55)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [1.2.0](googleapis/mcp-toolbox@v1.1.0...v1.2.0) (2026-05-07) ### Features * Add support for HTTPS/TLS listener ([googleapis#3126](googleapis#3126)) ([8bc385d](googleapis@8bc385d)) * **source/bigquery:** Add maximumBytesBilled source config ([googleapis#2724](googleapis#2724)) ([42f2d07](googleapis@42f2d07)) * **source/cloud-storage:** Add bucket and object management tools ([googleapis#3129](googleapis#3129)) ([8de9bcf](googleapis@8de9bcf)) * **source/cloud-storage:** Add Cloud Storage source with list_objects and read_object tools ([googleapis#3081](googleapis#3081)) ([da27b37](googleapis@da27b37)) * **source/cloud-storage:** Add write/copy/move/delete object tools ([googleapis#3139](googleapis#3139)) ([b225fc4](googleapis@b225fc4)) * **tools/knowledge-catalog:** Search Data Quality Scans ([googleapis#2444](googleapis#2444)) ([1c63551](googleapis@1c63551)) ### Bug Fixes * Allow converting string literal block with list ([googleapis#3050](googleapis#3050)) ([36ab2a9](googleapis@36ab2a9)), closes [googleapis#3023](googleapis#3023) * **mcp:** Implement router-level logger injection for MCP auth ([googleapis#3067](googleapis#3067)) ([ccc7cf5](googleapis@ccc7cf5)) * Prevent test.db from being created during unit tests ([googleapis#3042](googleapis#3042)) ([d10d2ca](googleapis@d10d2ca)) * Remove hardcoded * allowed origin for sse ([googleapis#3054](googleapis#3054)) ([c4c7bd9](googleapis@c4c7bd9)) * **sources/postgres:** Apply URL encoding to query string params ([googleapis#3020](googleapis#3020)) ([6b860f4](googleapis@6b860f4)) * **tool/looker-conversational-analytics:** OAuth token in GDA payload fix ([googleapis#3058](googleapis#3058)) ([6632d96](googleapis@6632d96)) * **tools/bigquery-execute-sql:** Avoid surfacing invalid queries as MCP 500s ([googleapis#3056](googleapis#3056)) ([7ed92c8](googleapis@7ed92c8)) * **tools/looker:** Fix OAuth for Converational Analytics ([googleapis#3044](googleapis#3044)) ([f9e3e55](googleapis@f9e3e55)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

fix oauth for looker ask-data-insights

097ed67

flaviojdz requested review from a team as code owners April 14, 2026 18:18

blunderbuss-gcf Bot assigned duwenxin99 Apr 14, 2026

gemini-code-assist Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread internal/tools/looker/lookerconversationalanalytics/lookerconversationalanalytics.go

drstrangelooker approved these changes Apr 14, 2026

View reviewed changes

Update internal/tools/looker/lookerconversationalanalytics/lookerconv…

df0dff5

…ersationalanalytics.go gemini code assist feedback Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

drstrangelooker added the tests: run Label to trigger Github Action tests. label Apr 14, 2026

drstrangelooker added the release candidate Use label to signal PR should be included in the next release. label Apr 14, 2026

drstrangelooker changed the title ~~# fix(tool/looker-conversational-analytics): OAuth token in GDA payload fix~~ fix(tool/looker-conversational-analytics): OAuth token in GDA payload fix Apr 14, 2026

duwenxin99 approved these changes Apr 14, 2026

View reviewed changes

drstrangelooker added the priority: p2 Moderately-important priority. Fix may not be included in next release. label Apr 14, 2026

drstrangelooker added 2 commits April 15, 2026 10:41

fix: lint issue

e221d87

Merge remote-tracking branch 'origin/main' into dd-main

a3b2e8d

drstrangelooker merged commit 6632d96 into googleapis:main Apr 15, 2026
14 checks passed

release-please Bot mentioned this pull request Apr 15, 2026

chore(main): release 1.2.0 #3059

Merged

BrewTestBot mentioned this pull request May 7, 2026

mcp-toolbox 1.2.0 Homebrew/homebrew-core#281497

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(tool/looker-conversational-analytics): OAuth token in GDA payload fix#3058

fix(tool/looker-conversational-analytics): OAuth token in GDA payload fix#3058
drstrangelooker merged 4 commits into
googleapis:mainfrom
datadriven-works:main

flaviojdz commented Apr 14, 2026 •

edited

Loading

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

duwenxin99 left a comment

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

drstrangelooker commented Apr 15, 2026

Uh oh!

Uh oh!

drstrangelooker commented Apr 15, 2026

Uh oh!

flaviojdz commented Apr 15, 2026 via email

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

flaviojdz commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before

After

Files Changed

PR Checklist

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

duwenxin99 left a comment

Choose a reason for hiding this comment

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

drstrangelooker commented Apr 14, 2026

Uh oh!

drstrangelooker commented Apr 15, 2026

Uh oh!

Uh oh!

drstrangelooker commented Apr 15, 2026

Uh oh!

flaviojdz commented Apr 15, 2026 via email

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

flaviojdz commented Apr 14, 2026 •

edited

Loading