MCPToolset ignores auth_scheme/auth_credential during initialization and tool listing

[chyok]

Describe the bug

When passing auth_scheme and auth_credential to MCPToolset, the authentication is not performed during the MCP initialization and tool listing phases. This results in a failure when using authenticated MCP services.

To Reproduce

Steps to reproduce the behavior:

1.Install the MCP server:

pip install fastmcp 

2.Run the following MCP server code:

from fastmcp import FastMCP
from fastmcp.server.auth import BearerAuthProvider
from fastmcp.server.auth.providers.bearer import RSAKeyPair

key_pair = RSAKeyPair.generate()

auth = BearerAuthProvider(
 public_key=key_pair.public_key,
 issuer="https://dev.example.com",
 audience="my-dev-server"
)

token = key_pair.create_token(
 subject="test_user",
 issuer="https://dev.example.com"
)

print("token:", token) # paste the token to next

mcp = FastMCP(name="My MCP Server", auth=auth)

@mcp.tool
def real_time() -> str:
 return "2025-07-24 12:30"

if __name__ == "__main__":
 mcp.run(port=8080)

3. Use the following ADK client code to access the server:

from google.adk.agents.llm_agent import LlmAgent
from google.adk.tools.mcp_tool.mcp_session_manager import StreamableHTTPServerParams
from google.adk.tools.mcp_tool.mcp_toolset import MCPToolset
from google.adk.tools.openapi_tool.auth.auth_helpers import token_to_scheme_credential

token = "your paste token"
auth_scheme, auth_credential = token_to_scheme_credential(
 "oauth2Token", "header", "Authorization", token
)

root_agent = LlmAgent(
 model="gemini-2.0-flash",
 name='Assistant',
 instruction="""You are a professional assistant with access to real-time tool.""",
 tools=[
 MCPToolset(
 connection_params=StreamableHTTPServerParams(
 url='https://127.0.0.1:8080/mcp/',
 ),
 auth_scheme=auth_scheme,
 auth_credential=auth_credential
 )
 ],
)

4. Run agent and ask any question.

5. See the error due to missing authentication.

Expected behavior

The MCPToolset should correctly apply the auth_scheme and auth_credential during the initialization and tool listing phases, ensuring authentication occurs as expected and the tool can be invoked successfully.

Screenshots

Desktop:

• OS: Mac OS
• Python version: python 3.11.9
• ADK version: v1.8.0

Model Information:

Model: gemini-2.0-flash

Additional context

[hsuyuming]

Trying to post the same issue as well. Thank you @chyok
@seanzhou1023 @chyok @hangfei
I have a following question.
Are there any plans for the MCPToolset to comply with the MCP authorization spec [1]? Specifically, if the MCP server requires client authentication credentials, will the client first request authorization server information from an OAuth-protected resource, and then send a request to /oauth-authorization-server to obtain authorization information?

[1]https://modelcontextprotocol.io/specification/draft/basic/authorization#authorization-flow-steps

[enxilium]

Bumping this - there seems to be auth support for MCPs in the Google ADK source code (auth_scheme, auth_credentials parameters) but it isn't well documented. Many modern MCPs require authentication so it would be great if this could be implemented down the line!

[seanzhou1023]

yes, the auth scheme and auth credentials here are for tool calling only. we cannot reuse same field for tool listing because tool listing could have different auth requirement as tool calling.

we will add new field to handle that.

[hsuyuming]

Hi @seanzhou1023
I'm curious how the new field may looks like, Also if both MCP Server an the underlying tool calling are required "Authorization" header, how ADK may handle it?

E.g:
MCP enable authorization and it is using Google OAuth as provider, and tool calling also need authorization from third party service (e.g: Azure AD)

User -(header "Authorization": "Bearer " )> MCP -> Tool calling -(header "Authorization": "Bearer " )> third party service

[ninadingole]

yes, the auth scheme and auth credentials here are for tool calling only. we cannot reuse same field for tool listing because tool listing could have different auth requirement as tool calling.

we will add new field to handle that.

Why would tool listing have different auth requirement? Having different auths per resource will make it more complicated.

[LiamConnell]

@seanzhou1023 the MCP specification says that all endpoints (including both LIST tools and CALL tools) should be authenticated with an access token obtained by an Oauth flow. It doesnt mention that there is a different auth requirement for LIST, nor does is say that LIST should not be authenticated.

The issue is that ADK calls the LIST tools endpoint when the agent is initialized rather than when a user session has started. I think this will have to be moved to when the user session is created so that the API call to LIST tools has access to a user access token.

I think this issue should be labeled as a bug rather than a feature because ADK does not handle MCP according to specification.