Skip to content

feat(deps): update dependency googleapis/mcp-toolbox to v1.9.0 - #16

Open
renovate-bot wants to merge 1 commit into
gemini-cli-extensions:mainfrom
renovate-bot:renovate/googleapis-mcp-toolbox-1.x
Open

feat(deps): update dependency googleapis/mcp-toolbox to v1.9.0#16
renovate-bot wants to merge 1 commit into
gemini-cli-extensions:mainfrom
renovate-bot:renovate/googleapis-mcp-toolbox-1.x

Conversation

@renovate-bot

@renovate-bot renovate-bot commented May 22, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
googleapis/mcp-toolbox minor 1.2.0 → 1.9.0

Release Notes

googleapis/mcp-toolbox (googleapis/mcp-toolbox)

v1.9.0

Compare Source

Features
  • groups: Add ttlMs and cacheScope customization to config (#​3805) (a5d4947)
  • migrate: Convert toolset to group kind during migration (#​3704) (0adeaa5)
  • server/mcp: Introduce generic client extension registry (#​3723) (016245c)
  • skill: Add review-prs skill for mcp-toolbox (#​3743) (5b7bacc)
  • source/bigquery: Add apiEndpoint field to override BigQuery API host (#​3437) (4da1600)
  • source/databaseinsights: Add databaseinsights source (#​3461) (3b9615d)
  • sources/spanner: Rename execute_sql_dql to execute_sql_readonly (#​3776) (cf5a0c8)
  • tools/bigtable: Add admin lifecycle and listing tools (#​3596) (801d589)
  • tools/bigtable: Bigtable-list-schemas MCP tool (#​3683) (9228c61)
  • tools/databaseinsights: Add Advanced Query Insights tools for AlloyDB (#​3722) (74d18ae)
  • tools/looker: Add additional tools to allow dashboards to be modified, and their layouts altered. (#​3597) (b2b80fb)
  • tools: Add cloud-sql-connect-gce for pg, mysql, mssql (#​3740) (ca58fa4)
Bug Fixes
  • auth/mcp: Derive PRM URL from Toolbox URL (#​3765) (aa30842)
  • config: Ignore environment variables in YAML comments (#​3807) (79aa732), refs #​3793
  • mcp: Return Tool execution error for invalid input param (#​3799) (8120197)
  • prebuilt/cloud-storage: Declare tool collections as groups (#​3764) (7d468be)
  • server/mcp: Disallow client overriding URL bound parameters (#​3798) (f15a9c7)
  • server: Avoid a nil-flusher panic in the SSE handler (#​3520) (947f42f)
  • tools/bigquery: Keep the provider error classification in bigquery-execute-sql (#​3738) (42570b8)
  • tools/looker: Scope the filters quoting rule to values in query description (#​3788) (78eb0b8)
  • util: Convert exponent-form JSON numbers in ConvertNumbers (#​3730) (e9713ee)

v1.8.0

Compare Source

Features
  • Add groups support (#​3605) (e75ec3b)
  • prebuilt: Migrate skills-repo toolsets to kind: group with descriptions (#​3595) (b895b36)
  • server: Add /healthz endpoint for container health checks (#​3060) (d5aefbc)
  • skills: Add --group flag to generate a skill from one group (#​3585) (c1abd4f)
  • skills: Default --name to --group, --toolset, or single --prebuilt name (#​3586) (2b33b08)
  • skills: Make description optional during skills gen (#​3584) (d0a8f14)
  • tool/looker: Add get_field_value_suggestions tool (#​3696) (3debe81)
  • tools/dataplex-update-data-product-aspects: Add dataplex-update-data-product-aspects tool (#​3607) (f940937)
  • Update draft specs to 2026-07-28 (#​3699) (cf128ff)
Bug Fixes
  • Re-add name validation to tools name (#​3654) (944f6ce)
  • Re-add tool validation during startup (#​3705) (25ce953)
  • server: Sort default toolset alphabetically for stable ordering (#​3539) (e5da24c)
  • source/cloud-sql-admin: Validate source instance for backup-run restore (#​3555) (3ebe500)
  • source/dataplex: Cleanup Dataplex Data Product resources that may have leaked due to previously aborted tests (#​3627) (3fb5a3f)
  • source/http: Block CGNAT 100.64.0.0/10 in default SSRF guard (#​3625) (a0f36f4)
  • tools/looker: Enhance looker-run-dashboard to handle result maker structures and merge queries (#​3698) (7666bc0)
  • tools/looker: Log request/response traces at debug, not error (#​3552) (c3ad445)

v1.7.0

Compare Source

Features
  • Add quotaProject support for BigQuery and Looker conversational analytics (#​2610) (f3e7ca9)
  • arcadedb: Add arcadedb source and tools (#​2961) (351de00)
  • cmd/internal,docs: Add warning log that prebuilt tools are for developer use (#​3451) (8cffcef)
  • source/postgres: Add optional connectTimeout (#​3620) (b574b07)
  • tool/clickhouse-sql: Add native vector embedding support (#​3229) (6cbe1c2)
  • tool/dataplex-update-data-product,tool/dataplex-create-data-asset,tool/dataplex-update-data-asset: Add update data product, create data asset, and update data asset tools for knowledge catalog source (#​3574) (721c204)
  • tools/dataplex-create-data-product: Add dataplex-create-data-product tool (#​3504) (5cee0d2)
  • tools/dataplex-get-data-asset: Add dataplex-get-data-asset tool (#​3503) (1ddfbe9)
Bug Fixes
  • parameters: Report the offending value in array/map type errors (#​3512) (4034d6f)
  • parameters: Return an error instead of panicking on a non-string type field (#​3516) (66a0d53)
  • source/looker: Dynamically resolve public host URL (#​3603) (0428afd)
  • tool/looker-run-dashboard: Add support for SQL Runner query tiles (#​3594) (0975d0a)

v1.6.0

Compare Source

Features
  • Support MCP 2026 draft specs (#​3544) (d12eaa8)
  • release: Add digital signature to Toolbox binaries (#​3528) (3f0f0af)
  • tool/cloud-storage: Configure object operation parameters (#​3529) (d6dc5fe)
  • tool/cloud-storage: Support configurable parameters (#​3478) (bc2de2a)
  • tools/dataplex-list-data-products: Add dataplex-list-data-products tool (#​3337) (6dd669a)
  • tools/dataplex-get-data-product: Add dataplex-get-data-product tool (#​3499) (7ea7a09)
  • tools/dataplex-list-data-assets: Add dataplex-list-data-assets tool (#​3500) (182f933)
  • tools/looker: Support complex filter_expression parameter in queries (#​3494) (997fb8c)
  • tools/looker: Support dynamic_fields parameter in queries (#​3507) (cd22b89)
Bug Fixes
  • tools/gda: Support mTLS and GOOGLE_API_USE_MTLS_ENDPOINT for GDA client (#​3460) (cc2a61e)
  • tools/looker-conversational-analytics: Validate explore_references shape instead of panicking (#​3531) (b67419d)
  • tool/looker-create-view-from-table: Correct Looker API payload structure (#​3515) (18c539c)

v1.5.0

Compare Source

Features
  • auth/google: Require audience or clientId for mcpEnabled (#​3450) (59f7b6e)
  • Enable per source level flags for sql commenter (#​3465) (ecce6b7)
  • mcp: Add URL parameter binding for HTTP transport (#​3112) (0cc7b37)
  • scylladb: Adding support for ScyllaDB source and tool (#​3119) (2dada83)
  • server: Add support for toolset filtering in prebuilt CLI flag (#​3245) (7cc4f65)
  • skills: Generate skills offline without live source connections (#​3388) (4c860b6)
  • skills: Tolerate missing env vars during offline skills-generate (#​3399) (ea5d3e5)
  • source/cloud-storage: Restrict bucket and local path access (#​3454) (2c3ca5d)
  • tools/bigquery: Add per tool query label in BigQuery jobs (#​1975) (3f6a49f)
  • tools/dataplex: Add tools to support metadata enrichment workflow (#​3270) (05289aa)
  • tools/mysql: Add show-query-stats and list-all-locks tools for MySQL and Cloud SQL MySQL source (#​2954) (a9693bd)
  • tools: Decouple tool initialization from sources (#​3355) (32a24e3)
Bug Fixes
  • auth/dataplex: Fix failing source with service account credentials (#​3369) (ba4deef)
  • bigquery: Wire maximumBytesBilled into prebuilt config (#​3385) (4abbf6e)
  • Bound MCP HTTP body size (#​3216) (d4f4342)
  • config: Add doc/line context to parse errors (#​2957) (4b097da)
  • Escape delimiter characters in applyEscape to prevent SQL injection (#​2811) (932519a)
  • npm: Source binary version from cmd/version.txt (#​3417) (6ffbdec)
  • prebuilt/alloydb-omni: Require password env var explicitly (#​3398) (fcbe3e7)
  • server: Fail if MCP auth is enabled together with enable-api (#​3435) (a6ff910)
  • server: Return errors instead of panicking in InitializeConfigs (#​3397) (f48b01d)
  • source/cloudhealthcare: Validate pageURL parameter to prevent SSRF (#​3453) (9abf47d)
  • source/dataplex,source/datalineage: Specify cloud-platform scope for default credentials (#​3376) (13e8c36)
  • source/http: Implement SSRF guard (#​3448) (24d7d29)
  • tool/bigquery-execute-sql: Prevent dataset restriction bypass (#​3452) (ca6d5e3)
  • tool/mysql-get-query-plan: Prevent query execution bypass and statement injection (#​3235) (7ed1e7b)
  • tool/spanner-sql,tool/spanner-execute-sql: Use read-only annotations when readOnly is set (#​3338) (8bde0ec)

v1.4.0

Compare Source

Features
  • ci: Add support for windows/arm64 binary distribution (#​3231) (10abf3b)
  • datalineage: Add Data Lineage integration (#​3285) (19353c3)
  • server: Ignore unknown tools at startup with --ignore-unknown-tools flag (#​3353) (5f0304f)
  • tools/cloudsqlpg: Add remaining vector assist tools for Cloud SQL Postgres (#​3203) (b514cbd)
  • tools/spanner-search-catalog: Implement search_catalog tool (#​3140) (defc086)
Bug Fixes
  • auth/generic: Enforce issuer presence in opaque token validation (#​3360) (1d8df0d)
  • auth: Separate Google and Generic MCP OAuth verification (#​3341) (dfd66ee)
  • mcp: Support annotations and metadata within Tools to earlier MCP schemas (#​3300) (9a88c72)
  • oracle: Remove trailing semicolons from prebuilt tools (#​3215) (fcad02d)
  • server/auth: Centralize tool scopes validation (#​3335) (adce4ab)
  • server: Return null id for batch request rejection (#​3333) (0b18d58)
  • source/dataplex: Limit search results to pageSize (#​3323) (905c1f6), closes #​3308
  • telemetry: Allow GCP project override (#​2960) (3c83ba5)
  • tool/bigquery: Prevent allowedDatasets bypass in forecast query (#​3324) (45df461)
  • tool/clickhouse: Handle ignored ProcessParameters error (#​3340) (ddfd887)
  • tools/clickhouse,tools/bigquery: Validate identifier parameters to prevent injection (#​3219) (2f45f75)
  • tools/looker: Escape filter values for unquoted parameters (#​3289) (1711156)

v1.3.0

Compare Source

Features
  • auth: Implement MCP auth tool-level scopes validation (#​3049) (c528985)
  • looker: Propagate client IP from incoming MCP requests to downstream SDK calls (#​3253) (75da6c2)
  • Setup SQLCommenter and allow client metadata (#​3064) (9f1f9b3)
  • tool/cloudsqladmin: Add cloud-sql-admin-execute-sql-many and cloud-sql-admin-sql-many (#​3083) (ef300a8)
Bug Fixes
  • auth/generic: Fix generic auth expiration field and integration with authRequired (#​3251) (f4d16c0)
  • Enforce toolset/promptset boundary on tools/call and prompts/get (#​3036) (c739b80)
  • tools/http: Prevent path traversal and base path scope escape (#​3218) (80a6602)
  • tools/looker: Return a 401 error to MCP client when Looker returns a 401 (#​3233) (4f409a3)
  • tools/looker: Strip wrapping quotes from filter values for unquoted parameters (#​3273) (1e3de96)
  • tools: Initialize query result slices to empty array (#​3250) (60ddf48)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

BEGIN_COMMIT_OVERRIDE
feat: groups: Add ttlMs and cacheScope customization to config (mcp-toolbox#​3805) (a5d4947)
feat: migrate: Convert toolset to group kind during migration (mcp-toolbox#​3704) (0adeaa5)
feat: server/mcp: Introduce generic client extension registry (mcp-toolbox#​3723) (016245c)
feat: skill: Add review-prs skill for mcp-toolbox (mcp-toolbox#​3743) (5b7bacc)
feat: tools: Add cloud-sql-connect-gce for pg, mysql, mssql (mcp-toolbox#​3740) (ca58fa4)
fix: auth/mcp: Derive PRM URL from Toolbox URL (mcp-toolbox#​3765) (aa30842)
fix: config: Ignore environment variables in YAML comments (mcp-toolbox#​3807) (79aa732), refs mcp-toolbox#​3793
fix: mcp: Return Tool execution error for invalid input param (mcp-toolbox#​3799) (8120197)
fix: prebuilt/cloud-storage: Declare tool collections as groups (mcp-toolbox#​3764) (7d468be)
fix: server/mcp: Disallow client overriding URL bound parameters (mcp-toolbox#​3798) (f15a9c7)
fix: server: Avoid a nil-flusher panic in the SSE handler (mcp-toolbox#​3520) (947f42f)
fix: util: Convert exponent-form JSON numbers in ConvertNumbers (mcp-toolbox#​3730) (e9713ee)
feat: Add groups support (mcp-toolbox#​3605) (e75ec3b)
feat: prebuilt: Migrate skills-repo toolsets to kind: group with descriptions (mcp-toolbox#​3595) (b895b36)
feat: server: Add /healthz endpoint for container health checks (mcp-toolbox#​3060) (d5aefbc)
feat: skills: Add --group flag to generate a skill from one group (mcp-toolbox#​3585) (c1abd4f)
feat: skills: Default --name to --group, --toolset, or single --prebuilt name (mcp-toolbox#​3586) (2b33b08)
feat: skills: Make description optional during skills gen (mcp-toolbox#​3584) (d0a8f14)
feat: Update draft specs to 2026-07-28 (mcp-toolbox#​3699) (cf128ff)
fix: Re-add name validation to tools name (mcp-toolbox#​3654) (944f6ce)
fix: Re-add tool validation during startup (mcp-toolbox#​3705) (25ce953)
fix: server: Sort default toolset alphabetically for stable ordering (mcp-toolbox#​3539) (e5da24c)
feat: Add quotaProject support for BigQuery and Looker conversational analytics (mcp-toolbox#​2610) (f3e7ca9)
feat: arcadedb: Add arcadedb source and tools (mcp-toolbox#​2961) (351de00)
feat: cmd/internal,docs: Add warning log that prebuilt tools are for developer use (mcp-toolbox#​3451) (8cffcef)
fix: parameters: Report the offending value in array/map type errors (mcp-toolbox#​3512) (4034d6f)
fix: parameters: Return an error instead of panicking on a non-string type field (mcp-toolbox#​3516) (66a0d53)
feat: Support MCP 2026 draft specs (mcp-toolbox#​3544) (d12eaa8)
feat: release: Add digital signature to Toolbox binaries (mcp-toolbox#​3528) (3f0f0af)
feat: auth/google: Require audience or clientId for mcpEnabled (mcp-toolbox#​3450) (59f7b6e)
feat: Enable per source level flags for sql commenter (mcp-toolbox#​3465) (ecce6b7)
feat: mcp: Add URL parameter binding for HTTP transport (mcp-toolbox#​3112) (0cc7b37)
feat: scylladb: Adding support for ScyllaDB source and tool (mcp-toolbox#​3119) (2dada83)
feat: server: Add support for toolset filtering in prebuilt CLI flag (mcp-toolbox#​3245) (7cc4f65)
feat: skills: Generate skills offline without live source connections (mcp-toolbox#​3388) (4c860b6)
feat: skills: Tolerate missing env vars during offline skills-generate (mcp-toolbox#​3399) (ea5d3e5)
feat: tools: Decouple tool initialization from sources (mcp-toolbox#​3355) (32a24e3)
fix: auth/dataplex: Fix failing source with service account credentials (mcp-toolbox#​3369) (ba4deef)
fix: bigquery: Wire maximumBytesBilled into prebuilt config (mcp-toolbox#​3385) (4abbf6e)
fix: Bound MCP HTTP body size (mcp-toolbox#​3216) (d4f4342)
fix: config: Add doc/line context to parse errors (mcp-toolbox#​2957) (4b097da)
fix: Escape delimiter characters in applyEscape to prevent SQL injection (mcp-toolbox#​2811) (932519a)
fix: npm: Source binary version from cmd/version.txt (mcp-toolbox#​3417) (6ffbdec)
fix: prebuilt/alloydb-omni: Require password env var explicitly (mcp-toolbox#​3398) (fcbe3e7)
fix: server: Fail if MCP auth is enabled together with enable-api (mcp-toolbox#​3435) (a6ff910)
fix: server: Return errors instead of panicking in InitializeConfigs (mcp-toolbox#​3397) (f48b01d)
feat: ci: Add support for windows/arm64 binary distribution (mcp-toolbox#​3231) (10abf3b)
feat: datalineage: Add Data Lineage integration (mcp-toolbox#​3285) (19353c3)
feat: server: Ignore unknown tools at startup with --ignore-unknown-tools flag (mcp-toolbox#​3353) (5f0304f)
fix: auth/generic: Enforce issuer presence in opaque token validation (mcp-toolbox#​3360) (1d8df0d)
fix: auth: Separate Google and Generic MCP OAuth verification (mcp-toolbox#​3341) (dfd66ee)
fix: mcp: Support annotations and metadata within Tools to earlier MCP schemas (mcp-toolbox#​3300) (9a88c72)
fix: oracle: Remove trailing semicolons from prebuilt tools (mcp-toolbox#​3215) (fcad02d)
fix: server/auth: Centralize tool scopes validation (mcp-toolbox#​3335) (adce4ab)
fix: server: Return null id for batch request rejection (mcp-toolbox#​3333) (0b18d58)
fix: telemetry: Allow GCP project override (mcp-toolbox#​2960) (3c83ba5)
feat: auth: Implement MCP auth tool-level scopes validation (mcp-toolbox#​3049) (c528985)
feat: looker: Propagate client IP from incoming MCP requests to downstream SDK calls (mcp-toolbox#​3253) (75da6c2)
feat: Setup SQLCommenter and allow client metadata (mcp-toolbox#​3064) (9f1f9b3)
fix: auth/generic: Fix generic auth expiration field and integration with authRequired (mcp-toolbox#​3251) (f4d16c0)
fix: tools: Initialize query result slices to empty array (mcp-toolbox#​3250) (60ddf48)
END_COMMIT_OVERRIDE

@github-actions
github-actions Bot requested a review from averikitsch May 22, 2026 00:47
@renovate-bot renovate-bot changed the title feat(deps): update dependency googleapis/mcp-toolbox to v1.3.0 feat(deps): update dependency googleapis/mcp-toolbox to v1.4.0 Jun 5, 2026
@renovate-bot
renovate-bot force-pushed the renovate/googleapis-mcp-toolbox-1.x branch from 01e9b1c to 6f7f9af Compare June 5, 2026 01:10
@averikitsch averikitsch added the priority: p2 Moderately-important priority. Fix may not be included in next release. label Jun 9, 2026
@renovate-bot renovate-bot changed the title feat(deps): update dependency googleapis/mcp-toolbox to v1.4.0 feat(deps): update dependency googleapis/mcp-toolbox to v1.5.0 Jun 19, 2026
@renovate-bot
renovate-bot force-pushed the renovate/googleapis-mcp-toolbox-1.x branch from 6f7f9af to e57c42d Compare June 19, 2026 05:04
@renovate-bot renovate-bot changed the title feat(deps): update dependency googleapis/mcp-toolbox to v1.5.0 feat(deps): update dependency googleapis/mcp-toolbox to v1.6.0 Jul 2, 2026
@renovate-bot
renovate-bot force-pushed the renovate/googleapis-mcp-toolbox-1.x branch from e57c42d to 5a4ea34 Compare July 2, 2026 05:39
@renovate-bot
renovate-bot force-pushed the renovate/googleapis-mcp-toolbox-1.x branch from 5a4ea34 to 789c424 Compare July 17, 2026 10:07
@renovate-bot renovate-bot changed the title feat(deps): update dependency googleapis/mcp-toolbox to v1.6.0 feat(deps): update dependency googleapis/mcp-toolbox to v1.7.0 Jul 17, 2026
@renovate-bot renovate-bot changed the title feat(deps): update dependency googleapis/mcp-toolbox to v1.7.0 feat(deps): update dependency googleapis/mcp-toolbox to v1.8.0 Jul 28, 2026
@renovate-bot
renovate-bot force-pushed the renovate/googleapis-mcp-toolbox-1.x branch from 789c424 to 67ab2f8 Compare July 28, 2026 03:08
@renovate-bot renovate-bot changed the title feat(deps): update dependency googleapis/mcp-toolbox to v1.8.0 feat(deps): update dependency googleapis/mcp-toolbox to v1.9.0 Aug 14, 2026
@renovate-bot
renovate-bot force-pushed the renovate/googleapis-mcp-toolbox-1.x branch from 67ab2f8 to 3a52d9d Compare August 14, 2026 04:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@averikitsch averikitsch Awaiting requested review from averikitsch

At least 1 approving review is required to merge this pull request.

Assignees

@averikitsch averikitsch

Labels

priority: p2 Moderately-important priority. Fix may not be included in next release.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@renovate-bot @averikitsch