I wanted keyless auth for this MCP server, but it didn't work with Workload Identity Federation from AWS (no browser available, and the WIF config's "type": "external_account" gets rejected by service_account.Credentials.from_service_account_file()).
I patched get_gsc_service() to add a google.auth.default(scopes=SCOPES) fallback — this also makes it work keylessly on GCE/Cloud Run/GKE via the metadata server, not just WIF. Verified locally: fails before the patch, works after (real sites().list() data returned).
Happy to open a PR if useful — small, backward-compatible addition, existing OAuth/service-account paths untouched.
I wanted keyless auth for this MCP server, but it didn't work with Workload Identity Federation from AWS (no browser available, and the WIF config's
"type": "external_account"gets rejected byservice_account.Credentials.from_service_account_file()).I patched
get_gsc_service()to add agoogle.auth.default(scopes=SCOPES)fallback — this also makes it work keylessly on GCE/Cloud Run/GKE via the metadata server, not just WIF. Verified locally: fails before the patch, works after (realsites().list()data returned).Happy to open a PR if useful — small, backward-compatible addition, existing OAuth/service-account paths untouched.