diff --git a/internal/server/api.go b/internal/server/api.go
index 03e0433b83..8c8cafc073 100644
--- a/internal/server/api.go
+++ b/internal/server/api.go
@@ -278,8 +278,9 @@ func toolInvokeHandler(s *Server, w http.ResponseWriter, r *http.Request) {
 			case util.CategoryAgent:
 				// Agent Errors -> 200 OK
 				s.logger.DebugContext(ctx, fmt.Sprintf("Tool invocation agent error: %v", err))
-				_ = render.Render(w, r, newErrResponse(err, http.StatusOK))
-				return
+				res = map[string]string{
+					"error": err.Error(),
+				}
 
 			case util.CategoryServer:
 				// Server Errors -> Check the specific code inside
diff --git a/internal/tools/cloudsql/cloudsqlcreateusers/cloudsqlcreateusers.go b/internal/tools/cloudsql/cloudsqlcreateusers/cloudsqlcreateusers.go
index 4beb5e68a2..101ea45f96 100644
--- a/internal/tools/cloudsql/cloudsqlcreateusers/cloudsqlcreateusers.go
+++ b/internal/tools/cloudsql/cloudsqlcreateusers/cloudsqlcreateusers.go
@@ -144,6 +144,10 @@ func (t Tool) Invoke(ctx context.Context, resourceMgr tools.SourceProvider, para
 
 	iamUser, _ := paramsMap["iamUser"].(bool)
 	password, _ := paramsMap["password"].(string)
+	if !iamUser && password == "" {
+		return nil, util.NewAgentError("missing 'password' parameter for non-IAM user", nil)
+	}
+
 	resp, err := source.CreateUsers(ctx, project, instance, name, password, iamUser, string(accessToken))
 	if err != nil {
 		return nil, util.ProcessGcpError(err)
diff --git a/tests/cloudsql/cloud_sql_create_users_test.go b/tests/cloudsql/cloud_sql_create_users_test.go
index 77978c4506..e4b8bd0b2c 100644
--- a/tests/cloudsql/cloud_sql_create_users_test.go
+++ b/tests/cloudsql/cloud_sql_create_users_test.go
@@ -167,11 +167,10 @@ func TestCreateUsersToolEndpoints(t *testing.T) {
 			want:     `{"name":"op2","status":"PENDING"}`,
 		},
 		{
-			name:        "missing password for built-in user",
-			toolName:    "create-user",
-			body:        `{"project": "p1", "instance": "i1", "name": "test-user", "iamUser": false}`,
-			expectError: true,
-			errorStatus: http.StatusBadRequest,
+			name:     "missing password for built-in user",
+			toolName: "create-user",
+			body:     `{"project": "p1", "instance": "i1", "name": "test-user", "iamUser": false}`,
+			want:     `{"error":"missing 'password' parameter for non-IAM user"}`,
 		},
 	}
 
diff --git a/tests/cloudsql/cloud_sql_restore_backup_test.go b/tests/cloudsql/cloud_sql_restore_backup_test.go
index 970ad16164..c0bc4f71ca 100644
--- a/tests/cloudsql/cloud_sql_restore_backup_test.go
+++ b/tests/cloudsql/cloud_sql_restore_backup_test.go
@@ -95,7 +95,11 @@ func (h *masterRestoreBackupHandler) ServeHTTP(w http.ResponseWriter, r *http.Re
 		response = map[string]any{"name": "op1", "status": "PENDING"}
 		statusCode = http.StatusOK
 	default:
-		http.Error(w, fmt.Sprintf("unhandled restore request body: %v", body), http.StatusInternalServerError)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]string{
+			"error": "source project and instance are required when restoring via backup ID",
+		})
 		return
 	}
 
@@ -178,11 +182,10 @@ func TestRestoreBackupToolEndpoints(t *testing.T) {
 			want:     `{"name":"op1","status":"PENDING"}`,
 		},
 		{
-			name:        "missing source instance info for standard backup",
-			toolName:    "restore-backup",
-			body:        `{"target_project": "p1", "target_instance": "instance-project-level", "backup_id": "12345"}`,
-			expectError: true,
-			errorStatus: http.StatusBadRequest,
+			name:     "missing source instance info for standard backup",
+			toolName: "restore-backup",
+			body:     `{"target_project": "p1", "target_instance": "instance-project-level", "backup_id": "12345"}`,
+			want:     `{"error":"error processing GCP request: source project and instance are required when restoring via backup ID"}`,
 		},
 		{
 			name:        "missing backup identifier",