Mend Renovate 38d127a354 chore(deps): update dependency langchain to v1.2.3 [security] (#2248)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[langchain](https://redirect.github.com/langchain-ai/langchainjs/tree/main/libs/langchain/)
([source](https://redirect.github.com/langchain-ai/langchainjs)) |
[`1.0.2` →
`1.2.3`](https://renovatebot.com/diffs/npm/langchain/1.0.2/1.2.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/langchain/1.2.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/langchain/1.0.2/1.2.3?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-68665](https://redirect.github.com/langchain-ai/langchainjs/security/advisories/GHSA-r399-636x-v7f6)

## Context

A serialization injection vulnerability exists in LangChain JS's
`toJSON()` method (and subsequently when string-ifying objects using
`JSON.stringify()`. The method did not escape objects with `'lc'` keys
when serializing free-form data in kwargs. The `'lc'` key is used
internally by LangChain to mark serialized objects. When user-controlled
data contains this key structure, it is treated as a legitimate
LangChain object during deserialization rather than plain user data.

### Attack surface

The core vulnerability was in `Serializable.toJSON()`: this method
failed to escape user-controlled objects containing `'lc'` keys within
kwargs (e.g., `additional_kwargs`, `metadata`, `response_metadata`).
When this unescaped data was later deserialized via `load()`, the
injected structures were treated as legitimate LangChain objects rather
than plain user data.

This escaping bug enabled several attack vectors:

1. **Injection via user data**: Malicious LangChain object structures
could be injected through user-controlled fields like `metadata`,
`additional_kwargs`, or `response_metadata`
2. **Secret extraction**: Injected secret structures could extract
environment variables when `secretsFromEnv` was enabled (which had no
explicit default, effectively defaulting to `true` behavior)
3. **Class instantiation via import maps**: Injected constructor
structures could instantiate any class available in the provided import
maps with attacker-controlled parameters

**Note on import maps:** Classes must be explicitly included in import
maps to be instantiatable. The core import map includes standard types
(messages, prompts, documents), and users can extend this via
`importMap` and `optionalImportsMap` options. This architecture
naturally limits the attack surface—an `allowedObjects` parameter is not
necessary because users control which classes are available through the
import maps they provide.

**Security hardening:** This patch fixes the escaping bug in `toJSON()`
and introduces new restrictive defaults in `load()`: `secretsFromEnv`
now explicitly defaults to `false`, and a `maxDepth` parameter protects
against DoS via deeply nested structures. JSDoc security warnings have
been added to all import map options.

## Who is affected?

Applications are vulnerable if they:

1. **Serialize untrusted data via `JSON.stringify()` on Serializable
objects, then deserialize with `load()`** — Trusting your own
serialization output makes you vulnerable if user-controlled data (e.g.,
from LLM responses, metadata fields, or user inputs) contains `'lc'` key
structures.
2. **Deserialize untrusted data with `load()`** — Directly deserializing
untrusted data that may contain injected `'lc'` structures.
3. **Use LangGraph checkpoints** — Checkpoint
serialization/deserialization paths may be affected.

The most common attack vector is through **LLM response fields** like
`additional_kwargs` or `response_metadata`, which can be controlled via
prompt injection and then serialized/deserialized in streaming
operations.

## Impact

Attackers who control serialized data can extract environment variable
secrets by injecting `{"lc": 1, "type": "secret", "id": ["ENV_VAR"]}` to
load environment variables during deserialization (when `secretsFromEnv:
true`). They can also instantiate classes with controlled parameters by
injecting constructor structures to instantiate any class within the
provided import maps with attacker-controlled parameters, potentially
triggering side effects such as network calls or file operations.

Key severity factors:

- Affects the serialization path—applications trusting their own
serialization output are vulnerable
- Enables secret extraction when combined with `secretsFromEnv: true`
- LLM responses in `additional_kwargs` can be controlled via prompt
injection

## Exploit example

```typescript
import { load } from "@​langchain/core/load";

// Attacker injects secret structure into user-controlled data
const attackerPayload = JSON.stringify({
  user_data: {
    lc: 1,
    type: "secret",
    id: ["OPENAI_API_KEY"],
  },
});

process.env.OPENAI_API_KEY = "sk-secret-key-12345";

// With secretsFromEnv: true, the secret is extracted
const deserialized = await load(attackerPayload, { secretsFromEnv: true });

console.log(deserialized.user_data); // "sk-secret-key-12345" - SECRET LEAKED!
```

## Security hardening changes

This patch introduces the following changes to `load()`:

1. **`secretsFromEnv` default changed to `false`**: Disables automatic
secret loading from environment variables. Secrets not found in
`secretsMap` now throw an error instead of being loaded from
`process.env`. This fail-safe behavior ensures missing secrets are
caught immediately rather than silently continuing with `null`.
2. **New `maxDepth` parameter** (defaults to `50`): Protects against
denial-of-service attacks via deeply nested JSON structures that could
cause stack overflow.
3. **Escape mechanism in `toJSON()`**: User-controlled objects
containing `'lc'` keys are now wrapped in `{"__lc_escaped__": {...}}`
during serialization and unwrapped as plain data during deserialization.
4. **JSDoc security warnings**: All import map options (`importMap`,
`optionalImportsMap`, `optionalImportEntrypoints`) now include security
warnings about never populating them from user input.

## Migration guide

### No changes needed for most users

If you're deserializing standard LangChain types (messages, documents,
prompts) using the core import map, your code will work without changes:

```typescript
import { load } from "@​langchain/core/load";

// Works with default settings
const obj = await load(serializedData);
```

### For secrets from environment

`secretsFromEnv` now defaults to `false`, and missing secrets throw an
error. If you need to load secrets:

```typescript
import { load } from "@​langchain/core/load";

// Provide secrets explicitly (recommended)
const obj = await load(serializedData, {
  secretsMap: { OPENAI_API_KEY: process.env.OPENAI_API_KEY },
});

// Or explicitly opt-in to load from env (only use with trusted data)
const obj = await load(serializedData, { secretsFromEnv: true });
```

> **Warning:** Only enable `secretsFromEnv` if you trust the serialized
data. Untrusted data could extract any environment variable.

> **Note:** If a secret reference is encountered but not found in
`secretsMap` (and `secretsFromEnv` is `false` or the secret is not in
the environment), an error is thrown. This fail-safe behavior ensures
you're aware of missing secrets rather than silently receiving `null`
values.

### For deeply nested structures

If you have legitimate deeply nested data that exceeds the default depth
limit of 50:

```typescript
import { load } from "@​langchain/core/load";

const obj = await load(serializedData, { maxDepth: 100 });
```

### For custom import maps

If you provide custom import maps, ensure they only contain trusted
modules:

```typescript
import { load } from "@​langchain/core/load";
import * as myModule from "./my-trusted-module";

// GOOD - explicitly include only trusted modules
const obj = await load(serializedData, {
  importMap: { my_module: myModule },
});

// BAD - never populate from user input
const obj = await load(serializedData, {
  importMap: userProvidedImports, // DANGEROUS!
});
```

---

### Release Notes

<details>
<summary>langchain-ai/langchainjs (langchain)</summary>

###
[`v1.2.3`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.2.3)

##### Patch Changes

- Updated dependencies
\[[`0bade90`](0bade90ed4),
[`6c40d00`](6c40d00e92)]:
-
[@&#8203;langchain/core](https://redirect.github.com/langchain/core)@&#8203;1.1.4

###
[`v1.2.2`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.2.2)

##### Patch Changes

-
[#&#8203;9520](https://redirect.github.com/langchain-ai/langchainjs/pull/9520)
[`cc022b0`](cc022b0aab)
Thanks [@&#8203;yukukotani](https://redirect.github.com/yukukotani)! -
Includes cache creation/read tokens in input\_tokens of usage metadata

- Updated dependencies
\[[`bd2c46e`](bd2c46e09e),
[`487378b`](487378bf14),
[`138e7fb`](138e7fb628)]:
-
[@&#8203;langchain/core](https://redirect.github.com/langchain/core)@&#8203;1.1.3

###
[`v1.2.1`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.2.1)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.2.0...langchain@1.2.1)

##### Patch Changes

- Updated dependencies
\[[`833f578`](833f57834d)]:
-
[@&#8203;langchain/core](https://redirect.github.com/langchain/core)@&#8203;1.1.2

###
[`v1.2.0`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.0)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.6...langchain@1.2.0)

##### Minor Changes

-
[#&#8203;9651](https://redirect.github.com/langchain-ai/langchainjs/pull/9651)
[`348c37c`](348c37c01a)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- feat(langchain): allow to set strict tag manually in providerStrategy
[#&#8203;9578](https://redirect.github.com/langchain-ai/langchainjs/issues/9578)

###
[`v1.1.6`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.1.6)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.5...langchain@1.1.6)

##### Patch Changes

-
[#&#8203;9586](https://redirect.github.com/langchain-ai/langchainjs/pull/9586)
[`bc8e90f`](bc8e90f4f7)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - patch
prompts created from runs fix

-
[#&#8203;9623](https://redirect.github.com/langchain-ai/langchainjs/pull/9623)
[`ade8b8a`](ade8b8af0b)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- fix(langchain): properly retrieve structured output from thinking
block

-
[#&#8203;9637](https://redirect.github.com/langchain-ai/langchainjs/pull/9637)
[`88bb788`](88bb7882fa)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- fix(langchain): Prevent functions from being accidentally assignable
to AgentMiddleware

-
[#&#8203;8964](https://redirect.github.com/langchain-ai/langchainjs/pull/8964)
[`38ff1b5`](38ff1b55d3)
Thanks [@&#8203;jnjacobson](https://redirect.github.com/jnjacobson)! -
add support for anyOf, allOf, oneOf in openapi conversion

-
[#&#8203;9640](https://redirect.github.com/langchain-ai/langchainjs/pull/9640)
[`aa8c4f8`](aa8c4f867a)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- fix(langchain): prevent summarization middleware from leaking
streaming events

-
[#&#8203;9648](https://redirect.github.com/langchain-ai/langchainjs/pull/9648)
[`29a8480`](29a8480799)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- fix(langchain): allow to set strict tag manually in providerStrategy
[#&#8203;9578](https://redirect.github.com/langchain-ai/langchainjs/issues/9578)

-
[#&#8203;9630](https://redirect.github.com/langchain-ai/langchainjs/pull/9630)
[`a2df2d4`](a2df2d422e)
Thanks [@&#8203;nephix](https://redirect.github.com/nephix)! -
fix(summary-middleware): use summaryPrefix or fall back to default
prefix

- Updated dependencies
\[[`005c729`](005c72903b),
[`ab78246`](ab78246275),
[`8cc81c7`](8cc81c7cee),
[`f32e499`](f32e4991d0),
[`a28d83d`](a28d83d49d),
[`2e5ad70`](2e5ad70d16),
[`e456c66`](e456c661aa),
[`1cfe603`](1cfe603e97)]:
-
[@&#8203;langchain/core](https://redirect.github.com/langchain/core)@&#8203;1.1.5

###
[`v1.1.5`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.1.5)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.4...langchain@1.1.5)

##### Patch Changes

- Updated dependencies
\[[`0bade90`](0bade90ed4),
[`6c40d00`](6c40d00e92)]:
-
[@&#8203;langchain/core](https://redirect.github.com/langchain/core)@&#8203;1.1.4

###
[`v1.1.4`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.4)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.3...langchain@1.1.4)

##### Patch Changes

-
[#&#8203;9575](https://redirect.github.com/langchain-ai/langchainjs/pull/9575)
[`0bade90`](0bade90ed4)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - bin p-retry

-
[#&#8203;9574](https://redirect.github.com/langchain-ai/langchainjs/pull/9574)
[`6c40d00`](6c40d00e92)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - Revert
"fix([@&#8203;langchain/core](https://redirect.github.com/langchain/core)):
update and bundle dependencies
([#&#8203;9534](https://redirect.github.com/langchain-ai/langchainjs/issues/9534))"

###
[`v1.1.3`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.3)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.2...langchain@1.1.3)

##### Patch Changes

-
[#&#8203;9534](https://redirect.github.com/langchain-ai/langchainjs/pull/9534)
[`bd2c46e`](bd2c46e09e)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
-
fix([@&#8203;langchain/core](https://redirect.github.com/langchain/core)):
update and bundle `p-retry`, `ansi-styles`, `camelcase` and `decamelize`
dependencies

-
[#&#8203;9544](https://redirect.github.com/langchain-ai/langchainjs/pull/9544)
[`487378b`](487378bf14)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - fix tool
chunk concat behavior
([#&#8203;9450](https://redirect.github.com/langchain-ai/langchainjs/issues/9450))

-
[#&#8203;9505](https://redirect.github.com/langchain-ai/langchainjs/pull/9505)
[`138e7fb`](138e7fb628)
Thanks [@&#8203;chosh-dev](https://redirect.github.com/chosh-dev)! -
feat: replace btoa with toBase64Url for encoding in drawMermaidImage

###
[`v1.1.2`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.2)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.1...langchain@1.1.2)

##### Patch Changes

-
[#&#8203;9511](https://redirect.github.com/langchain-ai/langchainjs/pull/9511)
[`833f578`](833f57834d)
Thanks [@&#8203;dqbd](https://redirect.github.com/dqbd)! - allow parsing
more partial JSON

###
[`v1.1.1`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.1)

##### Patch Changes

-
[#&#8203;9495](https://redirect.github.com/langchain-ai/langchainjs/pull/9495)
[`636b994`](636b99459b)
Thanks [@&#8203;gsriram24](https://redirect.github.com/gsriram24)! -
fix: use dynamic import for p-retry to support CommonJS environments

-
[#&#8203;9531](https://redirect.github.com/langchain-ai/langchainjs/pull/9531)
[`38f0162`](38f0162b7b)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - add
`extras` to tools

###
[`v1.1.0`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.1.0)

##### Minor Changes

-
[#&#8203;9424](https://redirect.github.com/langchain-ai/langchainjs/pull/9424)
[`f17b2c9`](f17b2c9db0)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - add support
for `betas` param

-
[#&#8203;9424](https://redirect.github.com/langchain-ai/langchainjs/pull/9424)
[`f17b2c9`](f17b2c9db0)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - add support
for native structured output

##### Patch Changes

-
[#&#8203;9424](https://redirect.github.com/langchain-ai/langchainjs/pull/9424)
[`f17b2c9`](f17b2c9db0)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - bump sdk
version

###
[`v1.0.6`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.0.6)

[Compare
Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.0.5...langchain@1.0.6)

##### Patch Changes

-
[#&#8203;9434](https://redirect.github.com/langchain-ai/langchainjs/pull/9434)
[`f7cfece`](f7cfecec29)
Thanks [@&#8203;deepansh946](https://redirect.github.com/deepansh946)! -
Updated error handling behaviour of AgentNode

###
[`v1.0.5`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.0.5)

##### Patch Changes

-
[#&#8203;9403](https://redirect.github.com/langchain-ai/langchainjs/pull/9403)
[`944bf56`](944bf56ff0)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- improvements to toolEmulator middleware

-
[#&#8203;9388](https://redirect.github.com/langchain-ai/langchainjs/pull/9388)
[`831168a`](831168a545)
Thanks [@&#8203;hntrl](https://redirect.github.com/hntrl)! - use
`profile.maxInputTokens` in summarization middleware

-
[#&#8203;9393](https://redirect.github.com/langchain-ai/langchainjs/pull/9393)
[`f1e2f9e`](f1e2f9eeb3)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- align context editing with summarization interface

-
[#&#8203;9427](https://redirect.github.com/langchain-ai/langchainjs/pull/9427)
[`bad7aea`](bad7aea86d)
Thanks [@&#8203;dqbd](https://redirect.github.com/dqbd)! -
fix(langchain): add tool call contents and tool call ID to improve token
count approximation

-
[#&#8203;9396](https://redirect.github.com/langchain-ai/langchainjs/pull/9396)
[`ed6b581`](ed6b581e52)
Thanks
[@&#8203;christian-bromann](https://redirect.github.com/christian-bromann)!
- rename exit behavior from throw to error

###
[`v1.0.4`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/community%401.0.4)

##### Patch Changes

-
[#&#8203;9326](https://redirect.github.com/langchain-ai/langchainjs/pull/9326)
[`3e0cab6`](3e0cab61b3)
Thanks [@&#8203;ayanyev](https://redirect.github.com/ayanyev)! - Milvus
vector store client: ignore auto-calculated fields in collection schema
during payload validation

- Updated dependencies
\[[`415cb0b`](415cb0bfd2),
[`a2ad61e`](a2ad61e787),
[`34c472d`](34c472d129)]:
-
[@&#8203;langchain/openai](https://redirect.github.com/langchain/openai)@&#8203;1.1.2
-
[@&#8203;langchain/classic](https://redirect.github.com/langchain/classic)@&#8203;1.0.4

###
[`v1.0.3`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/google-gauth%401.0.3)

##### Patch Changes

- Updated dependencies \[]:
-
[@&#8203;langchain/google-common](https://redirect.github.com/langchain/google-common)@&#8203;1.0.3

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/genai-toolbox).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42Ni4xNCIsInVwZGF0ZWRJblZlciI6IjQyLjY2LjE0IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
2025-12-30 12:01:21 -08:00
2025-12-19 01:44:04 +00:00
2024-06-07 21:29:24 +00:00
2025-05-20 21:50:26 +00:00

logo

MCP Toolbox for Databases

Docs Discord Medium Go Report Card

Note

MCP Toolbox for Databases is currently in beta, and may see breaking changes until the first stable release (v1.0).

MCP Toolbox for Databases is an open source MCP server for databases. It enables you to develop tools easier, faster, and more securely by handling the complexities such as connection pooling, authentication, and more.

This README provides a brief overview. For comprehensive details, see the full documentation.

Note

This solution was originally named “Gen AI Toolbox for Databases” as its initial development predated MCP, but was renamed to align with recently added MCP compatibility.

Table of Contents

Why Toolbox?

Toolbox helps you build Gen AI tools that let your agents access data in your database. Toolbox provides:

  • Simplified development: Integrate tools to your agent in less than 10 lines of code, reuse tools between multiple agents or frameworks, and deploy new versions of tools more easily.
  • Better performance: Best practices such as connection pooling, authentication, and more.
  • Enhanced security: Integrated auth for more secure access to your data
  • End-to-end observability: Out of the box metrics and tracing with built-in support for OpenTelemetry.

Supercharge Your Workflow with an AI Database Assistant

Stop context-switching and let your AI assistant become a true co-developer. By connecting your IDE to your databases with MCP Toolbox, you can delegate complex and time-consuming database tasks, allowing you to build faster and focus on what matters. This isn't just about code completion; it's about giving your AI the context it needs to handle the entire development lifecycle.

Heres how it will save you time:

  • Query in Plain English: Interact with your data using natural language right from your IDE. Ask complex questions like, "How many orders were delivered in 2024, and what items were in them?" without writing any SQL.
  • Automate Database Management: Simply describe your data needs, and let the AI assistant manage your database for you. It can handle generating queries, creating tables, adding indexes, and more.
  • Generate Context-Aware Code: Empower your AI assistant to generate application code and tests with a deep understanding of your real-time database schema. This accelerates the development cycle by ensuring the generated code is directly usable.
  • Slash Development Overhead: Radically reduce the time spent on manual setup and boilerplate. MCP Toolbox helps streamline lengthy database configurations, repetitive code, and error-prone schema migrations.

Learn how to connect your AI tools (IDEs) to Toolbox using MCP.

General Architecture

Toolbox sits between your application's orchestration framework and your database, providing a control plane that is used to modify, distribute, or invoke tools. It simplifies the management of your tools by providing you with a centralized location to store and update tools, allowing you to share tools between agents and applications and update those tools without necessarily redeploying your application.

architecture

Getting Started

(Non-production) Running Toolbox

You can run Toolbox directly with a configuration file:

npx @toolbox-sdk/server --tools-file tools.yaml

This runs the latest version of the toolbox server with your configuration file.

Note

This method should only be used for non-production use cases such as experimentation. For any production use-cases, please consider Installing the server and then running it.

Installing the server

For the latest version, check the releases page and use the following instructions for your OS and CPU architecture.

Binary

To install Toolbox as a binary:

Linux (AMD64)

To install Toolbox as a binary on Linux (AMD64):

# see releases page for other versions
export VERSION=0.24.0
curl -L -o toolbox https://storage.googleapis.com/genai-toolbox/v$VERSION/linux/amd64/toolbox
chmod +x toolbox
macOS (Apple Silicon)

To install Toolbox as a binary on macOS (Apple Silicon):

# see releases page for other versions
export VERSION=0.24.0
curl -L -o toolbox https://storage.googleapis.com/genai-toolbox/v$VERSION/darwin/arm64/toolbox
chmod +x toolbox
macOS (Intel)

To install Toolbox as a binary on macOS (Intel):

# see releases page for other versions
export VERSION=0.24.0
curl -L -o toolbox https://storage.googleapis.com/genai-toolbox/v$VERSION/darwin/amd64/toolbox
chmod +x toolbox
Windows (Command Prompt)

To install Toolbox as a binary on Windows (Command Prompt):

:: see releases page for other versions
set VERSION=0.24.0
curl -o toolbox.exe "https://storage.googleapis.com/genai-toolbox/v%VERSION%/windows/amd64/toolbox.exe"
Windows (PowerShell)

To install Toolbox as a binary on Windows (PowerShell):

# see releases page for other versions
$VERSION = "0.24.0"
curl.exe -o toolbox.exe "https://storage.googleapis.com/genai-toolbox/v$VERSION/windows/amd64/toolbox.exe"
Container image You can also install Toolbox as a container:
# see releases page for other versions
export VERSION=0.24.0
docker pull us-central1-docker.pkg.dev/database-toolbox/toolbox/toolbox:$VERSION
Homebrew

To install Toolbox using Homebrew on macOS or Linux:

brew install mcp-toolbox
Compile from source

To install from source, ensure you have the latest version of Go installed, and then run the following command:

go install github.com/googleapis/genai-toolbox@v0.24.0
Gemini CLI Extensions

To install Gemini CLI Extensions for MCP Toolbox, run the following command:

gemini extensions install https://github.com/gemini-cli-extensions/mcp-toolbox

Running the server

Configure a tools.yaml to define your tools, and then execute toolbox to start the server:

Binary

To run Toolbox from binary:

./toolbox --tools-file "tools.yaml"

ⓘ Note
Toolbox enables dynamic reloading by default. To disable, use the --disable-reload flag.

Container image

To run the server after pulling the container image:

export VERSION=0.11.0 # Use the version you pulled
docker run -p 5000:5000 \
-v $(pwd)/tools.yaml:/app/tools.yaml \
us-central1-docker.pkg.dev/database-toolbox/toolbox/toolbox:$VERSION \
--tools-file "/app/tools.yaml"

ⓘ Note
The -v flag mounts your local tools.yaml into the container, and -p maps the container's port 5000 to your host's port 5000.

Source

To run the server directly from source, navigate to the project root directory and run:

go run .

ⓘ Note
This command runs the project from source, and is more suitable for development and testing. It does not compile a binary into your $GOPATH. If you want to compile a binary instead, refer the Developer Documentation.

Homebrew

If you installed Toolbox using Homebrew, the toolbox binary is available in your system path. You can start the server with the same command:

toolbox --tools-file "tools.yaml"
NPM

To run Toolbox directly without manually downloading the binary (requires Node.js):

npx @toolbox-sdk/server --tools-file tools.yaml
Gemini CLI

Interact with your custom tools using natural language. Check gemini-cli-extensions/mcp-toolbox for more information.

You can use toolbox help for a full list of flags! To stop the server, send a terminate signal (ctrl+c on most platforms).

For more detailed documentation on deploying to different environments, check out the resources in the How-to section

Integrating your application

Once your server is up and running, you can load the tools into your application. See below the list of Client SDKs for using various frameworks:

Python (Github)
Core
  1. Install Toolbox Core SDK:

    pip install toolbox-core
    
  2. Load tools:

    from toolbox_core import ToolboxClient
    
    # update the url to point to your server
    async with ToolboxClient("http://127.0.0.1:5000") as client:
    
        # these tools can be passed to your application!
        tools = await client.load_toolset("toolset_name")
    

For more detailed instructions on using the Toolbox Core SDK, see the project's README.

LangChain / LangGraph
  1. Install Toolbox LangChain SDK:

    pip install toolbox-langchain
    
  2. Load tools:

    from toolbox_langchain import ToolboxClient
    
    # update the url to point to your server
    async with ToolboxClient("http://127.0.0.1:5000") as client:
    
        # these tools can be passed to your application!
        tools = client.load_toolset()
    

    For more detailed instructions on using the Toolbox LangChain SDK, see the project's README.

LlamaIndex
  1. Install Toolbox Llamaindex SDK:

    pip install toolbox-llamaindex
    
  2. Load tools:

    from toolbox_llamaindex import ToolboxClient
    
    # update the url to point to your server
    async with ToolboxClient("http://127.0.0.1:5000") as client:
    
        # these tools can be passed to your application!
        tools = client.load_toolset()
    

    For more detailed instructions on using the Toolbox Llamaindex SDK, see the project's README.

Javascript/Typescript (Github)
Core
  1. Install Toolbox Core SDK:

    npm install @toolbox-sdk/core
    
  2. Load tools:

    import { ToolboxClient } from '@toolbox-sdk/core';
    
    // update the url to point to your server
    const URL = 'http://127.0.0.1:5000';
    let client = new ToolboxClient(URL);
    
    // these tools can be passed to your application!
    const tools = await client.loadToolset('toolsetName');
    

    For more detailed instructions on using the Toolbox Core SDK, see the project's README.

LangChain / LangGraph
  1. Install Toolbox Core SDK:

    npm install @toolbox-sdk/core
    
  2. Load tools:

    import { ToolboxClient } from '@toolbox-sdk/core';
    
    // update the url to point to your server
    const URL = 'http://127.0.0.1:5000';
    let client = new ToolboxClient(URL);
    
    // these tools can be passed to your application!
    const toolboxTools = await client.loadToolset('toolsetName');
    
    // Define the basics of the tool: name, description, schema and core logic
    const getTool = (toolboxTool) => tool(currTool, {
        name: toolboxTool.getName(),
        description: toolboxTool.getDescription(),
        schema: toolboxTool.getParamSchema()
    });
    
    // Use these tools in your Langchain/Langraph applications
    const tools = toolboxTools.map(getTool);
    
Genkit
  1. Install Toolbox Core SDK:

    npm install @toolbox-sdk/core
    
  2. Load tools:

    import { ToolboxClient } from '@toolbox-sdk/core';
    import { genkit } from 'genkit';
    
    // Initialise genkit
    const ai = genkit({
        plugins: [
            googleAI({
                apiKey: process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY
            })
        ],
        model: googleAI.model('gemini-2.0-flash'),
    });
    
    // update the url to point to your server
    const URL = 'http://127.0.0.1:5000';
    let client = new ToolboxClient(URL);
    
    // these tools can be passed to your application!
    const toolboxTools = await client.loadToolset('toolsetName');
    
    // Define the basics of the tool: name, description, schema and core logic
    const getTool = (toolboxTool) => ai.defineTool({
        name: toolboxTool.getName(),
        description: toolboxTool.getDescription(),
        schema: toolboxTool.getParamSchema()
    }, toolboxTool)
    
    // Use these tools in your Genkit applications
    const tools = toolboxTools.map(getTool);
    
ADK
  1. Install Toolbox ADK SDK:

    npm install @toolbox-sdk/adk
    
  2. Load tools:

    import { ToolboxClient } from '@toolbox-sdk/adk';
    
    // update the url to point to your server
    const URL = 'http://127.0.0.1:5000';
    let client = new ToolboxClient(URL);
    
    // these tools can be passed to your application!
    const tools = await client.loadToolset('toolsetName');
    

    For more detailed instructions on using the Toolbox ADK SDK, see the project's README.

Go (Github)
Core
  1. Install Toolbox Go SDK:

    go get github.com/googleapis/mcp-toolbox-sdk-go
    
  2. Load tools:

    package main
    
    import (
      "github.com/googleapis/mcp-toolbox-sdk-go/core"
      "context"
    )
    
    func main() {
      // Make sure to add the error checks
      // update the url to point to your server
      URL := "http://127.0.0.1:5000";
      ctx := context.Background()
    
      client, err := core.NewToolboxClient(URL)
    
      // Framework agnostic tools
      tools, err := client.LoadToolset("toolsetName", ctx)
    }
    

    For more detailed instructions on using the Toolbox Go SDK, see the project's README.

LangChain Go
  1. Install Toolbox Go SDK:

    go get github.com/googleapis/mcp-toolbox-sdk-go
    
  2. Load tools:

    package main
    
    import (
      "context"
      "encoding/json"
    
      "github.com/googleapis/mcp-toolbox-sdk-go/core"
      "github.com/tmc/langchaingo/llms"
    )
    
    func main() {
      // Make sure to add the error checks
      // update the url to point to your server
      URL := "http://127.0.0.1:5000"
      ctx := context.Background()
    
      client, err := core.NewToolboxClient(URL)
    
      // Framework agnostic tool
      tool, err := client.LoadTool("toolName", ctx)
    
      // Fetch the tool's input schema
      inputschema, err := tool.InputSchema()
    
      var paramsSchema map[string]any
      _ = json.Unmarshal(inputschema, &paramsSchema)
    
      // Use this tool with LangChainGo
      langChainTool := llms.Tool{
        Type: "function",
        Function: &llms.FunctionDefinition{
          Name:        tool.Name(),
          Description: tool.Description(),
          Parameters:  paramsSchema,
        },
      }
    }
    
    
Genkit
  1. Install Toolbox Go SDK:

    go get github.com/googleapis/mcp-toolbox-sdk-go
    
  2. Load tools:

    package main
    import (
      "context"
      "log"
    
      "github.com/firebase/genkit/go/genkit"
      "github.com/googleapis/mcp-toolbox-sdk-go/core"
      "github.com/googleapis/mcp-toolbox-sdk-go/tbgenkit"
    )
    
    func main() {
      // Make sure to add the error checks
      // Update the url to point to your server
      URL := "http://127.0.0.1:5000"
      ctx := context.Background()
      g := genkit.Init(ctx)
    
      client, err := core.NewToolboxClient(URL)
    
      // Framework agnostic tool
      tool, err := client.LoadTool("toolName", ctx)
    
      // Convert the tool using the tbgenkit package
      // Use this tool with Genkit Go
      genkitTool, err := tbgenkit.ToGenkitTool(tool, g)
      if err != nil {
        log.Fatalf("Failed to convert tool: %v\n", err)
      }
      log.Printf("Successfully converted tool: %s", genkitTool.Name())
    }
    
Go GenAI
  1. Install Toolbox Go SDK:

    go get github.com/googleapis/mcp-toolbox-sdk-go
    
  2. Load tools:

    package main
    
    import (
      "context"
      "encoding/json"
    
      "github.com/googleapis/mcp-toolbox-sdk-go/core"
      "google.golang.org/genai"
    )
    
    func main() {
      // Make sure to add the error checks
      // Update the url to point to your server
      URL := "http://127.0.0.1:5000"
      ctx := context.Background()
    
      client, err := core.NewToolboxClient(URL)
    
      // Framework agnostic tool
      tool, err := client.LoadTool("toolName", ctx)
    
      // Fetch the tool's input schema
      inputschema, err := tool.InputSchema()
    
      var schema *genai.Schema
      _ = json.Unmarshal(inputschema, &schema)
    
      funcDeclaration := &genai.FunctionDeclaration{
        Name:        tool.Name(),
        Description: tool.Description(),
        Parameters:  schema,
      }
    
      // Use this tool with Go GenAI
      genAITool := &genai.Tool{
        FunctionDeclarations: []*genai.FunctionDeclaration{funcDeclaration},
      }
    }
    
OpenAI Go
  1. Install Toolbox Go SDK:

    go get github.com/googleapis/mcp-toolbox-sdk-go
    
  2. Load tools:

    package main
    
    import (
      "context"
      "encoding/json"
    
      "github.com/googleapis/mcp-toolbox-sdk-go/core"
      openai "github.com/openai/openai-go"
    )
    
    func main() {
      // Make sure to add the error checks
      // Update the url to point to your server
      URL := "http://127.0.0.1:5000"
      ctx := context.Background()
    
      client, err := core.NewToolboxClient(URL)
    
      // Framework agnostic tool
      tool, err := client.LoadTool("toolName", ctx)
    
      // Fetch the tool's input schema
      inputschema, err := tool.InputSchema()
    
      var paramsSchema openai.FunctionParameters
      _ = json.Unmarshal(inputschema, &paramsSchema)
    
      // Use this tool with OpenAI Go
      openAITool := openai.ChatCompletionToolParam{
        Function: openai.FunctionDefinitionParam{
          Name:        tool.Name(),
          Description: openai.String(tool.Description()),
          Parameters:  paramsSchema,
        },
      }
    
    }
    
ADK Go
  1. Install Toolbox Go SDK:

    go get github.com/googleapis/mcp-toolbox-sdk-go
    
  2. Load tools:

    package main
    
    import (
      "github.com/googleapis/mcp-toolbox-sdk-go/tbadk"
      "context"
    )
    
    func main() {
      // Make sure to add the error checks
      // Update the url to point to your server
      URL := "http://127.0.0.1:5000"
      ctx := context.Background()
      client, err := tbadk.NewToolboxClient(URL)
      if err != nil {
        return fmt.Sprintln("Could not start Toolbox Client", err)
      }
    
      // Use this tool with ADK Go
      tool, err := client.LoadTool("toolName", ctx)
      if err != nil {
        return fmt.Sprintln("Could not load Toolbox Tool", err)
      }
    }
    

    For more detailed instructions on using the Toolbox Go SDK, see the project's README.

Using Toolbox with Gemini CLI Extensions

Gemini CLI extensions provide tools to interact directly with your data sources from command line. Below is a list of Gemini CLI extensions that are built on top of Toolbox. They allow you to interact with your data sources through pre-defined or custom tools with natural language. Click into the link to see detailed instructions on their usage.

To use custom tools with Gemini CLI:

To use prebuilt tools with Gemini CLI:

Configuration

The primary way to configure Toolbox is through the tools.yaml file. If you have multiple files, you can tell toolbox which to load with the --tools-file tools.yaml flag.

You can find more detailed reference documentation to all resource types in the Resources.

Sources

The sources section of your tools.yaml defines what data sources your Toolbox should have access to. Most tools will have at least one source to execute against.

sources:
  my-pg-source:
    kind: postgres
    host: 127.0.0.1
    port: 5432
    database: toolbox_db
    user: toolbox_user
    password: my-password

For more details on configuring different types of sources, see the Sources.

Tools

The tools section of a tools.yaml define the actions an agent can take: what kind of tool it is, which source(s) it affects, what parameters it uses, etc.

tools:
  search-hotels-by-name:
    kind: postgres-sql
    source: my-pg-source
    description: Search for hotels based on name.
    parameters:
      - name: name
        type: string
        description: The name of the hotel.
    statement: SELECT * FROM hotels WHERE name ILIKE '%' || $1 || '%';

For more details on configuring different types of tools, see the Tools.

Toolsets

The toolsets section of your tools.yaml allows you to define groups of tools that you want to be able to load together. This can be useful for defining different groups based on agent or application.

toolsets:
    my_first_toolset:
        - my_first_tool
        - my_second_tool
    my_second_toolset:
        - my_second_tool
        - my_third_tool

You can load toolsets by name:

# This will load all tools
all_tools = client.load_toolset()

# This will only load the tools listed in 'my_second_toolset'
my_second_toolset = client.load_toolset("my_second_toolset")

Prompts

The prompts section of a tools.yaml defines prompts that can be used for interactions with LLMs.

prompts:
  code_review:
    description: "Asks the LLM to analyze code quality and suggest improvements."
    messages:
      - content: "Please review the following code for quality, correctness, and potential improvements: \n\n{{.code}}"
    arguments:
      - name: "code"
        description: "The code to review"

For more details on configuring prompts, see the Prompts.

Versioning

This project uses semantic versioning (MAJOR.MINOR.PATCH). Since the project is in a pre-release stage (version 0.x.y), we follow the standard conventions for initial development:

Pre-1.0.0 Versioning

While the major version is 0, the public API should be considered unstable. The version will be incremented as follows:

  • 0.MINOR.PATCH: The MINOR version is incremented when we add new functionality or make breaking, incompatible API changes.
  • 0.MINOR.PATCH: The PATCH version is incremented for backward-compatible bug fixes.

Post-1.0.0 Versioning

Once the project reaches a stable 1.0.0 release, the version number MAJOR.MINOR.PATCH will follow the more common convention:

  • MAJOR: Incremented for incompatible API changes.
  • MINOR: Incremented for new, backward-compatible functionality.
  • PATCH: Incremented for backward-compatible bug fixes.

The public API that this applies to is the CLI associated with Toolbox, the interactions with official SDKs, and the definitions in the tools.yaml file.

Contributing

Contributions are welcome. Please, see the CONTRIBUTING to get started.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. See Contributor Code of Conduct for more information.

Community

Join our discord community to connect with our developers!

Description
No description provided
Readme Apache-2.0 778 MiB
Latest
2025-07-02 11:30:33 -04:00
Languages
Go 97.5%
JavaScript 1.5%
Shell 0.4%
CSS 0.3%
HTML 0.2%