This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [langchain](https://redirect.github.com/langchain-ai/langchainjs/tree/main/libs/langchain/) ([source](https://redirect.github.com/langchain-ai/langchainjs)) | [`1.0.2` → `1.2.3`](https://renovatebot.com/diffs/npm/langchain/1.0.2/1.2.3) |  |  | ### GitHub Vulnerability Alerts #### [CVE-2025-68665](https://redirect.github.com/langchain-ai/langchainjs/security/advisories/GHSA-r399-636x-v7f6) ## Context A serialization injection vulnerability exists in LangChain JS's `toJSON()` method (and subsequently when string-ifying objects using `JSON.stringify()`. The method did not escape objects with `'lc'` keys when serializing free-form data in kwargs. The `'lc'` key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. ### Attack surface The core vulnerability was in `Serializable.toJSON()`: this method failed to escape user-controlled objects containing `'lc'` keys within kwargs (e.g., `additional_kwargs`, `metadata`, `response_metadata`). When this unescaped data was later deserialized via `load()`, the injected structures were treated as legitimate LangChain objects rather than plain user data. This escaping bug enabled several attack vectors: 1. **Injection via user data**: Malicious LangChain object structures could be injected through user-controlled fields like `metadata`, `additional_kwargs`, or `response_metadata` 2. **Secret extraction**: Injected secret structures could extract environment variables when `secretsFromEnv` was enabled (which had no explicit default, effectively defaulting to `true` behavior) 3. **Class instantiation via import maps**: Injected constructor structures could instantiate any class available in the provided import maps with attacker-controlled parameters **Note on import maps:** Classes must be explicitly included in import maps to be instantiatable. The core import map includes standard types (messages, prompts, documents), and users can extend this via `importMap` and `optionalImportsMap` options. This architecture naturally limits the attack surface—an `allowedObjects` parameter is not necessary because users control which classes are available through the import maps they provide. **Security hardening:** This patch fixes the escaping bug in `toJSON()` and introduces new restrictive defaults in `load()`: `secretsFromEnv` now explicitly defaults to `false`, and a `maxDepth` parameter protects against DoS via deeply nested structures. JSDoc security warnings have been added to all import map options. ## Who is affected? Applications are vulnerable if they: 1. **Serialize untrusted data via `JSON.stringify()` on Serializable objects, then deserialize with `load()`** — Trusting your own serialization output makes you vulnerable if user-controlled data (e.g., from LLM responses, metadata fields, or user inputs) contains `'lc'` key structures. 2. **Deserialize untrusted data with `load()`** — Directly deserializing untrusted data that may contain injected `'lc'` structures. 3. **Use LangGraph checkpoints** — Checkpoint serialization/deserialization paths may be affected. The most common attack vector is through **LLM response fields** like `additional_kwargs` or `response_metadata`, which can be controlled via prompt injection and then serialized/deserialized in streaming operations. ## Impact Attackers who control serialized data can extract environment variable secrets by injecting `{"lc": 1, "type": "secret", "id": ["ENV_VAR"]}` to load environment variables during deserialization (when `secretsFromEnv: true`). They can also instantiate classes with controlled parameters by injecting constructor structures to instantiate any class within the provided import maps with attacker-controlled parameters, potentially triggering side effects such as network calls or file operations. Key severity factors: - Affects the serialization path—applications trusting their own serialization output are vulnerable - Enables secret extraction when combined with `secretsFromEnv: true` - LLM responses in `additional_kwargs` can be controlled via prompt injection ## Exploit example ```typescript import { load } from "@​langchain/core/load"; // Attacker injects secret structure into user-controlled data const attackerPayload = JSON.stringify({ user_data: { lc: 1, type: "secret", id: ["OPENAI_API_KEY"], }, }); process.env.OPENAI_API_KEY = "sk-secret-key-12345"; // With secretsFromEnv: true, the secret is extracted const deserialized = await load(attackerPayload, { secretsFromEnv: true }); console.log(deserialized.user_data); // "sk-secret-key-12345" - SECRET LEAKED! ``` ## Security hardening changes This patch introduces the following changes to `load()`: 1. **`secretsFromEnv` default changed to `false`**: Disables automatic secret loading from environment variables. Secrets not found in `secretsMap` now throw an error instead of being loaded from `process.env`. This fail-safe behavior ensures missing secrets are caught immediately rather than silently continuing with `null`. 2. **New `maxDepth` parameter** (defaults to `50`): Protects against denial-of-service attacks via deeply nested JSON structures that could cause stack overflow. 3. **Escape mechanism in `toJSON()`**: User-controlled objects containing `'lc'` keys are now wrapped in `{"__lc_escaped__": {...}}` during serialization and unwrapped as plain data during deserialization. 4. **JSDoc security warnings**: All import map options (`importMap`, `optionalImportsMap`, `optionalImportEntrypoints`) now include security warnings about never populating them from user input. ## Migration guide ### No changes needed for most users If you're deserializing standard LangChain types (messages, documents, prompts) using the core import map, your code will work without changes: ```typescript import { load } from "@​langchain/core/load"; // Works with default settings const obj = await load(serializedData); ``` ### For secrets from environment `secretsFromEnv` now defaults to `false`, and missing secrets throw an error. If you need to load secrets: ```typescript import { load } from "@​langchain/core/load"; // Provide secrets explicitly (recommended) const obj = await load(serializedData, { secretsMap: { OPENAI_API_KEY: process.env.OPENAI_API_KEY }, }); // Or explicitly opt-in to load from env (only use with trusted data) const obj = await load(serializedData, { secretsFromEnv: true }); ``` > **Warning:** Only enable `secretsFromEnv` if you trust the serialized data. Untrusted data could extract any environment variable. > **Note:** If a secret reference is encountered but not found in `secretsMap` (and `secretsFromEnv` is `false` or the secret is not in the environment), an error is thrown. This fail-safe behavior ensures you're aware of missing secrets rather than silently receiving `null` values. ### For deeply nested structures If you have legitimate deeply nested data that exceeds the default depth limit of 50: ```typescript import { load } from "@​langchain/core/load"; const obj = await load(serializedData, { maxDepth: 100 }); ``` ### For custom import maps If you provide custom import maps, ensure they only contain trusted modules: ```typescript import { load } from "@​langchain/core/load"; import * as myModule from "./my-trusted-module"; // GOOD - explicitly include only trusted modules const obj = await load(serializedData, { importMap: { my_module: myModule }, }); // BAD - never populate from user input const obj = await load(serializedData, { importMap: userProvidedImports, // DANGEROUS! }); ``` --- ### Release Notes <details> <summary>langchain-ai/langchainjs (langchain)</summary> ### [`v1.2.3`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.2.3) ##### Patch Changes - Updated dependencies \[[`0bade90`](0bade90ed4), [`6c40d00`](6c40d00e92)]: - [@​langchain/core](https://redirect.github.com/langchain/core)@​1.1.4 ### [`v1.2.2`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.2.2) ##### Patch Changes - [#​9520](https://redirect.github.com/langchain-ai/langchainjs/pull/9520) [`cc022b0`](cc022b0aab) Thanks [@​yukukotani](https://redirect.github.com/yukukotani)! - Includes cache creation/read tokens in input\_tokens of usage metadata - Updated dependencies \[[`bd2c46e`](bd2c46e09e), [`487378b`](487378bf14), [`138e7fb`](138e7fb628)]: - [@​langchain/core](https://redirect.github.com/langchain/core)@​1.1.3 ### [`v1.2.1`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.2.1) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.2.0...langchain@1.2.1) ##### Patch Changes - Updated dependencies \[[`833f578`](833f57834d)]: - [@​langchain/core](https://redirect.github.com/langchain/core)@​1.1.2 ### [`v1.2.0`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.0) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.6...langchain@1.2.0) ##### Minor Changes - [#​9651](https://redirect.github.com/langchain-ai/langchainjs/pull/9651) [`348c37c`](348c37c01a) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - feat(langchain): allow to set strict tag manually in providerStrategy [#​9578](https://redirect.github.com/langchain-ai/langchainjs/issues/9578) ### [`v1.1.6`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.1.6) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.5...langchain@1.1.6) ##### Patch Changes - [#​9586](https://redirect.github.com/langchain-ai/langchainjs/pull/9586) [`bc8e90f`](bc8e90f4f7) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - patch prompts created from runs fix - [#​9623](https://redirect.github.com/langchain-ai/langchainjs/pull/9623) [`ade8b8a`](ade8b8af0b) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - fix(langchain): properly retrieve structured output from thinking block - [#​9637](https://redirect.github.com/langchain-ai/langchainjs/pull/9637) [`88bb788`](88bb7882fa) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - fix(langchain): Prevent functions from being accidentally assignable to AgentMiddleware - [#​8964](https://redirect.github.com/langchain-ai/langchainjs/pull/8964) [`38ff1b5`](38ff1b55d3) Thanks [@​jnjacobson](https://redirect.github.com/jnjacobson)! - add support for anyOf, allOf, oneOf in openapi conversion - [#​9640](https://redirect.github.com/langchain-ai/langchainjs/pull/9640) [`aa8c4f8`](aa8c4f867a) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - fix(langchain): prevent summarization middleware from leaking streaming events - [#​9648](https://redirect.github.com/langchain-ai/langchainjs/pull/9648) [`29a8480`](29a8480799) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - fix(langchain): allow to set strict tag manually in providerStrategy [#​9578](https://redirect.github.com/langchain-ai/langchainjs/issues/9578) - [#​9630](https://redirect.github.com/langchain-ai/langchainjs/pull/9630) [`a2df2d4`](a2df2d422e) Thanks [@​nephix](https://redirect.github.com/nephix)! - fix(summary-middleware): use summaryPrefix or fall back to default prefix - Updated dependencies \[[`005c729`](005c72903b), [`ab78246`](ab78246275), [`8cc81c7`](8cc81c7cee), [`f32e499`](f32e4991d0), [`a28d83d`](a28d83d49d), [`2e5ad70`](2e5ad70d16), [`e456c66`](e456c661aa), [`1cfe603`](1cfe603e97)]: - [@​langchain/core](https://redirect.github.com/langchain/core)@​1.1.5 ### [`v1.1.5`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.1.5) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.4...langchain@1.1.5) ##### Patch Changes - Updated dependencies \[[`0bade90`](0bade90ed4), [`6c40d00`](6c40d00e92)]: - [@​langchain/core](https://redirect.github.com/langchain/core)@​1.1.4 ### [`v1.1.4`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.4) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.3...langchain@1.1.4) ##### Patch Changes - [#​9575](https://redirect.github.com/langchain-ai/langchainjs/pull/9575) [`0bade90`](0bade90ed4) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - bin p-retry - [#​9574](https://redirect.github.com/langchain-ai/langchainjs/pull/9574) [`6c40d00`](6c40d00e92) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - Revert "fix([@​langchain/core](https://redirect.github.com/langchain/core)): update and bundle dependencies ([#​9534](https://redirect.github.com/langchain-ai/langchainjs/issues/9534))" ### [`v1.1.3`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.3) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.2...langchain@1.1.3) ##### Patch Changes - [#​9534](https://redirect.github.com/langchain-ai/langchainjs/pull/9534) [`bd2c46e`](bd2c46e09e) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - fix([@​langchain/core](https://redirect.github.com/langchain/core)): update and bundle `p-retry`, `ansi-styles`, `camelcase` and `decamelize` dependencies - [#​9544](https://redirect.github.com/langchain-ai/langchainjs/pull/9544) [`487378b`](487378bf14) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - fix tool chunk concat behavior ([#​9450](https://redirect.github.com/langchain-ai/langchainjs/issues/9450)) - [#​9505](https://redirect.github.com/langchain-ai/langchainjs/pull/9505) [`138e7fb`](138e7fb628) Thanks [@​chosh-dev](https://redirect.github.com/chosh-dev)! - feat: replace btoa with toBase64Url for encoding in drawMermaidImage ### [`v1.1.2`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.2) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.1.1...langchain@1.1.2) ##### Patch Changes - [#​9511](https://redirect.github.com/langchain-ai/langchainjs/pull/9511) [`833f578`](833f57834d) Thanks [@​dqbd](https://redirect.github.com/dqbd)! - allow parsing more partial JSON ### [`v1.1.1`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/core%401.1.1) ##### Patch Changes - [#​9495](https://redirect.github.com/langchain-ai/langchainjs/pull/9495) [`636b994`](636b99459b) Thanks [@​gsriram24](https://redirect.github.com/gsriram24)! - fix: use dynamic import for p-retry to support CommonJS environments - [#​9531](https://redirect.github.com/langchain-ai/langchainjs/pull/9531) [`38f0162`](38f0162b7b) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - add `extras` to tools ### [`v1.1.0`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/anthropic%401.1.0) ##### Minor Changes - [#​9424](https://redirect.github.com/langchain-ai/langchainjs/pull/9424) [`f17b2c9`](f17b2c9db0) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - add support for `betas` param - [#​9424](https://redirect.github.com/langchain-ai/langchainjs/pull/9424) [`f17b2c9`](f17b2c9db0) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - add support for native structured output ##### Patch Changes - [#​9424](https://redirect.github.com/langchain-ai/langchainjs/pull/9424) [`f17b2c9`](f17b2c9db0) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - bump sdk version ### [`v1.0.6`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.0.6) [Compare Source](https://redirect.github.com/langchain-ai/langchainjs/compare/langchain@1.0.5...langchain@1.0.6) ##### Patch Changes - [#​9434](https://redirect.github.com/langchain-ai/langchainjs/pull/9434) [`f7cfece`](f7cfecec29) Thanks [@​deepansh946](https://redirect.github.com/deepansh946)! - Updated error handling behaviour of AgentNode ### [`v1.0.5`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.0.5) ##### Patch Changes - [#​9403](https://redirect.github.com/langchain-ai/langchainjs/pull/9403) [`944bf56`](944bf56ff0) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - improvements to toolEmulator middleware - [#​9388](https://redirect.github.com/langchain-ai/langchainjs/pull/9388) [`831168a`](831168a545) Thanks [@​hntrl](https://redirect.github.com/hntrl)! - use `profile.maxInputTokens` in summarization middleware - [#​9393](https://redirect.github.com/langchain-ai/langchainjs/pull/9393) [`f1e2f9e`](f1e2f9eeb3) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - align context editing with summarization interface - [#​9427](https://redirect.github.com/langchain-ai/langchainjs/pull/9427) [`bad7aea`](bad7aea86d) Thanks [@​dqbd](https://redirect.github.com/dqbd)! - fix(langchain): add tool call contents and tool call ID to improve token count approximation - [#​9396](https://redirect.github.com/langchain-ai/langchainjs/pull/9396) [`ed6b581`](ed6b581e52) Thanks [@​christian-bromann](https://redirect.github.com/christian-bromann)! - rename exit behavior from throw to error ### [`v1.0.4`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/community%401.0.4) ##### Patch Changes - [#​9326](https://redirect.github.com/langchain-ai/langchainjs/pull/9326) [`3e0cab6`](3e0cab61b3) Thanks [@​ayanyev](https://redirect.github.com/ayanyev)! - Milvus vector store client: ignore auto-calculated fields in collection schema during payload validation - Updated dependencies \[[`415cb0b`](415cb0bfd2), [`a2ad61e`](a2ad61e787), [`34c472d`](34c472d129)]: - [@​langchain/openai](https://redirect.github.com/langchain/openai)@​1.1.2 - [@​langchain/classic](https://redirect.github.com/langchain/classic)@​1.0.4 ### [`v1.0.3`](https://redirect.github.com/langchain-ai/langchainjs/releases/tag/%40langchain/google-gauth%401.0.3) ##### Patch Changes - Updated dependencies \[]: - [@​langchain/google-common](https://redirect.github.com/langchain/google-common)@​1.0.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/googleapis/genai-toolbox). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42Ni4xNCIsInVwZGF0ZWRJblZlciI6IjQyLjY2LjE0IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
MCP Toolbox for Databases
Note
MCP Toolbox for Databases is currently in beta, and may see breaking changes until the first stable release (v1.0).
MCP Toolbox for Databases is an open source MCP server for databases. It enables you to develop tools easier, faster, and more securely by handling the complexities such as connection pooling, authentication, and more.
This README provides a brief overview. For comprehensive details, see the full documentation.
Note
This solution was originally named “Gen AI Toolbox for Databases” as its initial development predated MCP, but was renamed to align with recently added MCP compatibility.
Table of Contents
Why Toolbox?
Toolbox helps you build Gen AI tools that let your agents access data in your database. Toolbox provides:
- Simplified development: Integrate tools to your agent in less than 10 lines of code, reuse tools between multiple agents or frameworks, and deploy new versions of tools more easily.
- Better performance: Best practices such as connection pooling, authentication, and more.
- Enhanced security: Integrated auth for more secure access to your data
- End-to-end observability: Out of the box metrics and tracing with built-in support for OpenTelemetry.
⚡ Supercharge Your Workflow with an AI Database Assistant ⚡
Stop context-switching and let your AI assistant become a true co-developer. By connecting your IDE to your databases with MCP Toolbox, you can delegate complex and time-consuming database tasks, allowing you to build faster and focus on what matters. This isn't just about code completion; it's about giving your AI the context it needs to handle the entire development lifecycle.
Here’s how it will save you time:
- Query in Plain English: Interact with your data using natural language right from your IDE. Ask complex questions like, "How many orders were delivered in 2024, and what items were in them?" without writing any SQL.
- Automate Database Management: Simply describe your data needs, and let the AI assistant manage your database for you. It can handle generating queries, creating tables, adding indexes, and more.
- Generate Context-Aware Code: Empower your AI assistant to generate application code and tests with a deep understanding of your real-time database schema. This accelerates the development cycle by ensuring the generated code is directly usable.
- Slash Development Overhead: Radically reduce the time spent on manual setup and boilerplate. MCP Toolbox helps streamline lengthy database configurations, repetitive code, and error-prone schema migrations.
Learn how to connect your AI tools (IDEs) to Toolbox using MCP.
General Architecture
Toolbox sits between your application's orchestration framework and your database, providing a control plane that is used to modify, distribute, or invoke tools. It simplifies the management of your tools by providing you with a centralized location to store and update tools, allowing you to share tools between agents and applications and update those tools without necessarily redeploying your application.
Getting Started
(Non-production) Running Toolbox
You can run Toolbox directly with a configuration file:
npx @toolbox-sdk/server --tools-file tools.yaml
This runs the latest version of the toolbox server with your configuration file.
Note
This method should only be used for non-production use cases such as experimentation. For any production use-cases, please consider Installing the server and then running it.
Installing the server
For the latest version, check the releases page and use the following instructions for your OS and CPU architecture.
Binary
To install Toolbox as a binary:
Linux (AMD64)
To install Toolbox as a binary on Linux (AMD64):
# see releases page for other versions export VERSION=0.24.0 curl -L -o toolbox https://storage.googleapis.com/genai-toolbox/v$VERSION/linux/amd64/toolbox chmod +x toolboxmacOS (Apple Silicon)
To install Toolbox as a binary on macOS (Apple Silicon):
# see releases page for other versions export VERSION=0.24.0 curl -L -o toolbox https://storage.googleapis.com/genai-toolbox/v$VERSION/darwin/arm64/toolbox chmod +x toolboxmacOS (Intel)
To install Toolbox as a binary on macOS (Intel):
# see releases page for other versions export VERSION=0.24.0 curl -L -o toolbox https://storage.googleapis.com/genai-toolbox/v$VERSION/darwin/amd64/toolbox chmod +x toolboxWindows (Command Prompt)
To install Toolbox as a binary on Windows (Command Prompt):
:: see releases page for other versions set VERSION=0.24.0 curl -o toolbox.exe "https://storage.googleapis.com/genai-toolbox/v%VERSION%/windows/amd64/toolbox.exe"Windows (PowerShell)
To install Toolbox as a binary on Windows (PowerShell):
# see releases page for other versions $VERSION = "0.24.0" curl.exe -o toolbox.exe "https://storage.googleapis.com/genai-toolbox/v$VERSION/windows/amd64/toolbox.exe"
Container image
You can also install Toolbox as a container:# see releases page for other versions
export VERSION=0.24.0
docker pull us-central1-docker.pkg.dev/database-toolbox/toolbox/toolbox:$VERSION
Homebrew
To install Toolbox using Homebrew on macOS or Linux:
brew install mcp-toolbox
Compile from source
To install from source, ensure you have the latest version of Go installed, and then run the following command:
go install github.com/googleapis/genai-toolbox@v0.24.0
Gemini CLI Extensions
To install Gemini CLI Extensions for MCP Toolbox, run the following command:
gemini extensions install https://github.com/gemini-cli-extensions/mcp-toolbox
Running the server
Configure a tools.yaml to define your tools, and then
execute toolbox to start the server:
Binary
To run Toolbox from binary:
./toolbox --tools-file "tools.yaml"
ⓘ Note
Toolbox enables dynamic reloading by default. To disable, use the--disable-reloadflag.
Container image
To run the server after pulling the container image:
export VERSION=0.11.0 # Use the version you pulled
docker run -p 5000:5000 \
-v $(pwd)/tools.yaml:/app/tools.yaml \
us-central1-docker.pkg.dev/database-toolbox/toolbox/toolbox:$VERSION \
--tools-file "/app/tools.yaml"
ⓘ Note
The-vflag mounts your localtools.yamlinto the container, and-pmaps the container's port5000to your host's port5000.
Source
To run the server directly from source, navigate to the project root directory and run:
go run .
ⓘ Note
This command runs the project from source, and is more suitable for development and testing. It does not compile a binary into your$GOPATH. If you want to compile a binary instead, refer the Developer Documentation.
Homebrew
If you installed Toolbox using Homebrew, the toolbox
binary is available in your system path. You can start the server with the same
command:
toolbox --tools-file "tools.yaml"
NPM
To run Toolbox directly without manually downloading the binary (requires Node.js):
npx @toolbox-sdk/server --tools-file tools.yaml
Gemini CLI
Interact with your custom tools using natural language. Check gemini-cli-extensions/mcp-toolbox for more information.
You can use toolbox help for a full list of flags! To stop the server, send a
terminate signal (ctrl+c on most platforms).
For more detailed documentation on deploying to different environments, check out the resources in the How-to section
Integrating your application
Once your server is up and running, you can load the tools into your application. See below the list of Client SDKs for using various frameworks:
Python (Github)
Core
Install Toolbox Core SDK:
pip install toolbox-coreLoad tools:
from toolbox_core import ToolboxClient # update the url to point to your server async with ToolboxClient("http://127.0.0.1:5000") as client: # these tools can be passed to your application! tools = await client.load_toolset("toolset_name")For more detailed instructions on using the Toolbox Core SDK, see the project's README.
LangChain / LangGraph
Install Toolbox LangChain SDK:
pip install toolbox-langchainLoad tools:
from toolbox_langchain import ToolboxClient # update the url to point to your server async with ToolboxClient("http://127.0.0.1:5000") as client: # these tools can be passed to your application! tools = client.load_toolset()For more detailed instructions on using the Toolbox LangChain SDK, see the project's README.
LlamaIndex
Install Toolbox Llamaindex SDK:
pip install toolbox-llamaindexLoad tools:
from toolbox_llamaindex import ToolboxClient # update the url to point to your server async with ToolboxClient("http://127.0.0.1:5000") as client: # these tools can be passed to your application! tools = client.load_toolset()For more detailed instructions on using the Toolbox Llamaindex SDK, see the project's README.
Javascript/Typescript (Github)
Core
Install Toolbox Core SDK:
npm install @toolbox-sdk/coreLoad tools:
import { ToolboxClient } from '@toolbox-sdk/core'; // update the url to point to your server const URL = 'http://127.0.0.1:5000'; let client = new ToolboxClient(URL); // these tools can be passed to your application! const tools = await client.loadToolset('toolsetName');For more detailed instructions on using the Toolbox Core SDK, see the project's README.
LangChain / LangGraph
Install Toolbox Core SDK:
npm install @toolbox-sdk/coreLoad tools:
import { ToolboxClient } from '@toolbox-sdk/core'; // update the url to point to your server const URL = 'http://127.0.0.1:5000'; let client = new ToolboxClient(URL); // these tools can be passed to your application! const toolboxTools = await client.loadToolset('toolsetName'); // Define the basics of the tool: name, description, schema and core logic const getTool = (toolboxTool) => tool(currTool, { name: toolboxTool.getName(), description: toolboxTool.getDescription(), schema: toolboxTool.getParamSchema() }); // Use these tools in your Langchain/Langraph applications const tools = toolboxTools.map(getTool);Genkit
Install Toolbox Core SDK:
npm install @toolbox-sdk/coreLoad tools:
import { ToolboxClient } from '@toolbox-sdk/core'; import { genkit } from 'genkit'; // Initialise genkit const ai = genkit({ plugins: [ googleAI({ apiKey: process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY }) ], model: googleAI.model('gemini-2.0-flash'), }); // update the url to point to your server const URL = 'http://127.0.0.1:5000'; let client = new ToolboxClient(URL); // these tools can be passed to your application! const toolboxTools = await client.loadToolset('toolsetName'); // Define the basics of the tool: name, description, schema and core logic const getTool = (toolboxTool) => ai.defineTool({ name: toolboxTool.getName(), description: toolboxTool.getDescription(), schema: toolboxTool.getParamSchema() }, toolboxTool) // Use these tools in your Genkit applications const tools = toolboxTools.map(getTool);ADK
Install Toolbox ADK SDK:
npm install @toolbox-sdk/adkLoad tools:
import { ToolboxClient } from '@toolbox-sdk/adk'; // update the url to point to your server const URL = 'http://127.0.0.1:5000'; let client = new ToolboxClient(URL); // these tools can be passed to your application! const tools = await client.loadToolset('toolsetName');For more detailed instructions on using the Toolbox ADK SDK, see the project's README.
Go (Github)
Core
Install Toolbox Go SDK:
go get github.com/googleapis/mcp-toolbox-sdk-goLoad tools:
package main import ( "github.com/googleapis/mcp-toolbox-sdk-go/core" "context" ) func main() { // Make sure to add the error checks // update the url to point to your server URL := "http://127.0.0.1:5000"; ctx := context.Background() client, err := core.NewToolboxClient(URL) // Framework agnostic tools tools, err := client.LoadToolset("toolsetName", ctx) }For more detailed instructions on using the Toolbox Go SDK, see the project's README.
LangChain Go
Install Toolbox Go SDK:
go get github.com/googleapis/mcp-toolbox-sdk-goLoad tools:
package main import ( "context" "encoding/json" "github.com/googleapis/mcp-toolbox-sdk-go/core" "github.com/tmc/langchaingo/llms" ) func main() { // Make sure to add the error checks // update the url to point to your server URL := "http://127.0.0.1:5000" ctx := context.Background() client, err := core.NewToolboxClient(URL) // Framework agnostic tool tool, err := client.LoadTool("toolName", ctx) // Fetch the tool's input schema inputschema, err := tool.InputSchema() var paramsSchema map[string]any _ = json.Unmarshal(inputschema, ¶msSchema) // Use this tool with LangChainGo langChainTool := llms.Tool{ Type: "function", Function: &llms.FunctionDefinition{ Name: tool.Name(), Description: tool.Description(), Parameters: paramsSchema, }, } }Genkit
Install Toolbox Go SDK:
go get github.com/googleapis/mcp-toolbox-sdk-goLoad tools:
package main import ( "context" "log" "github.com/firebase/genkit/go/genkit" "github.com/googleapis/mcp-toolbox-sdk-go/core" "github.com/googleapis/mcp-toolbox-sdk-go/tbgenkit" ) func main() { // Make sure to add the error checks // Update the url to point to your server URL := "http://127.0.0.1:5000" ctx := context.Background() g := genkit.Init(ctx) client, err := core.NewToolboxClient(URL) // Framework agnostic tool tool, err := client.LoadTool("toolName", ctx) // Convert the tool using the tbgenkit package // Use this tool with Genkit Go genkitTool, err := tbgenkit.ToGenkitTool(tool, g) if err != nil { log.Fatalf("Failed to convert tool: %v\n", err) } log.Printf("Successfully converted tool: %s", genkitTool.Name()) }Go GenAI
Install Toolbox Go SDK:
go get github.com/googleapis/mcp-toolbox-sdk-goLoad tools:
package main import ( "context" "encoding/json" "github.com/googleapis/mcp-toolbox-sdk-go/core" "google.golang.org/genai" ) func main() { // Make sure to add the error checks // Update the url to point to your server URL := "http://127.0.0.1:5000" ctx := context.Background() client, err := core.NewToolboxClient(URL) // Framework agnostic tool tool, err := client.LoadTool("toolName", ctx) // Fetch the tool's input schema inputschema, err := tool.InputSchema() var schema *genai.Schema _ = json.Unmarshal(inputschema, &schema) funcDeclaration := &genai.FunctionDeclaration{ Name: tool.Name(), Description: tool.Description(), Parameters: schema, } // Use this tool with Go GenAI genAITool := &genai.Tool{ FunctionDeclarations: []*genai.FunctionDeclaration{funcDeclaration}, } }OpenAI Go
Install Toolbox Go SDK:
go get github.com/googleapis/mcp-toolbox-sdk-goLoad tools:
package main import ( "context" "encoding/json" "github.com/googleapis/mcp-toolbox-sdk-go/core" openai "github.com/openai/openai-go" ) func main() { // Make sure to add the error checks // Update the url to point to your server URL := "http://127.0.0.1:5000" ctx := context.Background() client, err := core.NewToolboxClient(URL) // Framework agnostic tool tool, err := client.LoadTool("toolName", ctx) // Fetch the tool's input schema inputschema, err := tool.InputSchema() var paramsSchema openai.FunctionParameters _ = json.Unmarshal(inputschema, ¶msSchema) // Use this tool with OpenAI Go openAITool := openai.ChatCompletionToolParam{ Function: openai.FunctionDefinitionParam{ Name: tool.Name(), Description: openai.String(tool.Description()), Parameters: paramsSchema, }, } }ADK Go
Install Toolbox Go SDK:
go get github.com/googleapis/mcp-toolbox-sdk-goLoad tools:
package main import ( "github.com/googleapis/mcp-toolbox-sdk-go/tbadk" "context" ) func main() { // Make sure to add the error checks // Update the url to point to your server URL := "http://127.0.0.1:5000" ctx := context.Background() client, err := tbadk.NewToolboxClient(URL) if err != nil { return fmt.Sprintln("Could not start Toolbox Client", err) } // Use this tool with ADK Go tool, err := client.LoadTool("toolName", ctx) if err != nil { return fmt.Sprintln("Could not load Toolbox Tool", err) } }For more detailed instructions on using the Toolbox Go SDK, see the project's README.
Using Toolbox with Gemini CLI Extensions
Gemini CLI extensions provide tools to interact directly with your data sources from command line. Below is a list of Gemini CLI extensions that are built on top of Toolbox. They allow you to interact with your data sources through pre-defined or custom tools with natural language. Click into the link to see detailed instructions on their usage.
To use custom tools with Gemini CLI:
To use prebuilt tools with Gemini CLI:
- AlloyDB for PostgreSQL
- AlloyDB for PostgreSQL Observability
- BigQuery Data Analytics
- BigQuery Conversational Analytics
- Cloud SQL for MySQL
- Cloud SQL for MySQL Observability
- Cloud SQL for PostgreSQL
- Cloud SQL for PostgreSQL Observability
- Cloud SQL for SQL Server
- Cloud SQL for SQL Server Observability
- Looker
- Dataplex
- MySQL
- PostgreSQL
- Spanner
- Firestore
- SQL Server
Configuration
The primary way to configure Toolbox is through the tools.yaml file. If you
have multiple files, you can tell toolbox which to load with the --tools-file tools.yaml flag.
You can find more detailed reference documentation to all resource types in the Resources.
Sources
The sources section of your tools.yaml defines what data sources your
Toolbox should have access to. Most tools will have at least one source to
execute against.
sources:
my-pg-source:
kind: postgres
host: 127.0.0.1
port: 5432
database: toolbox_db
user: toolbox_user
password: my-password
For more details on configuring different types of sources, see the Sources.
Tools
The tools section of a tools.yaml define the actions an agent can take: what
kind of tool it is, which source(s) it affects, what parameters it uses, etc.
tools:
search-hotels-by-name:
kind: postgres-sql
source: my-pg-source
description: Search for hotels based on name.
parameters:
- name: name
type: string
description: The name of the hotel.
statement: SELECT * FROM hotels WHERE name ILIKE '%' || $1 || '%';
For more details on configuring different types of tools, see the Tools.
Toolsets
The toolsets section of your tools.yaml allows you to define groups of tools
that you want to be able to load together. This can be useful for defining
different groups based on agent or application.
toolsets:
my_first_toolset:
- my_first_tool
- my_second_tool
my_second_toolset:
- my_second_tool
- my_third_tool
You can load toolsets by name:
# This will load all tools
all_tools = client.load_toolset()
# This will only load the tools listed in 'my_second_toolset'
my_second_toolset = client.load_toolset("my_second_toolset")
Prompts
The prompts section of a tools.yaml defines prompts that can be used for
interactions with LLMs.
prompts:
code_review:
description: "Asks the LLM to analyze code quality and suggest improvements."
messages:
- content: "Please review the following code for quality, correctness, and potential improvements: \n\n{{.code}}"
arguments:
- name: "code"
description: "The code to review"
For more details on configuring prompts, see the Prompts.
Versioning
This project uses semantic versioning (MAJOR.MINOR.PATCH).
Since the project is in a pre-release stage (version 0.x.y), we follow the
standard conventions for initial development:
Pre-1.0.0 Versioning
While the major version is 0, the public API should be considered unstable.
The version will be incremented as follows:
0.MINOR.PATCH: The MINOR version is incremented when we add new functionality or make breaking, incompatible API changes.0.MINOR.PATCH: The PATCH version is incremented for backward-compatible bug fixes.
Post-1.0.0 Versioning
Once the project reaches a stable 1.0.0 release, the version number
MAJOR.MINOR.PATCH will follow the more common convention:
MAJOR: Incremented for incompatible API changes.MINOR: Incremented for new, backward-compatible functionality.PATCH: Incremented for backward-compatible bug fixes.
The public API that this applies to is the CLI associated with Toolbox, the
interactions with official SDKs, and the definitions in the tools.yaml file.
Contributing
Contributions are welcome. Please, see the CONTRIBUTING to get started.
Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. See Contributor Code of Conduct for more information.
Community
Join our discord community to connect with our developers!

