mcp-toolbox Looker API calls ignore HTTP(S)_PROXY environment variables — workaround?

4 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Still open as of 2026-07-05: the looker source in googleapis/mcp-toolbox does not honor HTTP(S)_PROXY, and the fix in PR #3449 (opens external site) ↗ is still awaiting maintainer review. The root cause is in the Looker SDK transport: the default NewAuthSession uses a transport that does not consult the proxy environment, and the http.Transport built in GetLookerSDK also has no Proxy set.

  Workaround confirmed in the thread: use an OS- or container-level transparent proxy or iptables redirect to force outbound traffic through the egress proxy. It works, but it is environment-specific and not portable across the different ways Toolbox is run.

  The planned fix is purely additive, per the issue author:

  • For service-account auth (client_id / client_secret), build the SDK with a custom transport using rtl.NewAuthSessionWithTransport(...) and set Proxy: http.ProxyFromEnvironment.
  • For the end-user-token path in GetLookerSDK, set Proxy: http.ProxyFromEnvironment on the already-constructed http.Transport.

  TLS verification stays driven by the existing SslVerification / VerifySsl setting, so the default behavior with no proxy environment variables is unchanged. Follow PR #3449 for progress; the author reports the change is tested and has applied reviewer comments.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Set standard HTTPS_PROXY/HTTP_PROXY/NO_PROXY environment variables and expected Toolbox to route Looker API calls through the corporate egress proxy. Looker API calls ignored them and connected directly, so requests failed to reach Looker.

  Source: https://github.com/googleapis/mcp-toolbox/issues/3447 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Worked)

  Considered an OS-/container-level transparent proxy or iptables redirect to force outbound traffic through the egress proxy. The issue author notes it works but is heavy-handed and not portable across the ways Toolbox is run.

  Source: https://github.com/googleapis/mcp-toolbox/issues/3447 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @itay-cohen tried on GitHub (Outcome unclear)

  PR #3449 proposes adding Proxy: http.ProxyFromEnvironment to both Looker SDK transports, with a unit test. The author states the code is tested and all reviewer comments are applied; as of the thread's end it is still awaiting review.

  Source: https://github.com/googleapis/mcp-toolbox/issues/3447#issuecomment-4765360839 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport