fix(mcp): ignore OAuth credentials without access tokens

src/google/adk/tools/mcp_tool/mcp_tool.py

@@ -860,7 +860,10 @@ async def _get_headers(
     headers: dict[str, str] | None = None
     if credential:
       if credential.oauth2:
-        headers = {"Authorization": f"Bearer {credential.oauth2.access_token}"}
+        if credential.oauth2.access_token:
+          headers = {
+              "Authorization": f"Bearer {credential.oauth2.access_token}"
+          }
       elif credential.http:
         # Handle HTTP authentication schemes
         if (

tests/unittests/tools/mcp_tool/test_mcp_tool.py

@@ -1893,6 +1893,44 @@ async def test_run_async_impl_auth_overrides_duplicate_provider_header(self):
         }
     )
 
+  @pytest.mark.asyncio
+  async def test_run_async_impl_provider_survives_unusable_oauth_credential(
+      self,
+  ):
+    """An unusable OAuth credential must not fall through to other fields."""
+    header_provider = Mock(
+        return_value={"Authorization": "Bearer provider-token"}
+    )
+    tool = MCPTool(
+        mcp_tool=self.mock_mcp_tool,
+        mcp_session_manager=self.mock_session_manager,
+        header_provider=header_provider,
+    )
+    credential = AuthCredential(
+        auth_type=AuthCredentialTypes.OAUTH2,
+        oauth2=OAuth2Auth(access_token=None),
+        http=HttpAuth(
+            scheme="bearer",
+            credentials=HttpCredentials(token="stale-http-token"),
+        ),
+    )
+    mcp_response = CallToolResult(
+        content=[TextContent(type="text", text="success")]
+    )
+    self.mock_session.call_tool = AsyncMock(return_value=mcp_response)
+    tool_context = Mock(spec=ToolContext)
+    tool_context._invocation_context = Mock()
+
+    await tool._run_async_impl(
+        args={"param1": "test_value"},
+        tool_context=tool_context,
+        credential=credential,
+    )
+
+    self.mock_session_manager.create_session.assert_awaited_once_with(
+        headers={"Authorization": "Bearer provider-token"}
+    )
+
   def test_init_with_progress_callback(self):
     """Test initialization with progress_callback."""