feat: Add get_auth_config method to toolset to expose auth requirement of the toolset

Co-authored-by: Xiang (Sean) Zhou <seanzhougoogle@google.com>
PiperOrigin-RevId: 862597425

src/google/adk/tools/apihub_tool/apihub_toolset.py

@@ -24,6 +24,7 @@ import yaml
 from ...agents.readonly_context import ReadonlyContext
 from ...auth.auth_credential import AuthCredential
 from ...auth.auth_schemes import AuthScheme
+from ...auth.auth_tool import AuthConfig
 from .._gemini_schema_util import _to_snake_case
 from ..base_toolset import BaseToolset
 from ..base_toolset import ToolPredicate
@@ -188,3 +189,13 @@ class APIHubToolset(BaseToolset):
   async def close(self):
     if self._openapi_toolset:
       await self._openapi_toolset.close()
+
+  @override
+  def get_auth_config(self) -> AuthConfig | None:
+    """Returns the auth config for this toolset."""
+    if self._auth_scheme is None:
+      return None
+    return AuthConfig(
+        auth_scheme=self._auth_scheme,
+        raw_auth_credential=self._auth_credential,
+    )

src/google/adk/tools/application_integration_tool/application_integration_toolset.py

@@ -28,6 +28,7 @@ from ...auth.auth_credential import AuthCredentialTypes
 from ...auth.auth_credential import ServiceAccount
 from ...auth.auth_credential import ServiceAccountCredential
 from ...auth.auth_schemes import AuthScheme
+from ...auth.auth_tool import AuthConfig
 from ..base_toolset import BaseToolset
 from ..base_toolset import ToolPredicate
 from ..openapi_tool.auth.auth_helpers import service_account_scheme_credential
@@ -278,3 +279,13 @@ class ApplicationIntegrationToolset(BaseToolset):
   async def close(self) -> None:
     if self._openapi_toolset:
       await self._openapi_toolset.close()
+
+  @override
+  def get_auth_config(self) -> AuthConfig | None:
+    """Returns the auth config for this toolset."""
+    if self._auth_scheme is None:
+      return None
+    return AuthConfig(
+        auth_scheme=self._auth_scheme,
+        raw_auth_credential=self._auth_credential,
+    )

src/google/adk/tools/base_toolset.py

@@ -28,6 +28,7 @@ from typing import TypeVar
 from typing import Union
 
 from ..agents.readonly_context import ReadonlyContext
+from ..auth.auth_tool import AuthConfig
 from .base_tool import BaseTool
 
 if TYPE_CHECKING:
@@ -204,3 +205,21 @@ class BaseToolset(ABC):
       llm_request: The outgoing LLM request, mutable this method.
     """
     pass
+
+  def get_auth_config(self) -> Optional[AuthConfig]:
+    """Returns the auth config for this toolset. ADK will make sure the
+    'exchanged_auth_credential' field in the config is populated with
+    ready-to-use credential (e.g. oauth token for OAuth flow) before calling
+    get_tools method or execute any tools returned by this toolset. Thus toolset
+    can use this credential either for tool listing or tool calling. If tool
+    calling needs a different credential from ADK client, call
+    tool_context.request_credential in the tool.
+
+    Toolsets that support authentication should override this method to return
+    an AuthConfig constructed from their auth_scheme, auth_credential, and
+    optional credential_key parameters.
+
+    Returns:
+      AuthConfig if the toolset has authentication configured, None otherwise.
+    """
+    return None

src/google/adk/tools/mcp_tool/mcp_toolset.py

@@ -39,6 +39,7 @@ from typing_extensions import override
 from ...agents.readonly_context import ReadonlyContext
 from ...auth.auth_credential import AuthCredential
 from ...auth.auth_schemes import AuthScheme
+from ...auth.auth_tool import AuthConfig
 from ..base_tool import BaseTool
 from ..base_toolset import BaseToolset
 from ..base_toolset import ToolPredicate
@@ -284,6 +285,16 @@ class McpToolset(BaseToolset):
       # Log the error but don't re-raise to avoid blocking shutdown
       print(f"Warning: Error during McpToolset cleanup: {e}", file=self._errlog)
 
+  @override
+  def get_auth_config(self) -> AuthConfig | None:
+    """Returns the auth config for this toolset."""
+    if self._auth_scheme is None:
+      return None
+    return AuthConfig(
+        auth_scheme=self._auth_scheme,
+        raw_auth_credential=self._auth_credential,
+    )
+
   @override
   @classmethod
   def from_config(

src/google/adk/tools/openapi_tool/openapi_spec_parser/openapi_toolset.py

@@ -32,6 +32,7 @@ import yaml
 from ....agents.readonly_context import ReadonlyContext
 from ....auth.auth_credential import AuthCredential
 from ....auth.auth_schemes import AuthScheme
+from ....auth.auth_tool import AuthConfig
 from ...base_toolset import BaseToolset
 from ...base_toolset import ToolPredicate
 from .openapi_spec_parser import OpenApiSpecParser
@@ -128,6 +129,8 @@ class OpenAPIToolset(BaseToolset):
     """
     super().__init__(tool_filter=tool_filter, tool_name_prefix=tool_name_prefix)
     self._header_provider = header_provider
+    self._auth_scheme = auth_scheme
+    self._auth_credential = auth_credential
     if not spec_dict:
       spec_dict = self._load_spec(spec_str, spec_str_type)
     self._ssl_verify = ssl_verify
@@ -211,3 +214,13 @@ class OpenAPIToolset(BaseToolset):
   @override
   async def close(self):
     pass
+
+  @override
+  def get_auth_config(self) -> AuthConfig | None:
+    """Returns the auth config for this toolset."""
+    if self._auth_scheme is None:
+      return None
+    return AuthConfig(
+        auth_scheme=self._auth_scheme,
+        raw_auth_credential=self._auth_credential,
+    )