ModelsAtlas
Explore
Atlas / MCP servers / gannonh / Firebase

FirebaseCAUTION

mcp/gannonh/firebase
MCP server by gannonh · firebase · modelcontextprotocol · Audited 2026-10-06
⚑ Report / re-scanSource ↗

🔥 Model Context Protocol (MCP) server for Firebase.

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
12 7r · 4w · 1d
Transport
stdio · streamable-http
License
MIT
Stars
247
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/gannonh/firebase-mcp/actions/workflows/tests.yml)

Overview

Firebase MCP enables AI assistants to work directly with Firebase services, including:

  • Firestore: Document database operations
  • Storage: File management with robust upload capabilities
  • Authentication: User management and verification

The server works with MCP client applicatios such as Claude Desktop, Augment Code, VS Code, and Cursor.

⚠️ Known Issue: The firestore_list_collections tool may return a Zod validation error in the client logs. This is an erroneous validation error in the MCP SDK, as our investigation confirmed no boolean values are present in the response. Despite the error message, the query still works correctly and returns the proper collection data. This is a log-level error that doesn't affect functionality.

⚡ Quick Start

Prerequisites

  • Firebase project with service account credentials
  • Node.js environment

1. Install MCP Server

Add the server configuration to your MCP settings file:

  • Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Augment: ~/Library/Application Support/Code/User/settings.json
  • Cursor: [project root]/.cursor/mcp.json

MCP Servers can be installed manually or at runtime via npx (recommended). How you install determines your configuration:

Configure for npx (recommended)

{
"firebase-mcp": {
"command": "npx",
"args": [
"-y",
Read from source at commit d1da90c4eff9OBSERVED · 2026-10-06
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add firebase-mcp --env FIREBASE_AUTH_EMULATOR_HOST=${FIREBASE_AUTH_EMULATOR_HOST} --env SERVICE_ACCOUNT_KEY_PATH=${SERVICE_ACCOUNT_KEY_PATH} -- npx -y @gannonh/[email protected]
claude-desktop
{
  "mcpServers": {
    "firebase-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@gannonh/[email protected]"
      ],
      "env": {
        "FIREBASE_AUTH_EMULATOR_HOST": "${FIREBASE_AUTH_EMULATOR_HOST}",
        "SERVICE_ACCOUNT_KEY_PATH": "${SERVICE_ACCOUNT_KEY_PATH}"
      }
    }
  }
}
03

Exposed tools (12)

7 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
auth_get_userreadGet a user by ID or email from Firebase Authentication
firestore_add_documentwriteAdd a document to a Firestore collection
firestore_delete_documentdestructiveDelete a document from a Firestore collection
firestore_get_documentreadGet a document from a Firestore collection
firestore_list_collectionsreadList root collections in Firestore
firestore_list_documentsreadList documents from a Firestore collection with filtering and ordering
firestore_query_collection_groupreadQuery documents across all subcollections with the same name (collection group query)
firestore_update_documentwriteUpdate a document in a Firestore collection
storage_get_file_inforeadGet file information including metadata and download URL
storage_list_filesreadList files in a given path in Firebase Storage
storage_uploadwriteUpload a file to Firebase Storage. Supports local file paths (preferred for binary files), base64 data, or plain text.
storage_upload_from_urlwriteUpload a file to Firebase Storage from an external URL. Perfect for images, documents, or any file accessible via URL.
04

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (10)

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
.github/workflows/tests.yml:127
"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDJ5pM3yuFLQKr6\n6Ht9YuVvjGBr0OnmZv8Wwf1Go+lr1wH1aGGFuEBPQlFVXvrNmQXRPNKgPuI+HFaP\n4wuS4zJnCYPYLgLu5IRBM8t
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
firestore_delete_document
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.augmentignore
.augmentignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/firebase/__tests__/authClient.test.ts:3
import { logger } from '../../../utils/logger';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/firebase/__tests__/firebaseConfig.test.ts:24
import { getProjectId, initializeFirebase } from '../../firebase/firebaseConfig';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/firebase/__tests__/storageClient.test.ts:17
import { logger } from '../../../utils/logger.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/firebase/firestoreClient.ts:14
import { logger } from '../../utils/logger.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/firebase/storageClient.ts:16
import { logger } from '../../utils/logger.js';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, axios, dotenv, express, firebase-admin, @eslint/eslintrc, @eslint/js, @types/express
Why it matters. 19 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-06 · audit v0.4.1 · source sha d1da90c4eff9full audit observations/trust-audit/mcp-server/gannonh__firebase.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-06d1da90c4eff9CAUTIONB89first audit
06

Questions

What is the Firebase MCP server?

🔥 Model Context Protocol (MCP) server for Firebase.

What tools does Firebase expose?

12 in total: 7 read-only, 4 that write, and 1 that can delete or overwrite (firestore_delete_document). Every one is listed on this page with its risk.

Is Firebase safe to connect to an agent?

With care. The audit graded it B (89/100) and found 10 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Firebase need?

It reads FIREBASE_AUTH_EMULATOR_HOST and SERVICE_ACCOUNT_KEY_PATH from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Firebase run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @gannonh/firebase-mcp at 1.4.9.

How current is this page?

The grade is for one exact copy of the source (d1da90c4eff9), read on 2026-10-06. The repository is watched and re-audited when it changes.

Advertisement