@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/.github/workflows/npm-publish.yml

@@ -4,19 +4,23 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: write
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
         with:
-          node-version: 20
+          node-version: 24
       - run: npm ci
-      # Now configure with the publish service for install.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
         with:
-          node-version: 20
+          node-version: 24
           registry-url: https://wombat-dressing-room.appspot.com/
       - run: npm publish
         env:

package/README.md

@@ -60,6 +60,8 @@ The Cloud Run MCP server can be configured using the following environment varia
 | `SKIP_IAM_CHECK`         | Controls whether to check for IAM permissions for a Cloud Run service. Set to `false` to enable checks. This is `true` by default which is a recommended way to make the service public. |
 | `ENABLE_HOST_VALIDATION` | Prevents [DNS Rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks by validating the Host header. This is disabled by default.                                                |
 | `ALLOWED_HOSTS`          | Comma-separated list of allowed Host headers (if host validation is enabled). The default value is `localhost,127.0.0.1,::1`.                                                            |
+| `OAUTH_ENABLED`          | Enables OAuth 2.0 Bearer token verification for incoming HTTP/SSE requests when set to `true`. Disabled by default.                                                                      |
+| `GOOGLE_OAUTH_AUDIENCE`  | Expected OAuth 2.0 token audience (typically your OAuth Client ID). Required when `OAUTH_ENABLED=true`.                                                                                  |
 
 ## Use as a Gemini CLI extension
 
@@ -274,3 +276,27 @@ Post the configuration changes as shown above, start the Gemini CLI. You should
 This will take you to the authentication page on your browser, wherein you need to sign in using the appropriate gmail id, and accept the terms and conditions. Once the authentication is succcessful, you can come back to the Gemini CLI, and the Cloud Run MCP server will be ready to use.
 
 The Google Cloud Platform Terms of Service (available at https://cloud.google.com/terms/) and the Data Processing and Security Terms (available at https://cloud.google.com/terms/data-processing-terms) do not apply to any component of the Cloud Run MCP Server software.
+
+# Cloud Run Skills
+
+We introduce Cloud Run skills to enable AI agents to perform actions on Cloud Run. You can use these skills with Gemini CLI and other agentic AI tools. The skills are available at [Cloud Run Skills](https://github.com/GoogleCloudPlatform/cloud-run-mcp/blob/main/skills/cloud-run/SKILL.md).
+
+The Cloud Run skills are based on top of gcloud cli for Cloud Run empowering agents to perform all the actions on the Cloud Run using gcloud, as can be performed by the GCP user using gcloud cli.
+
+In order to use Cloud Run skills:
+
+1. Ensure you have the `gcloud` CLI installed and authenticated with `gcloud auth login` and `gcloud auth application-default login`.
+2. Set your project with `gcloud config set project [PROJECT_ID]`.
+3. Enable the skills on your agentic AI tool. For example, you can enable the skills for Gemini CLI using the following command on your terminal:
+
+```bash
+gemini skills install https://github.com/GoogleCloudPlatform/cloud-run-mcp.git --path skills/cloud-run
+```
+
+4. Once the skills are enabled, you can use them to perform actions on Cloud Run. Here are some of the prompts for you to get started:
+
+- List the Cloud Run services in the project test-gcp-project in the region us-west1.
+
+- Deploy the folder /home/username/workspace/hello-world as Cloud Run service hello-world to the project test-gcp-project in the region us-west1.
+
+- Describe the Cloud Run job hello-job in the project test-gcp-project in the region europe-west1.

package/SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+To report a security issue, please use [g.co/vulnz](https://g.co/vulnz).
+
+The Google Security Team will respond within 5 working days of your report on [g.co/vulnz](https://g.co/vulnz).
+
+We use [g.co/vulnz](https://g.co/vulnz) for our intake, and do coordination and disclosure here using GitHub Security Advisory to privately discuss and fix the issue.

package/cloudbuild.yaml

@@ -0,0 +1,37 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Default cloudbuild.yaml for Cloud Shell custom images.
+# This file is used by the Cloud Build trigger that builds this image.
+
+substitutions:
+  _IMAGE_TAG: '${COMMIT_SHA}'
+
+steps:
+  - name: 'gcr.io/cloud-builders/docker'
+    args:
+      [
+        'build',
+        '-t',
+        'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:latest',
+        '-t',
+        'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:public-image-${_IMAGE_TAG}',
+        '.',
+      ]
+images:
+  - 'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:latest'
+  - 'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:public-image-${_IMAGE_TAG}'
+
+options:
+  dynamicSubstitutions: true

package/example-sources-to-deploy/java/pom.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>3.2.2</version>
+		<relativePath/> <!-- lookup parent from repository -->
+	</parent>
+	<groupId>com.example</groupId>
+	<artifactId>helloworld</artifactId>
+	<version>0.0.1-SNAPSHOT</version>
+	<name>helloworld</name>
+	<description>Demo project for Spring Boot</description>
+	<properties>
+		<java.version>17</java.version>
+	</properties>
+	<dependencies>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-web</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-maven-plugin</artifactId>
+			</plugin>
+		</plugins>
+	</build>
+
+</project>

package/example-sources-to-deploy/java/src/main/java/com/example/helloworld/HelloworldApplication.java

@@ -0,0 +1,21 @@
+package com.example.helloworld;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@SpringBootApplication
+@RestController
+public class HelloworldApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(HelloworldApplication.class, args);
+	}
+
+	@GetMapping("/")
+	public String hello() {
+		return "Hello from Spring Boot on Cloud Run!";
+	}
+
+}

package/example-sources-to-deploy/java/src/main/resources/application.properties

@@ -0,0 +1 @@
+server.port=${PORT:8080}

package/example-sources-to-deploy/nodejs/index.js

@@ -0,0 +1,15 @@
+const express = require('express');
+const app = express();
+const port = process.env.PORT || 8080;
+
+app.get('/', (req, res) => {
+  res.send('Hello from Node.js on Cloud Run!');
+});
+
+app.get('/health', (req, res) => {
+  res.status(200).send('OK');
+});
+
+app.listen(port, () => {
+  console.log(`Nodejs sample app listening at http://localhost:${port}`);
+});

package/example-sources-to-deploy/nodejs/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "nodejs-sample-app",
+  "version": "1.0.0",
+  "description": "A simple Node.js sample application for Cloud Run",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js"
+  },
+  "dependencies": {
+    "express": "^4.18.2"
+  }
+}

package/example-sources-to-deploy/python/pip-project/main.py

@@ -0,0 +1,11 @@
+from flask import Flask, request
+
+app = Flask(__name__)
+
+@app.route('/')
+def hello():
+    user = request.args.get('user', 'World')
+    return f'Hello {user}'
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=8080)

package/example-sources-to-deploy/python/pip-project/requirements.txt

@@ -0,0 +1,2 @@
+Flask
+gunicorn

package/example-sources-to-deploy/python/pyproject-project/main.py

@@ -0,0 +1,11 @@
+from flask import Flask, request
+
+app = Flask(__name__)
+
+@app.route('/')
+def hello_world():
+    user = request.args.get('user', 'World')
+    return f'Hello {user}'
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=8080)

package/example-sources-to-deploy/python/pyproject-project/pyproject.toml

@@ -0,0 +1,10 @@
+[project]
+name = "pyproject-project"
+version = "0.1.0"
+dependencies = [
+    "Flask",
+    "gunicorn",
+]
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"

package/lib/clients.js

@@ -22,12 +22,30 @@ const CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET;
 const REDIRECT_URI = process.env.GOOGLE_OAUTH_REDIRECT_URI;
 const AUTHORIZATION_HEADER = 'Authorization';
 const BEARER_PREFIX = 'Bearer';
+const CLOUD_PLATFORM_SCOPE = 'https://www.googleapis.com/auth/cloud-platform';
 
-function keyGenerator(projectId, accessToken) {
-  return accessToken !== GCLOUD_AUTH ? projectId + accessToken : projectId;
+export function getDefaultAccessToken() {
+  return process.env.OAUTH_ENABLED === 'true' ? undefined : GCLOUD_AUTH;
 }
 
-const clients = {
+export function validateAccessToken(accessToken) {
+  if (
+    process.env.OAUTH_ENABLED === 'true' &&
+    (!accessToken || accessToken === GCLOUD_AUTH)
+  ) {
+    throw new Error('Access token is required when OAuth is enabled.');
+  }
+}
+
+function keyGenerator(projectId, accessToken, region = '') {
+  const baseKey =
+    accessToken && accessToken !== GCLOUD_AUTH
+      ? projectId + accessToken
+      : projectId;
+  return baseKey + (region || '');
+}
+
+export const clients = {
   run: new Map(),
   builds: new Map(),
   serviceUsage: new Map(),
@@ -37,7 +55,9 @@ const clients = {
   logging: new Map(),
   billing: new Map(),
   projects: new Map(),
+  runV1: new Map(),
   oauth: new Map(),
+  secretManager: new Map(),
 };
 
 function getAuthClient(accessToken) {
@@ -98,6 +118,7 @@ export async function getClient(
   options = {},
   accessToken = null
 ) {
+  validateAccessToken(accessToken);
   if (!clients[service].has(key)) {
     const ClientClass = await loadClient();
     const finalOptions = { ...options };
@@ -121,7 +142,10 @@ export async function getClient(
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/run').v2.ServicesClient>}
  */
-export async function getRunClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getRunClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'run',
@@ -137,7 +161,10 @@ export async function getRunClient(projectId, accessToken = GCLOUD_AUTH) {
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/run').v2.BuildsClient>}
  */
-export async function getBuildsClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getBuildsClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'builds',
@@ -155,7 +182,7 @@ export async function getBuildsClient(projectId, accessToken = GCLOUD_AUTH) {
  */
 export async function getServiceUsageClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -173,7 +200,10 @@ export async function getServiceUsageClient(
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/storage').Storage>}
  */
-export async function getStorageClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getStorageClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'storage',
@@ -191,7 +221,7 @@ export async function getStorageClient(projectId, accessToken = GCLOUD_AUTH) {
  */
 export async function getCloudBuildClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -210,7 +240,7 @@ export async function getCloudBuildClient(
  */
 export async function getArtifactRegistryClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -228,7 +258,10 @@ export async function getArtifactRegistryClient(
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/logging').Logging>}
  */
-export async function getLoggingClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getLoggingClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'logging',
@@ -248,7 +281,7 @@ export async function getLoggingClient(projectId, accessToken = GCLOUD_AUTH) {
  */
 export async function getBillingClient(
   projectId = 'global',
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -264,7 +297,7 @@ export async function getBillingClient(
  * Gets a Projects Client (Resource Manager).
  * @returns {Promise<import('@google-cloud/resource-manager').ProjectsClient>}
  */
-export async function getProjectsClient(accessToken = GCLOUD_AUTH) {
+export async function getProjectsClient(accessToken = getDefaultAccessToken()) {
   const key = keyGenerator('global', accessToken);
   return getClient(
     'projects',
@@ -275,6 +308,26 @@ export async function getProjectsClient(accessToken = GCLOUD_AUTH) {
   );
 }
 
+/**
+ * Gets a Secret Manager Client for the specified project.
+ * @param {string} projectId - The Google Cloud project ID.
+ * @returns {Promise<import('@google-cloud/secret-manager').SecretManagerServiceClient>}
+ */
+export async function getSecretManagerClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
+  const key = keyGenerator(projectId, accessToken);
+  return getClient(
+    'secretManager',
+    key,
+    async () =>
+      (await import('@google-cloud/secret-manager')).SecretManagerServiceClient,
+    { projectId },
+    accessToken
+  );
+}
+
 /**
  * Gets an OAuth2 Client for the specified access token.
  * @param {string} accessToken - The access token.
@@ -290,3 +343,80 @@ export async function getOAuthClient(accessToken) {
 
   return clients.oauth.get(accessToken);
 }
+
+/**
+ * Gets a Cloud Run v1 Client (from googleapis).
+ * @param {string} projectId - The Google Cloud project ID.
+ * @param {string} accessToken - Access token for authentication.
+ * @param {string} [region] - The Google Cloud region (optional).
+ * @returns {Promise<import('googleapis').run_v1.Run>}
+ */
+export async function getRunV1Client(
+  projectId,
+  accessToken = getDefaultAccessToken(),
+  region = null
+) {
+  validateAccessToken(accessToken);
+  const key = keyGenerator(projectId, accessToken, region);
+  if (!clients.runV1.has(key)) {
+    const { google } = await import('googleapis');
+    const options = { version: 'v1' };
+
+    if (accessToken && accessToken !== GCLOUD_AUTH) {
+      options.auth = await getOAuthClient(accessToken);
+    } else {
+      // Use Application Default Credentials for GCLOUD_AUTH
+      const auth = new google.auth.GoogleAuth({
+        scopes: [CLOUD_PLATFORM_SCOPE],
+        projectId: projectId,
+      });
+      options.auth = auth;
+    }
+
+    if (region) {
+      const availableRegions = await getCloudRunRegions(projectId, accessToken);
+      if (!availableRegions.includes(region)) {
+        throw new Error(`Invalid region: ${region}.`);
+      }
+      options.rootUrl = `https://${region}-run.googleapis.com/`;
+    }
+    clients.runV1.set(key, google.run(options));
+  }
+  return clients.runV1.get(key);
+}
+
+let cachedRegions = null;
+
+/**
+ * Resets the cached regions. Used for testing.
+ */
+export function resetCachedRegions() {
+  cachedRegions = null;
+}
+
+/**
+ * Returns a list of supported Cloud Run regions by fetching them from Compute Engine API.
+ * This is the SDK equivalent of `gcloud compute regions list`.
+ * Note: This is not moved to utils as it is required by getRunV1Client. Moving it to utils
+ * would lead to circular dependency.
+ * @param {string} projectId - The project ID to fetch regions for.
+ * @param {string} accessToken - The access token for authentication.
+ * @returns {Promise<string[]>}
+ */
+export async function getCloudRunRegions(projectId, accessToken) {
+  if (cachedRegions) {
+    return cachedRegions;
+  }
+  const runClient = await getRunClient(projectId, accessToken);
+  const iterable = runClient.listLocationsAsync({
+    name: `projects/${projectId}`,
+  });
+
+  const regions = [];
+  for await (const region of iterable) {
+    regions.push(region.locationId);
+  }
+
+  cachedRegions = regions;
+  return cachedRegions;
+}