@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/mcp-server.js

@@ -29,11 +29,11 @@ import { registerPrompts } from './prompts.js';
 import { checkGCP } from './lib/cloud-api/metadata.js';
 import { ensureGCPCredentials } from './lib/cloud-api/auth.js';
 import { extractAccessToken } from './lib/util/helpers.js';
+import { getDefaultAccessToken, validateAccessToken } from './lib/clients.js';
 import { oauthMiddleware } from './lib/middleware/oauth.js';
 import { config } from '@dotenvx/dotenvx';
 import {
   SCOPES,
-  GCLOUD_AUTH,
   BEARER_METHODS_SUPPORTED,
   RESPONSE_TYPES_SUPPORTED,
 } from './constants.js';
@@ -41,6 +41,16 @@ import {
 //Suppress the warning related to missing .env file in case of non-OAuth mode
 config({ quiet: true, ignore: ['MISSING_ENV_FILE'] });
 
+if (
+  process.env.OAUTH_ENABLED === 'true' &&
+  !process.env.GOOGLE_OAUTH_AUDIENCE
+) {
+  console.error(
+    'GOOGLE_OAUTH_AUDIENCE environment variable is required when OAuth is enabled.'
+  );
+  process.exit(1);
+}
+
 const gcpInfo = await checkGCP();
 let gcpCredentialsAvailable = false;
 
@@ -54,7 +64,11 @@ function makeLoggingCompatibleWithStdio() {
 }
 
 function shouldStartStdio() {
-  if (process.env.GCP_STDIO === 'false' || (gcpInfo && gcpInfo.project)) {
+  if (
+    process.env.GCP_STDIO === 'false' ||
+    process.env.OAUTH_ENABLED === 'true' ||
+    (gcpInfo && gcpInfo.project)
+  ) {
     return false;
   }
   return true;
@@ -69,12 +83,15 @@ const envProjectId = process.env.GOOGLE_CLOUD_PROJECT || undefined;
 const envRegion = process.env.GOOGLE_CLOUD_REGION;
 const defaultServiceName = process.env.DEFAULT_SERVICE_NAME;
 const skipIamCheck = process.env.SKIP_IAM_CHECK !== 'false';
+// Values for RUN_INGRESS_POLICY could be: "INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"
+const ingress = process.env.RUN_INGRESS_POLICY || undefined;
 const enableHostValidation = process.env.ENABLE_HOST_VALIDATION === 'true';
 const allowedHosts = process.env.ALLOWED_HOSTS
   ? process.env.ALLOWED_HOSTS.split(',')
   : undefined;
 
-async function getServer(accessToken = GCLOUD_AUTH) {
+async function getServer(accessToken = getDefaultAccessToken()) {
+  validateAccessToken(accessToken);
   // Create an MCP server with implementation details
   const server = new McpServer(
     {
@@ -107,6 +124,7 @@ async function getServer(accessToken = GCLOUD_AUTH) {
       defaultRegion: effectiveRegion,
       defaultServiceName,
       skipIamCheck,
+      ingress,
       gcpCredentialsAvailable,
       accessToken,
     });
@@ -120,6 +138,7 @@ async function getServer(accessToken = GCLOUD_AUTH) {
       defaultRegion: effectiveRegion,
       defaultServiceName,
       skipIamCheck,
+      ingress,
       gcpCredentialsAvailable,
       accessToken,
     });
@@ -185,9 +204,9 @@ if (shouldStartStdio()) {
 
   app.post('/mcp', oauthMiddleware, async (req, res) => {
     console.log('/mcp Received:', req.body);
-    const accessToken = extractAccessToken(req.headers.authorization);
-    const server = await getServer(accessToken);
     try {
+      const accessToken = extractAccessToken(req.headers.authorization);
+      const server = await getServer(accessToken);
       const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
       });
@@ -245,28 +264,72 @@ if (shouldStartStdio()) {
   const sseTransports = {};
 
   // Legacy SSE endpoint for older clients
-  app.get('/sse', async (req, res) => {
+  app.get('/sse', oauthMiddleware, async (req, res) => {
     console.log('/sse Received:', req.body);
-    const accessToken = extractAccessToken(req.headers.authorization);
-    const server = await getServer(accessToken);
-    // Create SSE transport for legacy clients
-    const transport = new SSEServerTransport('/messages', res);
-    sseTransports[transport.sessionId] = transport;
-
-    res.on('close', () => {
-      delete sseTransports[transport.sessionId];
-    });
+    try {
+      const accessToken = extractAccessToken(req.headers.authorization);
+      const server = await getServer(accessToken);
+      // Create SSE transport for legacy clients
+      const transport = new SSEServerTransport('/messages', res);
+      sseTransports[transport.sessionId] = { transport, accessToken };
+
+      res.on('close', () => {
+        delete sseTransports[transport.sessionId];
+      });
 
-    await server.connect(transport);
+      await server.connect(transport);
+    } catch (error) {
+      console.error('Error handling SSE request:', error);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: '2.0',
+          error: {
+            code: -32603,
+            message: 'Internal server error',
+          },
+          id: null,
+        });
+      }
+    }
   });
 
   // Legacy message endpoint for older clients
-  app.post('/messages', async (req, res) => {
+  app.post('/messages', oauthMiddleware, async (req, res) => {
     console.log('/messages Received:', req.body);
     const sessionId = req.query.sessionId;
-    const transport = sseTransports[sessionId];
-    if (transport) {
-      await transport.handlePostMessage(req, res, req.body);
+    const session = sseTransports[sessionId];
+    if (session) {
+      const accessToken = extractAccessToken(req.headers.authorization);
+      // Session is intentionally bound to the /sse access token; clients must reconnect to /sse on token change.
+      if (
+        process.env.OAUTH_ENABLED === 'true' &&
+        session.accessToken !== accessToken
+      ) {
+        return res.status(403).json({
+          jsonrpc: '2.0',
+          error: {
+            code: -32001,
+            message:
+              'Forbidden: session is bound to a different access token; reconnect to /sse',
+          },
+          id: null,
+        });
+      }
+      try {
+        await session.transport.handlePostMessage(req, res, req.body);
+      } catch (error) {
+        console.error('Error handling message request:', error);
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: '2.0',
+            error: {
+              code: -32603,
+              message: 'Internal server error',
+            },
+            id: null,
+          });
+        }
+      }
     } else {
       res.status(400).send('No transport found for sessionId');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google-cloud/cloud-run-mcp",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "type": "module",
   "description": "Cloud Run MCP deployment tool",
   "main": "mcp-server.js",
@@ -40,20 +40,23 @@
   },
   "homepage": "https://github.com/GoogleCloudPlatform/cloud-run-mcp#readme",
   "dependencies": {
+    "@dotenvx/dotenvx": "^1.52.0",
     "@google-cloud/artifact-registry": "^4.0.1",
     "@google-cloud/billing": "^5.0.1",
     "@google-cloud/cloudbuild": "^5.0.1",
     "@google-cloud/logging": "^11.2.0",
     "@google-cloud/resource-manager": "^6.0.1",
     "@google-cloud/run": "^3.1.0",
+    "@google-cloud/secret-manager": "^6.1.1",
     "@google-cloud/service-usage": "^4.1.0",
     "@google-cloud/storage": "^7.16.0",
     "@modelcontextprotocol/sdk": "^1.24.3",
-    "archiver": "^7.0.1",
-    "@dotenvx/dotenvx": "^1.52.0",
+    "archiver": "^8.0.0",
     "express": "^5.1.0",
     "google-proto-files": "^5.0.0",
-    "zod": "^3.25.76"
+    "googleapis": "^171.4.0",
+    "js-yaml": "^4.1.1",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "c8": "^10.1.3",

package/skills/cloud-run/SKILL.md

@@ -0,0 +1,109 @@
+---
+name: cloud-run
+description: 'Manage Cloud Run services and jobs.'
+metadata:
+  version: 0.1.0
+  openclaw:
+    category: 'compute'
+    requires:
+      bins:
+        - gcloud
+    cliHelp: 'gcloud run --help'
+---
+
+# run (v1)
+
+> **PREREQUISITE:** Ensure you have the `gcloud` CLI installed and authenticated with `gcloud auth login`. Set your project with `gcloud config set project [PROJECT_ID]`.
+
+```bash
+gcloud run <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command  | Description                                  |
+| -------- | -------------------------------------------- |
+| `deploy` | Create or update a Cloud Run service or job. |
+
+## API Resources
+
+### services
+
+- `list` — List available services in the specified region.
+- `describe` — Obtain details about a given service, such as its URL and configuration.
+- `update` — Update Cloud Run environment variables, concurrency settings, and other configuration.
+- `delete` — Delete a service and its associated revisions.
+- `update-traffic` — Adjust the traffic assignments for a Cloud Run service.
+- `proxy` — Proxy a service to localhost authenticating as the active account.
+- `logs read` — Read logs for a Cloud Run service.
+- `replace` - Create or replace a service from a YAML service specification.
+- `add-iam-policy-binding` — Add IAM policy binding to a Cloud Run service (e.g., to make it public).
+- `remove-iam-policy-binding` - Remove IAM policy binding of a Cloud Run service.
+- `get-iam-policy` - Get the IAM policy for a Cloud Run service.
+- `set-iam-policy` - Set the IAM policy for a Cloud Run service.
+
+### jobs
+
+- `create` — Create a Cloud Run job.
+- `execute` — Start an execution of a Cloud Run job.
+- `list` — List available jobs.
+- `describe` — Obtain details about a given job.
+- `deploy` - Create or update a Cloud Run job
+- `update` — Update a Cloud Run job configuration.
+- `delete` — Delete a Cloud Run job.
+- `replace` - Create or replace a Cloud Run job from a YAML job specification.
+- `executions list` — List executions of a Cloud Run job.
+- `logs read` — Read logs for a Cloud Run job.
+- `add-iam-policy-binding` — Add IAM policy binding to a Cloud Run job.
+- `remove-iam-policy-binding` - Remove IAM policy binding of a Cloud Run job.
+- `get-iam-policy` - Get the IAM policy for a Cloud Run job.
+- `set-iam-policy` - Set the IAM policy for a Cloud Run job.
+
+### domain-mappings
+
+- `list` — List domain mappings.
+- `create` — Create a new domain mapping.
+- `describe` — Obtain details about a domain mapping.
+- `delete` — Delete a domain mapping.
+
+### multi-region-services
+
+- `list` — List multi-region services.
+- `describe` — Obtain details about a multi-region service.
+- `update` — Update settings for multi-region services.
+- `delete` — Delete a multi-region service.
+- `replace` - Create or Update multi-region service from YAML specification.
+
+### revisions
+
+- `list` — List available revisions for a service.
+- `describe` — Obtain details about a specific revision.
+- `delete` — Delete a specific revision.
+
+### regions
+
+- `list` — View available Cloud Run (fully managed) regions.
+
+### compose
+
+- `up` — Deploy to Cloud Run from a compose specification.
+
+## Discovering Commands
+
+Before calling any command, inspect it for help:
+
+```bash
+# Browse resources and methods
+gcloud run --help
+
+# Inspect a specific resource methods
+gcloud run services --help
+
+# Inspect a specific resource's sub-group methods
+gcloud run jobs executions --help
+
+# Inspect a method's specific flags and arguments
+gcloud run deploy --help
+```
+
+Use the output of `--help` to discover available flags like `--image`, `--env-vars`, `--memory`, etc.

package/test/local/archive.test.js

@@ -0,0 +1,88 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { test, describe, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { zipFiles } from '../../lib/util/archive.js';
+
+describe('Archive Utility (zipFiles)', () => {
+  let tempDir;
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'archive-test-'));
+  });
+
+  afterEach(() => {
+    if (tempDir && fs.existsSync(tempDir)) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  test('creates a valid zip archive in memory from buffer objects', async () => {
+    const files = [
+      { filename: 'file1.txt', content: 'Hello World' },
+      { filename: 'file2.json', content: JSON.stringify({ key: 'value' }) },
+    ];
+
+    const zipBuffer = await zipFiles(files, false);
+    assert.ok(Buffer.isBuffer(zipBuffer));
+    assert.ok(zipBuffer.length > 0);
+  });
+
+  test('creates a valid tar.gz archive in memory from buffer objects', async () => {
+    const files = [{ filename: 'file1.txt', content: 'Hello World Tar' }];
+
+    const tarBuffer = await zipFiles(files, true);
+    assert.ok(Buffer.isBuffer(tarBuffer));
+    assert.ok(tarBuffer.length > 0);
+  });
+
+  test('creates archive from actual file paths on disk', async () => {
+    const testFilePath = path.join(tempDir, 'sample.txt');
+    fs.writeFileSync(testFilePath, 'Sample file content');
+
+    const zipBuffer = await zipFiles([testFilePath], false);
+    assert.ok(Buffer.isBuffer(zipBuffer));
+    assert.ok(zipBuffer.length > 0);
+  });
+
+  test('creates archive from directory path on disk', async () => {
+    const subDir = path.join(tempDir, 'subdir');
+    fs.mkdirSync(subDir);
+    fs.writeFileSync(path.join(subDir, 'nested.txt'), 'Nested content');
+
+    const zipBuffer = await zipFiles([subDir], false);
+    assert.ok(Buffer.isBuffer(zipBuffer));
+    assert.ok(zipBuffer.length > 0);
+  });
+
+  test('throws error if file path does not exist', async () => {
+    const nonExistentPath = path.join(tempDir, 'does-not-exist.txt');
+    await assert.rejects(
+      async () => {
+        await zipFiles([nonExistentPath], false);
+      },
+      {
+        message: new RegExp(
+          `File or directory not found: ${nonExistentPath.replace(/\\/g, '\\\\')}`
+        ),
+      }
+    );
+  });
+});