@google-cloud/cloud-run-mcp 1.11.0 → 1.12.0

package/.github/workflows/npm-publish.yml

@@ -4,19 +4,23 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: write
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
         with:
-          node-version: 20
+          node-version: 24
       - run: npm ci
-      # Now configure with the publish service for install.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
         with:
-          node-version: 20
+          node-version: 24
           registry-url: https://wombat-dressing-room.appspot.com/
       - run: npm publish
         env:

package/README.md

@@ -60,6 +60,8 @@ The Cloud Run MCP server can be configured using the following environment varia
 | `SKIP_IAM_CHECK`         | Controls whether to check for IAM permissions for a Cloud Run service. Set to `false` to enable checks. This is `true` by default which is a recommended way to make the service public. |
 | `ENABLE_HOST_VALIDATION` | Prevents [DNS Rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks by validating the Host header. This is disabled by default.                                                |
 | `ALLOWED_HOSTS`          | Comma-separated list of allowed Host headers (if host validation is enabled). The default value is `localhost,127.0.0.1,::1`.                                                            |
+| `OAUTH_ENABLED`          | Enables OAuth 2.0 Bearer token verification for incoming HTTP/SSE requests when set to `true`. Disabled by default.                                                                      |
+| `GOOGLE_OAUTH_AUDIENCE`  | Expected OAuth 2.0 token audience (typically your OAuth Client ID). Required when `OAUTH_ENABLED=true`.                                                                                  |
 
 ## Use as a Gemini CLI extension
 

package/lib/clients.js

@@ -24,9 +24,24 @@ const AUTHORIZATION_HEADER = 'Authorization';
 const BEARER_PREFIX = 'Bearer';
 const CLOUD_PLATFORM_SCOPE = 'https://www.googleapis.com/auth/cloud-platform';
 
+export function getDefaultAccessToken() {
+  return process.env.OAUTH_ENABLED === 'true' ? undefined : GCLOUD_AUTH;
+}
+
+export function validateAccessToken(accessToken) {
+  if (
+    process.env.OAUTH_ENABLED === 'true' &&
+    (!accessToken || accessToken === GCLOUD_AUTH)
+  ) {
+    throw new Error('Access token is required when OAuth is enabled.');
+  }
+}
+
 function keyGenerator(projectId, accessToken, region = '') {
   const baseKey =
-    accessToken !== GCLOUD_AUTH ? projectId + accessToken : projectId;
+    accessToken && accessToken !== GCLOUD_AUTH
+      ? projectId + accessToken
+      : projectId;
   return baseKey + (region || '');
 }
 
@@ -103,6 +118,7 @@ export async function getClient(
   options = {},
   accessToken = null
 ) {
+  validateAccessToken(accessToken);
   if (!clients[service].has(key)) {
     const ClientClass = await loadClient();
     const finalOptions = { ...options };
@@ -126,7 +142,10 @@ export async function getClient(
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/run').v2.ServicesClient>}
  */
-export async function getRunClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getRunClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'run',
@@ -142,7 +161,10 @@ export async function getRunClient(projectId, accessToken = GCLOUD_AUTH) {
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/run').v2.BuildsClient>}
  */
-export async function getBuildsClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getBuildsClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'builds',
@@ -160,7 +182,7 @@ export async function getBuildsClient(projectId, accessToken = GCLOUD_AUTH) {
  */
 export async function getServiceUsageClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -178,7 +200,10 @@ export async function getServiceUsageClient(
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/storage').Storage>}
  */
-export async function getStorageClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getStorageClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'storage',
@@ -196,7 +221,7 @@ export async function getStorageClient(projectId, accessToken = GCLOUD_AUTH) {
  */
 export async function getCloudBuildClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -215,7 +240,7 @@ export async function getCloudBuildClient(
  */
 export async function getArtifactRegistryClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -233,7 +258,10 @@ export async function getArtifactRegistryClient(
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<import('@google-cloud/logging').Logging>}
  */
-export async function getLoggingClient(projectId, accessToken = GCLOUD_AUTH) {
+export async function getLoggingClient(
+  projectId,
+  accessToken = getDefaultAccessToken()
+) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
     'logging',
@@ -253,7 +281,7 @@ export async function getLoggingClient(projectId, accessToken = GCLOUD_AUTH) {
  */
 export async function getBillingClient(
   projectId = 'global',
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -269,7 +297,7 @@ export async function getBillingClient(
  * Gets a Projects Client (Resource Manager).
  * @returns {Promise<import('@google-cloud/resource-manager').ProjectsClient>}
  */
-export async function getProjectsClient(accessToken = GCLOUD_AUTH) {
+export async function getProjectsClient(accessToken = getDefaultAccessToken()) {
   const key = keyGenerator('global', accessToken);
   return getClient(
     'projects',
@@ -287,7 +315,7 @@ export async function getProjectsClient(accessToken = GCLOUD_AUTH) {
  */
 export async function getSecretManagerClient(
   projectId,
-  accessToken = GCLOUD_AUTH
+  accessToken = getDefaultAccessToken()
 ) {
   const key = keyGenerator(projectId, accessToken);
   return getClient(
@@ -325,9 +353,10 @@ export async function getOAuthClient(accessToken) {
  */
 export async function getRunV1Client(
   projectId,
-  accessToken = GCLOUD_AUTH,
+  accessToken = getDefaultAccessToken(),
   region = null
 ) {
+  validateAccessToken(accessToken);
   const key = keyGenerator(projectId, accessToken, region);
   if (!clients.runV1.has(key)) {
     const { google } = await import('googleapis');

package/lib/middleware/oauth.js

@@ -1,8 +1,6 @@
-import { getOAuthClient } from '../clients.js';
+import { clients, getOAuthClient } from '../clients.js';
 import { extractAccessToken } from '../util/helpers.js';
 
-const TOOLS_CALL_METHOD = 'tools/call';
-
 /**
  * Verifies the validity of an access token and checks the audience.
  * @param {string} accessToken - The access token to verify.
@@ -16,13 +14,14 @@ async function verifyAccessToken(accessToken, audience) {
     const tokenInfo = await client.getTokenInfo(accessToken);
 
     //An expired token will not have audience
-    if (audience && tokenInfo.aud !== audience) {
-      throw new Error(`Invalid audience: expected ${audience}`);
+    if (!audience || tokenInfo.aud !== audience) {
+      throw new Error('Invalid token audience');
     }
 
     console.log('Access token verified successfully.');
     return tokenInfo;
   } catch (error) {
+    clients.oauth.delete(accessToken);
     console.error('Error verifying access token:', error);
     throw error;
   }
@@ -43,11 +42,19 @@ async function ensureOAuthTokenInEnv(req, res) {
       console.log('No authorization header found in request');
       throw new Error('No authorization header');
     }
+    const accessToken = extractAccessToken(req.headers.authorization);
+    if (!accessToken) {
+      console.log('No access token found in authorization header');
+      throw new Error('No access token found in authorization header');
+    }
+    if (!audience) {
+      console.log('GOOGLE_OAUTH_AUDIENCE environment variable is missing');
+      throw new Error(
+        'GOOGLE_OAUTH_AUDIENCE environment variable is required when OAuth is enabled.'
+      );
+    }
     console.log('Authorization header found.. Verifying token');
-    await verifyAccessToken(
-      extractAccessToken(req.headers.authorization),
-      audience
-    );
+    await verifyAccessToken(accessToken, audience);
     console.log('Token verified');
   } catch (error) {
     console.error('Authentication failed: ', error);
@@ -64,11 +71,8 @@ async function ensureOAuthTokenInEnv(req, res) {
  * @param {import('express').NextFunction} next
  */
 export const oauthMiddleware = async (req, res, next) => {
-  //If OAUTH_ENABLED is not true or the request is not a tools/call, skip the middleware
-  if (
-    process.env.OAUTH_ENABLED !== 'true' ||
-    req.body.method !== TOOLS_CALL_METHOD
-  ) {
+  //If OAUTH_ENABLED is not true, skip the middleware
+  if (process.env.OAUTH_ENABLED !== 'true') {
     return next();
   }
 
@@ -79,12 +83,19 @@ export const oauthMiddleware = async (req, res, next) => {
     console.error('OAuth Middleware Error:', error);
     // ensureOAuthTokenInEnv throws an error if auth fails.
     // We catch it and send a 401 response.
+    if (process.env.OAUTH_PROTECTED_RESOURCE) {
+      const metadataUrl = new URL(
+        '/.well-known/oauth-protected-resource',
+        process.env.OAUTH_PROTECTED_RESOURCE
+      ).href;
+      res.set('WWW-Authenticate', `Bearer resource_metadata="${metadataUrl}"`);
+    }
     res.status(401).json({
       jsonrpc: '2.0',
       error: {
         code: -32001, // Custom auth error code or standard -32000
         message: 'Authentication failed',
-        data: error.message,
+        data: 'Invalid or missing access token',
       },
       id: null,
     });

package/mcp-server.js

@@ -29,11 +29,11 @@ import { registerPrompts } from './prompts.js';
 import { checkGCP } from './lib/cloud-api/metadata.js';
 import { ensureGCPCredentials } from './lib/cloud-api/auth.js';
 import { extractAccessToken } from './lib/util/helpers.js';
+import { getDefaultAccessToken, validateAccessToken } from './lib/clients.js';
 import { oauthMiddleware } from './lib/middleware/oauth.js';
 import { config } from '@dotenvx/dotenvx';
 import {
   SCOPES,
-  GCLOUD_AUTH,
   BEARER_METHODS_SUPPORTED,
   RESPONSE_TYPES_SUPPORTED,
 } from './constants.js';
@@ -41,6 +41,16 @@ import {
 //Suppress the warning related to missing .env file in case of non-OAuth mode
 config({ quiet: true, ignore: ['MISSING_ENV_FILE'] });
 
+if (
+  process.env.OAUTH_ENABLED === 'true' &&
+  !process.env.GOOGLE_OAUTH_AUDIENCE
+) {
+  console.error(
+    'GOOGLE_OAUTH_AUDIENCE environment variable is required when OAuth is enabled.'
+  );
+  process.exit(1);
+}
+
 const gcpInfo = await checkGCP();
 let gcpCredentialsAvailable = false;
 
@@ -54,7 +64,11 @@ function makeLoggingCompatibleWithStdio() {
 }
 
 function shouldStartStdio() {
-  if (process.env.GCP_STDIO === 'false' || (gcpInfo && gcpInfo.project)) {
+  if (
+    process.env.GCP_STDIO === 'false' ||
+    process.env.OAUTH_ENABLED === 'true' ||
+    (gcpInfo && gcpInfo.project)
+  ) {
     return false;
   }
   return true;
@@ -76,7 +90,8 @@ const allowedHosts = process.env.ALLOWED_HOSTS
   ? process.env.ALLOWED_HOSTS.split(',')
   : undefined;
 
-async function getServer(accessToken = GCLOUD_AUTH) {
+async function getServer(accessToken = getDefaultAccessToken()) {
+  validateAccessToken(accessToken);
   // Create an MCP server with implementation details
   const server = new McpServer(
     {
@@ -189,9 +204,9 @@ if (shouldStartStdio()) {
 
   app.post('/mcp', oauthMiddleware, async (req, res) => {
     console.log('/mcp Received:', req.body);
-    const accessToken = extractAccessToken(req.headers.authorization);
-    const server = await getServer(accessToken);
     try {
+      const accessToken = extractAccessToken(req.headers.authorization);
+      const server = await getServer(accessToken);
       const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
       });
@@ -249,28 +264,72 @@ if (shouldStartStdio()) {
   const sseTransports = {};
 
   // Legacy SSE endpoint for older clients
-  app.get('/sse', async (req, res) => {
+  app.get('/sse', oauthMiddleware, async (req, res) => {
     console.log('/sse Received:', req.body);
-    const accessToken = extractAccessToken(req.headers.authorization);
-    const server = await getServer(accessToken);
-    // Create SSE transport for legacy clients
-    const transport = new SSEServerTransport('/messages', res);
-    sseTransports[transport.sessionId] = transport;
-
-    res.on('close', () => {
-      delete sseTransports[transport.sessionId];
-    });
+    try {
+      const accessToken = extractAccessToken(req.headers.authorization);
+      const server = await getServer(accessToken);
+      // Create SSE transport for legacy clients
+      const transport = new SSEServerTransport('/messages', res);
+      sseTransports[transport.sessionId] = { transport, accessToken };
+
+      res.on('close', () => {
+        delete sseTransports[transport.sessionId];
+      });
 
-    await server.connect(transport);
+      await server.connect(transport);
+    } catch (error) {
+      console.error('Error handling SSE request:', error);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: '2.0',
+          error: {
+            code: -32603,
+            message: 'Internal server error',
+          },
+          id: null,
+        });
+      }
+    }
   });
 
   // Legacy message endpoint for older clients
-  app.post('/messages', async (req, res) => {
+  app.post('/messages', oauthMiddleware, async (req, res) => {
     console.log('/messages Received:', req.body);
     const sessionId = req.query.sessionId;
-    const transport = sseTransports[sessionId];
-    if (transport) {
-      await transport.handlePostMessage(req, res, req.body);
+    const session = sseTransports[sessionId];
+    if (session) {
+      const accessToken = extractAccessToken(req.headers.authorization);
+      // Session is intentionally bound to the /sse access token; clients must reconnect to /sse on token change.
+      if (
+        process.env.OAUTH_ENABLED === 'true' &&
+        session.accessToken !== accessToken
+      ) {
+        return res.status(403).json({
+          jsonrpc: '2.0',
+          error: {
+            code: -32001,
+            message:
+              'Forbidden: session is bound to a different access token; reconnect to /sse',
+          },
+          id: null,
+        });
+      }
+      try {
+        await session.transport.handlePostMessage(req, res, req.body);
+      } catch (error) {
+        console.error('Error handling message request:', error);
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: '2.0',
+            error: {
+              code: -32603,
+              message: 'Internal server error',
+            },
+            id: null,
+          });
+        }
+      }
     } else {
       res.status(400).send('No transport found for sessionId');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google-cloud/cloud-run-mcp",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "type": "module",
   "description": "Cloud Run MCP deployment tool",
   "main": "mcp-server.js",
@@ -56,7 +56,7 @@
     "google-proto-files": "^5.0.0",
     "googleapis": "^171.4.0",
     "js-yaml": "^4.1.1",
-    "zod": "^3.25.76"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "c8": "^10.1.3",

package/test/local/clients.test.js

@@ -4,6 +4,7 @@ import { google } from 'googleapis';
 import {
   clients,
   getClient,
+  getRunClient,
   getRunV1Client,
   getCloudRunRegions,
   resetCachedRegions,
@@ -181,6 +182,62 @@ describe('getClient Helper', () => {
 
     assert.strictEqual(client.options.extraOpt, extraOpt);
   });
+
+  test('throws error when OAUTH_ENABLED=true and accessToken is missing or GCLOUD_AUTH', async () => {
+    const originalOAuth = process.env.OAUTH_ENABLED;
+    process.env.OAUTH_ENABLED = 'true';
+    try {
+      const projectId = 'test-project-oauth-err';
+      const service = 'run';
+
+      await assert.rejects(
+        async () =>
+          getClient(
+            service,
+            projectId,
+            async () => MockClient,
+            { projectId },
+            null
+          ),
+        /Access token is required when OAuth is enabled/
+      );
+
+      await assert.rejects(
+        async () =>
+          getClient(
+            service,
+            projectId,
+            async () => MockClient,
+            { projectId },
+            undefined
+          ),
+        /Access token is required when OAuth is enabled/
+      );
+
+      await assert.rejects(
+        async () =>
+          getClient(
+            service,
+            projectId,
+            async () => MockClient,
+            { projectId },
+            GCLOUD_AUTH
+          ),
+        /Access token is required when OAuth is enabled/
+      );
+
+      await assert.rejects(
+        async () => getRunClient(projectId),
+        /Access token is required when OAuth is enabled/
+      );
+    } finally {
+      if (originalOAuth === undefined) {
+        delete process.env.OAUTH_ENABLED;
+      } else {
+        process.env.OAUTH_ENABLED = originalOAuth;
+      }
+    }
+  });
 });
 
 describe('getRunV1Client', () => {
@@ -324,6 +381,32 @@ describe('getRunV1Client', () => {
       clients.run.clear();
     }
   });
+
+  test('throws error when OAUTH_ENABLED=true and accessToken is missing or GCLOUD_AUTH', async () => {
+    const originalOAuth = process.env.OAUTH_ENABLED;
+    process.env.OAUTH_ENABLED = 'true';
+    try {
+      const projectId = 'test-project-v1-oauth-err';
+      await assert.rejects(
+        async () => getRunV1Client(projectId),
+        /Access token is required when OAuth is enabled/
+      );
+      await assert.rejects(
+        async () => getRunV1Client(projectId, undefined),
+        /Access token is required when OAuth is enabled/
+      );
+      await assert.rejects(
+        async () => getRunV1Client(projectId, GCLOUD_AUTH),
+        /Access token is required when OAuth is enabled/
+      );
+    } finally {
+      if (originalOAuth === undefined) {
+        delete process.env.OAUTH_ENABLED;
+      } else {
+        process.env.OAUTH_ENABLED = originalOAuth;
+      }
+    }
+  });
 });
 
 describe('getCloudRunRegions', () => {

package/test/local/mcp-server-streamable-http.test.js

@@ -3,6 +3,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { test, describe, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'child_process';
+import { pathToFileURL } from 'node:url';
 import { waitForString } from './test-utils.js';
 import {
   SCOPES,
@@ -76,18 +77,35 @@ describe('OAuth Endpoints', () => {
 
   before(async () => {
     stdout = '';
-    serverProcess = spawn('node', ['mcp-server.js'], {
-      cwd: process.cwd(),
-      env: {
-        ...process.env,
-        GCP_STDIO: 'false',
-        PORT: '3001',
-        OAUTH_PROTECTED_RESOURCE: oauthProtectedResource,
-        OAUTH_AUTHORIZATION_SERVER: oauthAuthorizationServer,
-        OAUTH_AUTHORIZATION_ENDPOINT: oauthAuthorizationEndpoint,
-        OAUTH_TOKEN_ENDPOINT: oauthTokenEndpoint,
-      },
-    });
+    const clientsUrl = pathToFileURL(`${process.cwd()}/lib/clients.js`).href;
+    // Note: verifyAccessToken evicts clients.oauth entries on any verification failure,
+    // so only use these pre-seeded tokens in test cases where token verification succeeds.
+    const preloadScript = `import { clients } from '${clientsUrl}';
+      const mockClient = { getTokenInfo: async () => ({ aud: 'test-audience' }) };
+      clients.oauth.set('token-user-a', mockClient);
+      clients.oauth.set('token-user-b', mockClient);`;
+    serverProcess = spawn(
+      'node',
+      [
+        '--import',
+        `data:text/javascript,${encodeURIComponent(preloadScript)}`,
+        'mcp-server.js',
+      ],
+      {
+        cwd: process.cwd(),
+        env: {
+          ...process.env,
+          GCP_STDIO: 'false',
+          PORT: '3001',
+          OAUTH_PROTECTED_RESOURCE: oauthProtectedResource,
+          OAUTH_AUTHORIZATION_SERVER: oauthAuthorizationServer,
+          OAUTH_AUTHORIZATION_ENDPOINT: oauthAuthorizationEndpoint,
+          OAUTH_TOKEN_ENDPOINT: oauthTokenEndpoint,
+          OAUTH_ENABLED: 'true',
+          GOOGLE_OAUTH_AUDIENCE: 'test-audience',
+        },
+      }
+    );
     stdout = await waitForString(serverProcess.stdout, httpMsg);
   });
 
@@ -127,4 +145,106 @@ describe('OAuth Endpoints', () => {
       response_types_supported: [...RESPONSE_TYPES_SUPPORTED],
     });
   });
+
+  test('should reject unauthenticated POST /mcp with JSON array body with 401', async () => {
+    const response = await fetch('http://localhost:3001/mcp', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify([
+        { jsonrpc: '2.0', method: 'tools/call', params: {}, id: 1 },
+      ]),
+    });
+    assert.equal(response.status, 401);
+  });
+
+  test('should reject unauthenticated GET /sse with 401 and WWW-Authenticate header', async () => {
+    const response = await fetch('http://localhost:3001/sse');
+    assert.equal(response.status, 401);
+    assert.equal(
+      response.headers.get('www-authenticate'),
+      'Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource"'
+    );
+  });
+
+  test('should reject unauthenticated POST /messages with 401', async () => {
+    const response = await fetch(
+      'http://localhost:3001/messages?sessionId=test',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          jsonrpc: '2.0',
+          method: 'tools/call',
+          params: {},
+          id: 1,
+        }),
+      }
+    );
+    assert.equal(response.status, 401);
+  });
+
+  test('should reject POST /messages with 403 when accessToken does not match SSE session token', async () => {
+    const sseController = new AbortController();
+    const sseResponse = await fetch('http://localhost:3001/sse', {
+      headers: { Authorization: 'Bearer token-user-a' },
+      signal: sseController.signal,
+    });
+    assert.equal(sseResponse.status, 200);
+
+    const reader = sseResponse.body.getReader();
+    const { value } = await reader.read();
+    const sseText = new TextDecoder().decode(value);
+    const match = sseText.match(/sessionId=([^\s]+)/);
+    assert.ok(
+      match,
+      `Expected sessionId in SSE endpoint event, got: ${sseText}`
+    );
+    const sessionId = match[1];
+
+    try {
+      const msgResponse = await fetch(
+        `http://localhost:3001/messages?sessionId=${sessionId}`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            Authorization: 'Bearer token-user-b',
+          },
+          body: JSON.stringify({
+            jsonrpc: '2.0',
+            method: 'tools/list',
+            params: {},
+            id: 1,
+          }),
+        }
+      );
+      assert.equal(msgResponse.status, 403);
+      const body = await msgResponse.json();
+      assert.equal(
+        body.error.message,
+        'Forbidden: session is bound to a different access token; reconnect to /sse'
+      );
+    } finally {
+      sseController.abort();
+    }
+  });
+
+  test('should exit at startup with non-zero code when OAUTH_ENABLED=true and GOOGLE_OAUTH_AUDIENCE is missing', async () => {
+    const envWithoutAudience = {
+      ...process.env,
+      GCP_STDIO: 'false',
+      PORT: '3002',
+      OAUTH_ENABLED: 'true',
+    };
+    delete envWithoutAudience.GOOGLE_OAUTH_AUDIENCE;
+
+    const exitCode = await new Promise((resolve) => {
+      const child = spawn('node', ['mcp-server.js'], {
+        cwd: process.cwd(),
+        env: envWithoutAudience,
+      });
+      child.on('exit', (code) => resolve(code));
+    });
+    assert.equal(exitCode, 1);
+  });
 });

package/test/local/middleware/oauth.test.js

@@ -17,6 +17,7 @@ describe('oauthMiddleware', () => {
     };
     res = {
       headersSent: false,
+      set: mock.fn(),
       status: mock.fn(() => res),
       json: mock.fn(),
     };
@@ -41,12 +42,10 @@ describe('oauthMiddleware', () => {
     assert.strictEqual(res.status.mock.callCount(), 0);
   });
 
-  it('should call next() if method is not tools/call', async () => {
+  it('should return 401 if Authorization header is missing even when method is not tools/call', async () => {
     process.env.OAUTH_ENABLED = 'true';
     req.body.method = 'other/method';
 
-    // We don't verify token if it's not a tool call (based on current implementation)
-    // So we don't need to mock successful verification here
     const { oauthMiddleware } = await esmock(
       '../../../lib/middleware/oauth.js',
       {}
@@ -54,7 +53,61 @@ describe('oauthMiddleware', () => {
 
     await oauthMiddleware(req, res, next);
 
-    assert.strictEqual(next.mock.callCount(), 1);
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header is missing when req.body is a JSON array', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body = [{ jsonrpc: '2.0', method: 'tools/call', id: 1 }];
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header is missing when req.body is undefined (e.g. GET /sse)', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body = undefined;
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header has no token value', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.headers.authorization = 'Bearer';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
   });
 
   it('should return 401 if Authorization header is missing for tool call', async () => {
@@ -74,8 +127,27 @@ describe('oauthMiddleware', () => {
     assert.strictEqual(res.json.mock.callCount(), 1);
   });
 
+  it('should return 401 if GOOGLE_OAUTH_AUDIENCE is missing when OAUTH_ENABLED is "true"', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    delete process.env.GOOGLE_OAUTH_AUDIENCE;
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer valid-token';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+  });
+
   it('should verify token and call next() for valid tool call', async () => {
     process.env.OAUTH_ENABLED = 'true';
+    process.env.GOOGLE_OAUTH_AUDIENCE = 'valid-audience';
     req.body.method = 'tools/call';
     req.headers.authorization = 'Bearer valid-token';
 
@@ -102,6 +174,7 @@ describe('oauthMiddleware', () => {
 
   it('should return 401 if token verification fails', async () => {
     process.env.OAUTH_ENABLED = 'true';
+    process.env.GOOGLE_OAUTH_AUDIENCE = 'valid-audience';
     req.body.method = 'tools/call';
     req.headers.authorization = 'Bearer invalid-token';
 
@@ -127,12 +200,13 @@ describe('oauthMiddleware', () => {
     assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
   });
 
-  it('should return 401 if audience does not match', async () => {
+  it('should return 401 if audience does not match and remove token from oauth cache', async () => {
     process.env.OAUTH_ENABLED = 'true';
     process.env.GOOGLE_OAUTH_AUDIENCE = 'expected-audience';
     req.body.method = 'tools/call';
     req.headers.authorization = 'Bearer valid-token-wrong-audience';
 
+    const mockOAuthMap = new Map([['valid-token-wrong-audience', {}]]);
     const mockGetTokenInfo = mock.fn(async () => ({ aud: 'wrong-audience' }));
     const mockGetOAuthClient = mock.fn(async () => ({
       getTokenInfo: mockGetTokenInfo,
@@ -142,6 +216,7 @@ describe('oauthMiddleware', () => {
       '../../../lib/middleware/oauth.js',
       {
         '../../../lib/clients.js': {
+          clients: { oauth: mockOAuthMap },
           getOAuthClient: mockGetOAuthClient,
         },
       }
@@ -152,5 +227,31 @@ describe('oauthMiddleware', () => {
     assert.strictEqual(next.mock.callCount(), 0);
     assert.strictEqual(res.status.mock.callCount(), 1);
     assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(mockOAuthMap.has('valid-token-wrong-audience'), false);
+    assert.strictEqual(
+      res.json.mock.calls[0].arguments[0].error.data,
+      'Invalid or missing access token'
+    );
+  });
+
+  it('should set WWW-Authenticate header on 401 when OAUTH_PROTECTED_RESOURCE is set', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    process.env.OAUTH_PROTECTED_RESOURCE = 'https://example.com/resource';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.set.mock.callCount(), 1);
+    assert.deepStrictEqual(res.set.mock.calls[0].arguments, [
+      'WWW-Authenticate',
+      'Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource"',
+    ]);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
   });
 });

package/test/need-gcp/test-helpers.js

@@ -163,7 +163,11 @@ export async function setSourceDeployProjectPermissions(projectId) {
   const context = {
     serviceUsageClient: serviceUsageClient,
   };
-  await ensureApisEnabled(projectId, ['run.googleapis.com']);
+  await ensureApisEnabled(projectId, [
+    'run.googleapis.com',
+    'cloudbuild.googleapis.com',
+    'compute.googleapis.com',
+  ]);
   console.log('Adding editor role to Compute SA...');
   const projectNumber = await getProjectNumber(projectId);
   const member = `serviceAccount:${projectNumber}-compute@developer.gserviceaccount.com`;

package/tools/register-tools.js

@@ -49,6 +49,10 @@ function gcpTool(gcpCredentialsAvailable, fn) {
   return fn;
 }
 
+function withDefault(schema, defaultValue) {
+  return defaultValue !== undefined ? schema.default(defaultValue) : schema;
+}
+
 // Tool to list GCP projects
 function registerListProjectsTool(server, options) {
   server.registerTool(
@@ -147,10 +151,10 @@ function registerListServicesTool(server, options) {
     {
       description: 'Lists all Cloud Run services in a given project.',
       inputSchema: {
-        project: z
-          .string()
-          .describe('Google Cloud project ID')
-          .default(options.defaultProjectId),
+        project: withDefault(
+          z.string().describe('Google Cloud project ID'),
+          options.defaultProjectId
+        ),
       },
     },
     gcpTool(options.gcpCredentialsAvailable, async ({ project }) => {
@@ -202,18 +206,18 @@ function registerGetServiceTool(server, options) {
     {
       description: 'Gets details for a specific Cloud Run service.',
       inputSchema: {
-        project: z
-          .string()
-          .describe('Google Cloud project ID containing the service')
-          .default(options.defaultProjectId),
-        region: z
-          .string()
-          .describe('Region where the service is located')
-          .default(options.defaultRegion),
-        service: z
-          .string()
-          .describe('Name of the Cloud Run service')
-          .default(options.defaultServiceName),
+        project: withDefault(
+          z.string().describe('Google Cloud project ID containing the service'),
+          options.defaultProjectId
+        ),
+        region: withDefault(
+          z.string().describe('Region where the service is located'),
+          options.defaultRegion
+        ),
+        service: withDefault(
+          z.string().describe('Name of the Cloud Run service'),
+          options.defaultServiceName
+        ),
       },
     },
     gcpTool(
@@ -292,18 +296,18 @@ function registerGetServiceLogTool(server, options) {
       description:
         'Gets Logs and Error Messages for a specific Cloud Run service.',
       inputSchema: {
-        project: z
-          .string()
-          .describe('Google Cloud project ID containing the service')
-          .default(options.defaultProjectId),
-        region: z
-          .string()
-          .describe('Region where the service is located')
-          .default(options.defaultRegion),
-        service: z
-          .string()
-          .describe('Name of the Cloud Run service')
-          .default(options.defaultServiceName),
+        project: withDefault(
+          z.string().describe('Google Cloud project ID containing the service'),
+          options.defaultProjectId
+        ),
+        region: withDefault(
+          z.string().describe('Region where the service is located'),
+          options.defaultRegion
+        ),
+        service: withDefault(
+          z.string().describe('Name of the Cloud Run service'),
+          options.defaultServiceName
+        ),
       },
     },
     gcpTool(
@@ -361,24 +365,24 @@ function registerDeployLocalFolderTool(server, options) {
       description:
         'Deploy a local folder to Cloud Run. Takes an absolute folder path from the local filesystem that will be deployed. Use this tool if the entire folder content needs to be deployed.',
       inputSchema: {
-        project: z
-          .string()
-          .describe(
-            'Google Cloud project ID. Do not select it yourself, make sure the user provides or confirms the project ID.'
-          )
-          .default(options.defaultProjectId),
-        region: z
-          .string()
-          .optional()
-          .default(options.defaultRegion)
-          .describe('Region to deploy the service to'),
-        service: z
-          .string()
-          .optional()
-          .default(options.defaultServiceName)
-          .describe(
-            'Name of the Cloud Run service to deploy to. If not provided, it will be inferred.'
-          ),
+        project: withDefault(
+          z
+            .string()
+            .describe(
+              'Google Cloud project ID. Do not select it yourself, make sure the user provides or confirms the project ID.'
+            ),
+          options.defaultProjectId
+        ),
+        region: withDefault(
+          z.string().optional(),
+          options.defaultRegion
+        ).describe('Region to deploy the service to'),
+        service: withDefault(
+          z.string().optional(),
+          options.defaultServiceName
+        ).describe(
+          'Name of the Cloud Run service to deploy to. If not provided, it will be inferred.'
+        ),
         folderPath: z
           .string()
           .describe(
@@ -452,22 +456,22 @@ function registerDeployFileContentsTool(server, options) {
       description:
         'Deploy files to Cloud Run by providing their contents directly. Takes an array of file objects containing filename and content. Use this tool if the files only exist in the current chat context.',
       inputSchema: {
-        project: z
-          .string()
-          .describe(
-            'Google Cloud project ID. Leave unset for the app to be deployed in a new project. If provided, make sure the user confirms the project ID they want to deploy to.'
-          )
-          .default(options.defaultProjectId),
-        region: z
-          .string()
-          .optional()
-          .default(options.defaultRegion)
-          .describe('Region to deploy the service to'),
-        service: z
-          .string()
-          .optional()
-          .default(options.defaultServiceName)
-          .describe('Name of the Cloud Run service to deploy to'),
+        project: withDefault(
+          z
+            .string()
+            .describe(
+              'Google Cloud project ID. If provided, make sure the user confirms the project ID they want to deploy to.'
+            ),
+          options.defaultProjectId
+        ),
+        region: withDefault(
+          z.string().optional(),
+          options.defaultRegion
+        ).describe('Region to deploy the service to'),
+        service: withDefault(
+          z.string().optional(),
+          options.defaultServiceName
+        ).describe('Name of the Cloud Run service to deploy to'),
         files: z
           .array(
             z.object({
@@ -555,22 +559,22 @@ function registerDeployContainerImageTool(server, options) {
       description:
         'Deploys a container image to Cloud Run. Use this tool if the user provides a container image URL.',
       inputSchema: {
-        project: z
-          .string()
-          .describe(
-            'Google Cloud project ID. Do not select it yourself, make sure the user provides or confirms the project ID.'
-          )
-          .default(options.defaultProjectId),
-        region: z
-          .string()
-          .optional()
-          .default(options.defaultRegion)
-          .describe('Region to deploy the service to'),
-        service: z
-          .string()
-          .optional()
-          .default(options.defaultServiceName)
-          .describe('Name of the Cloud Run service to deploy to'),
+        project: withDefault(
+          z
+            .string()
+            .describe(
+              'Google Cloud project ID. Do not select it yourself, make sure the user provides or confirms the project ID.'
+            ),
+          options.defaultProjectId
+        ),
+        region: withDefault(
+          z.string().optional(),
+          options.defaultRegion
+        ).describe('Region to deploy the service to'),
+        service: withDefault(
+          z.string().optional(),
+          options.defaultServiceName
+        ).describe('Name of the Cloud Run service to deploy to'),
         imageUrl: z
           .string()
           .describe(