@google-cloud/cloud-run-mcp 1.5.0 → 1.6.0

package/lib/deployment/deployer.js

@@ -0,0 +1,474 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { callWithRetry, ensureApisEnabled } from '../cloud-api/helpers.js';
+import { zipFiles } from '../util/archive.js';
+import {
+  ensureStorageBucketExists,
+  uploadToStorageBucket,
+} from '../cloud-api/storage.js';
+import { ensureArtifactRegistryRepoExists } from '../cloud-api/registry.js';
+import { triggerCloudBuild } from '../cloud-api/build.js';
+import { logAndProgress } from '../util/helpers.js';
+import { checkCloudRunServiceExists } from '../cloud-api/run.js';
+
+// Configuration
+const REPO_NAME = 'mcp-cloud-run-deployments';
+const ZIP_FILE_NAME = 'source.zip';
+const IMAGE_TAG = 'latest';
+
+// APIs required for deploying from source code.
+const REQUIRED_APIS_FOR_SOURCE_DEPLOY = [
+  'iam.googleapis.com',
+  'storage.googleapis.com',
+  'cloudbuild.googleapis.com',
+  'artifactregistry.googleapis.com',
+  'run.googleapis.com',
+  'serviceusage.googleapis.com',
+];
+
+// APIs required for deploying a container image.
+const REQUIRED_APIS_FOR_IMAGE_DEPLOY = [
+  'run.googleapis.com',
+  'serviceusage.googleapis.com',
+];
+
+/**
+ * Deploys or updates a Cloud Run service with the specified container image.
+ * If the service exists, it's updated; otherwise, a new service is created.
+ * The service is configured to be publicly accessible.
+ *
+ * @async
+ * @param {object} context - The context object containing clients and other parameters.
+ * @param {string} projectId - The Google Cloud project ID.
+ * @param {string} location - The Google Cloud region for the deployment.
+ * @param {string} serviceId - The ID for the Cloud Run service.
+ * @param {string} imgUrl - The URL of the container image to deploy.
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<object>} A promise that resolves with the Cloud Run service object upon successful deployment or update.
+ * @throws {Error} If the deployment or update process fails.
+ */
+async function deployToCloudRun(
+  context,
+  projectId,
+  location,
+  serviceId,
+  imgUrl,
+  progressCallback,
+  skipIamCheck
+) {
+  const parent = context.runClient.locationPath(projectId, location);
+  const servicePath = context.runClient.servicePath(
+    projectId,
+    location,
+    serviceId
+  );
+  const revisionName = `${serviceId}-${Date.now()}`; // Generate a unique revision name
+
+  const service = {
+    template: {
+      revision: revisionName,
+      containers: [{ image: imgUrl }],
+    },
+    labels: {
+      'created-by': 'cloud-run-mcp',
+    },
+  };
+
+  // Conditionally set invokerIamDisabled based on the skipIamCheck flag
+  if (skipIamCheck) {
+    service.invokerIamDisabled = true;
+  }
+
+  try {
+    const exists = await checkCloudRunServiceExists(
+      context,
+      projectId,
+      location,
+      serviceId,
+      progressCallback
+    );
+
+    // Always perform a dry run first for general validation
+    try {
+      await logAndProgress(
+        `Performing dry run for service ${serviceId}...`,
+        progressCallback,
+        'debug'
+      );
+      const dryRunServiceConfig = JSON.parse(JSON.stringify(service)); // Deep copy for dry run
+
+      if (exists) {
+        dryRunServiceConfig.name = servicePath;
+        await callWithRetry(
+          () =>
+            context.runClient.updateService({
+              service: dryRunServiceConfig,
+              validateOnly: true,
+            }),
+          `updateService (dry run) ${serviceId}`
+        );
+      } else {
+        await callWithRetry(
+          () =>
+            context.runClient.createService({
+              parent: parent,
+              service: dryRunServiceConfig,
+              serviceId: serviceId,
+              validateOnly: true,
+            }),
+          `createService (dry run) ${serviceId}`
+        );
+      }
+      await logAndProgress(
+        `Dry run successful for ${serviceId} with current configuration.`,
+        progressCallback,
+        'debug'
+      );
+    } catch (dryRunError) {
+      await logAndProgress(
+        `Dry run for ${serviceId} failed: ${dryRunError.message}`,
+        progressCallback,
+        'warn'
+      );
+
+      // Check if the error is related to invokerIamDisabled (this is a heuristic)
+      if (
+        skipIamCheck &&
+        dryRunError.message &&
+        (dryRunError.message.toLowerCase().includes('invokeriamdisabled') ||
+          dryRunError.message.toLowerCase().includes('iam policy violation') ||
+          dryRunError.code === 3) /* INVALID_ARGUMENT */
+      ) {
+        await logAndProgress(
+          `Dry run suggests 'invokerIamDisabled' is not allowed or invalid. Attempting deployment without it.`,
+          progressCallback,
+          'warn'
+        );
+        delete service.invokerIamDisabled; // Modify the main service object for actual deployment
+      } else {
+        // For any other validation errors, rethrow to stop the deployment
+        const errorMessage = `Dry run validation failed for service ${serviceId}: ${dryRunError.message}`;
+        await logAndProgress(errorMessage, progressCallback, 'error');
+        throw new Error(errorMessage);
+      }
+    }
+
+    let operation;
+    if (exists) {
+      await logAndProgress(
+        `Updating existing service ${serviceId}...`,
+        progressCallback
+      );
+      service.name = servicePath;
+      [operation] = await callWithRetry(
+        () => context.runClient.updateService({ service }),
+        `updateService ${serviceId}`
+      );
+    } else {
+      await logAndProgress(
+        `Creating new service ${serviceId}...`,
+        progressCallback
+      );
+      [operation] = await callWithRetry(
+        () =>
+          context.runClient.createService({
+            parent: parent,
+            service: service, // 'service' object might have invokerIamDisabled removed
+            serviceId: serviceId,
+          }),
+        `createService ${serviceId}`
+      );
+    }
+
+    await logAndProgress(
+      `Deploying ${serviceId} to Cloud Run...`,
+      progressCallback
+    );
+    const [response] = await operation.promise();
+
+    await logAndProgress(
+      `Service deployed/updated successfully: ${response.uri}`,
+      progressCallback
+    );
+    return response;
+  } catch (error) {
+    const errorMessage = `Error deploying/updating service ${serviceId}: ${error.message}`;
+    console.error(`Error deploying/updating service ${serviceId}:`, error);
+    await logAndProgress(errorMessage, progressCallback, 'error');
+    throw error;
+  }
+}
+
+/**
+ * Deploys a service to Google Cloud Run.
+ * @param {object} config - The deployment configuration.
+ * @param {string} config.projectId - The Google Cloud project ID.
+ * @param {string} [config.serviceName='app'] - The name of the Cloud Run service. Defaults to 'app'.
+ * @param {string} [config.region='europe-west1'] - The Google Cloud region for deployment. Defaults to 'europe-west1'.
+ * @param {Array<string|{filename: string, content: Buffer|string}>} config.files - An array of file paths or file objects (with `filename` and `content`) to deploy.
+ * @param {function(object): void} [config.progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<object>} A promise that resolves with the deployed Cloud Run service object.
+ * @throws {Error} If deployment fails or required configuration is missing.
+ */
+export async function deploy({
+  projectId,
+  serviceName,
+  region,
+  files,
+  progressCallback,
+  skipIamCheck,
+}) {
+  if (!projectId) {
+    const errorMsg =
+      'Error: projectId is required in the configuration object.';
+    await logAndProgress(errorMsg, progressCallback, 'error');
+    throw new Error(errorMsg);
+  }
+
+  if (!serviceName) {
+    const errorMsg =
+      'Error: serviceName is required in the configuration object.';
+    await logAndProgress(errorMsg, progressCallback, 'error');
+    throw new Error(errorMsg);
+  }
+
+  if (!files || !Array.isArray(files) || files.length === 0) {
+    const errorMsg =
+      'Error: files array is required in the configuration object.';
+    await logAndProgress(errorMsg, progressCallback, 'error');
+    if (typeof process !== 'undefined' && process.exit) {
+      process.exit(1);
+    } else {
+      throw new Error(errorMsg);
+    }
+  }
+
+  const path = await import('path');
+  const fs = await import('fs');
+  const { Storage } = await import('@google-cloud/storage');
+  const { CloudBuildClient } = await import('@google-cloud/cloudbuild');
+  const { ArtifactRegistryClient } = await import(
+    '@google-cloud/artifact-registry'
+  );
+  const { v2: CloudRunV2Module } = await import('@google-cloud/run');
+  const { ServicesClient } = CloudRunV2Module;
+  const { ServiceUsageClient } = await import('@google-cloud/service-usage');
+  const { Logging } = await import('@google-cloud/logging');
+
+  try {
+    const context = {
+      storage: new Storage({ projectId }),
+      cloudBuildClient: new CloudBuildClient({ projectId }),
+      artifactRegistryClient: new ArtifactRegistryClient({ projectId }),
+      runClient: new ServicesClient({ projectId }),
+      serviceUsageClient: new ServiceUsageClient({ projectId }),
+      loggingClient: new Logging({ projectId }),
+    };
+
+    await ensureApisEnabled(
+      context,
+      projectId,
+      REQUIRED_APIS_FOR_SOURCE_DEPLOY,
+      progressCallback
+    );
+
+    const bucketName = `${projectId}-source-bucket`;
+    const imageUrl = `${region}-docker.pkg.dev/${projectId}/${REPO_NAME}/${serviceName}:${IMAGE_TAG}`;
+
+    await logAndProgress(`Project: ${projectId}`, progressCallback);
+    await logAndProgress(`Region: ${region}`, progressCallback);
+    await logAndProgress(`Service Name: ${serviceName}`, progressCallback);
+    await logAndProgress(`Files to deploy: ${files.length}`, progressCallback);
+
+    let hasDockerfile = false;
+    if (
+      files.length === 1 &&
+      typeof files[0] === 'string' &&
+      fs.statSync(files[0]).isDirectory()
+    ) {
+      // Handle folder deployment: check for Dockerfile inside the folder
+      const dockerfilePath = path.join(files[0], 'Dockerfile');
+      const dockerfilePathLowerCase = path.join(files[0], 'dockerfile');
+      if (
+        fs.existsSync(dockerfilePath) ||
+        fs.existsSync(dockerfilePathLowerCase)
+      ) {
+        hasDockerfile = true;
+      }
+    } else {
+      // Handle file list deployment or file content deployment
+      for (const file of files) {
+        if (typeof file === 'string') {
+          if (path.basename(file).toLowerCase() === 'dockerfile') {
+            hasDockerfile = true;
+            break;
+          }
+        } else if (typeof file === 'object' && file.filename) {
+          if (path.basename(file.filename).toLowerCase() === 'dockerfile') {
+            hasDockerfile = true;
+            break;
+          }
+        }
+      }
+    }
+    await logAndProgress(`Dockerfile: ${hasDockerfile}`, progressCallback);
+
+    const bucket = await ensureStorageBucketExists(
+      context,
+      bucketName,
+      region,
+      progressCallback
+    );
+
+    const zipBuffer = await zipFiles(files, progressCallback);
+    await uploadToStorageBucket(
+      context,
+      bucket,
+      zipBuffer,
+      ZIP_FILE_NAME,
+      progressCallback
+    );
+    await logAndProgress('Source code uploaded successfully', progressCallback);
+
+    await ensureArtifactRegistryRepoExists(
+      context,
+      projectId,
+      region,
+      REPO_NAME,
+      'DOCKER',
+      progressCallback
+    );
+
+    const buildResult = await triggerCloudBuild(
+      context,
+      projectId,
+      region,
+      bucketName,
+      ZIP_FILE_NAME,
+      REPO_NAME,
+      imageUrl,
+      hasDockerfile,
+      progressCallback
+    );
+
+    const builtImageUrl = buildResult.results.images[0].name;
+
+    const service = await deployToCloudRun(
+      context,
+      projectId,
+      region,
+      serviceName,
+      builtImageUrl,
+      progressCallback,
+      skipIamCheck
+    );
+
+    await logAndProgress(`Deployment Completed Successfully`, progressCallback);
+    return service;
+  } catch (error) {
+    const deployFailedMessage = `Deployment Failed: ${error.message}`;
+    console.error(`Deployment Failed`, error);
+    await logAndProgress(deployFailedMessage, progressCallback, 'error');
+    throw error;
+  }
+}
+
+/**
+ * Deploys a container image to Google Cloud Run.
+ * @param {object} config - The deployment configuration.
+ * @param {string} config.projectId - The Google Cloud project ID.
+ * @param {string} [config.serviceName='app'] - The name of the Cloud Run service. Defaults to 'app'.
+ * @param {string} [config.region='europe-west1'] - The Google Cloud region for deployment. Defaults to 'europe-west1'.
+ * @param {string} config.imageUrl - The URL of the container image to deploy.
+ * @param {function(object): void} [config.progressCallback] - Optional callback for progress updates.
+ * @param {boolean} [config.skipIamCheck=false] - Whether to skip the IAM check.
+ * @returns {Promise<object>} A promise that resolves with the deployed Cloud Run service object.
+ * @throws {Error} If deployment fails or required configuration is missing.
+ */
+export async function deployImage({
+  projectId,
+  serviceName,
+  region,
+  imageUrl,
+  progressCallback,
+  skipIamCheck,
+}) {
+  if (!projectId) {
+    const errorMsg =
+      'Error: projectId is required in the configuration object.';
+    await logAndProgress(errorMsg, progressCallback, 'error');
+    throw new Error(errorMsg);
+  }
+
+  if (!serviceName) {
+    const errorMsg =
+      'Error: serviceName is required in the configuration object.';
+    await logAndProgress(errorMsg, progressCallback, 'error');
+    throw new Error(errorMsg);
+  }
+
+  if (!imageUrl) {
+    const errorMsg = 'Error: imageUrl is required in the configuration object.';
+    await logAndProgress(errorMsg, progressCallback, 'error');
+    if (typeof process !== 'undefined' && process.exit) {
+      process.exit(1);
+    } else {
+      throw new Error(errorMsg);
+    }
+  }
+
+  const { v2: CloudRunV2Module } = await import('@google-cloud/run');
+  const { ServicesClient } = CloudRunV2Module;
+  const { ServiceUsageClient } = await import('@google-cloud/service-usage');
+
+  try {
+    const context = {
+      runClient: new ServicesClient({ projectId }),
+      serviceUsageClient: new ServiceUsageClient({ projectId }),
+    };
+
+    await ensureApisEnabled(
+      context,
+      projectId,
+      REQUIRED_APIS_FOR_IMAGE_DEPLOY,
+      progressCallback
+    );
+
+    await logAndProgress(`Project: ${projectId}`, progressCallback);
+    await logAndProgress(`Region: ${region}`, progressCallback);
+    await logAndProgress(`Service Name: ${serviceName}`, progressCallback);
+    await logAndProgress(`Image URL: ${imageUrl}`, progressCallback);
+
+    const service = await deployToCloudRun(
+      context,
+      projectId,
+      region,
+      serviceName,
+      imageUrl,
+      progressCallback,
+      skipIamCheck
+    );
+
+    await logAndProgress(`Deployment Completed Successfully`, progressCallback);
+    return service;
+  } catch (error) {
+    const deployFailedMessage = `Deployment Failed: ${error.message}`;
+    console.error(`Deployment Failed`, error);
+    await logAndProgress(deployFailedMessage, progressCallback, 'error');
+    throw error;
+  }
+}

package/lib/util/archive.js

@@ -0,0 +1,95 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { logAndProgress } from './helpers.js';
+
+/**
+ * Creates a zip archive in memory from a list of file paths and/or file objects.
+ * File objects should have `filename` (string) and `content` (Buffer or string) properties.
+ *
+ * @param {Array<string|{filename: string, content: Buffer|string}>} files - An array of items to zip.
+ * Each item can be a string representing a file/directory path, or an object
+ * with `filename` and `content` properties for in-memory files.
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<Buffer>} A promise that resolves with a Buffer containing the zip data.
+ * @throws {Error} If an input file path is not found, an input item has an invalid format, or an archiver error occurs.
+ */
+export async function zipFiles(files, progressCallback) {
+  const path = await import('path');
+  const fs = await import('fs');
+  const archiver = (await import('archiver')).default;
+
+  return new Promise((resolve, reject) => {
+    logAndProgress('Creating in-memory zip archive...', progressCallback);
+    const chunks = [];
+    const archive = archiver('zip', {
+      zlib: { level: 9 },
+    });
+
+    archive.on('data', (chunk) => chunks.push(chunk));
+    archive.on('end', () => {
+      logAndProgress(
+        `Files zipped successfully. Total size: ${archive.pointer()} bytes`,
+        progressCallback
+      );
+      resolve(Buffer.concat(chunks));
+    });
+
+    archive.on('warning', (err) => {
+      const warningMessage = `Archiver warning: ${err}`;
+      logAndProgress(warningMessage, progressCallback, 'warn');
+      if (err.code !== 'ENOENT') {
+        // ENOENT is often just a warning, others might be more critical for zip
+        reject(err);
+      }
+    });
+
+    archive.on('error', (err) => {
+      const errorMessage = `Archiver error: ${err.message}`;
+      console.error(errorMessage, err);
+      logAndProgress(errorMessage, progressCallback, 'error');
+      reject(err);
+    });
+
+    files.forEach((file) => {
+      if (typeof file === 'object' && 'filename' in file && 'content' in file) {
+        archive.append(file.content, { name: file.filename });
+      } else if (typeof file === 'string') {
+        let pathInput = file;
+
+        // This is a "hack" to better support WSL on Windows. AI agents tend to send path that start with '/c' in that case. Re-write it to '/mnt/c'
+        if (pathInput.startsWith('/c')) {
+          pathInput = `/mnt${pathInput}`;
+        }
+        const filePath = path.resolve(pathInput);
+        if (!fs.existsSync(filePath)) {
+          throw new Error(`File or directory not found: ${filePath}`);
+        }
+
+        const stats = fs.statSync(filePath);
+        if (stats.isDirectory()) {
+          archive.directory(filePath, false);
+        } else {
+          archive.file(filePath, { name: path.basename(filePath) });
+        }
+      } else {
+        throw new Error(`Invalid file format: ${JSON.stringify(file)}`);
+      }
+    });
+
+    archive.finalize();
+  });
+}

package/lib/util/helpers.js

@@ -0,0 +1,42 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/**
+ * Helper function to log a message and call the progress callback.
+ * @param {string} message - The message to log.
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @param {'debug' | 'info' | 'warn' | 'error'} [severity='info'] - The severity level of the message.
+ */
+export async function logAndProgress(
+  message,
+  progressCallback,
+  severity = 'info'
+) {
+  switch (severity) {
+    case 'error':
+      console.error(message);
+      break;
+    case 'warn':
+    case 'info':
+    case 'debug':
+    default:
+      console.log(message);
+      break;
+  }
+  if (progressCallback) {
+    progressCallback({ level: severity, data: message });
+  }
+}

package/mcp-server.js

@@ -16,7 +16,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import express from 'express';
+import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 // Support SSE for backward compatibility
@@ -26,8 +26,8 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { registerTools, registerToolsRemote } from './tools/tools.js';
 import { SetLevelRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { registerPrompts } from './prompts.js';
-import { checkGCP } from './lib/gcp-metadata.js';
-import { ensureGCPCredentials } from './lib/gcp-auth-check.js';
+import { checkGCP } from './lib/cloud-api/metadata.js';
+import { ensureGCPCredentials } from './lib/cloud-api/auth.js';
 import 'dotenv/config';
 
 const gcpInfo = await checkGCP();
@@ -43,10 +43,7 @@ function makeLoggingCompatibleWithStdio() {
 }
 
 function shouldStartStdio() {
-  if (process.env.GCP_STDIO) {
-    return true;
-  }
-  if (gcpInfo && gcpInfo.project) {
+  if (process.env.GCP_STDIO === 'false' || (gcpInfo && gcpInfo.project)) {
     return false;
   }
   return true;
@@ -61,6 +58,10 @@ const envProjectId = process.env.GOOGLE_CLOUD_PROJECT || undefined;
 const envRegion = process.env.GOOGLE_CLOUD_REGION;
 const defaultServiceName = process.env.DEFAULT_SERVICE_NAME;
 const skipIamCheck = process.env.SKIP_IAM_CHECK !== 'false';
+const enableHostValidation = process.env.ENABLE_HOST_VALIDATION === 'true';
+const allowedHosts = process.env.ALLOWED_HOSTS
+  ? process.env.ALLOWED_HOSTS.split(',')
+  : undefined;
 
 async function getServer() {
   // Create an MCP server with implementation details
@@ -125,10 +126,20 @@ if (shouldStartStdio()) {
   await server.connect(stdioTransport);
   console.log('Cloud Run MCP server stdio transport connected');
 } else {
-  console.log('Running on GCP, stdio transport will not be started.');
+  // non-stdio mode
+  console.log('Stdio transport mode is turned off.');
   gcpCredentialsAvailable = await ensureGCPCredentials();
-  const app = express();
-  app.use(express.json());
+
+  const app = enableHostValidation
+    ? createMcpExpressApp({ allowedHosts })
+    : createMcpExpressApp({ host: null });
+
+  if (!enableHostValidation) {
+    console.warn(
+      `Warning: Server is running without DNS rebinding protection. ` +
+        'Consider enabling host validation by passing env variable ENABLE_HOST_VALIDATION=true and adding the ALLOWED_HOSTS to restrict allowed hosts'
+    );
+  }
 
   app.post('/mcp', async (req, res) => {
     console.log('/mcp Received:', req.body);