@google-cloud/cloud-run-mcp 1.7.0 → 1.9.0

package/lib/deployment/deployer.js

@@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { getRunClient } from '../clients.js';
 import { callWithRetry, ensureApisEnabled } from '../cloud-api/helpers.js';
 import { zipFiles } from '../util/archive.js';
 import {
@@ -58,7 +59,6 @@ import {
  * @throws {Error} If the deployment or update process fails.
  */
 async function deployToCloudRun(
-  context,
   projectId,
   location,
   serviceId,
@@ -66,15 +66,13 @@ async function deployToCloudRun(
   progressCallback,
   skipIamCheck,
   deploymentType,
+  accessToken,
   zippedSourceContainer,
   runtime
 ) {
-  const parent = context.runClient.locationPath(projectId, location);
-  const servicePath = context.runClient.servicePath(
-    projectId,
-    location,
-    serviceId
-  );
+  const runClient = await getRunClient(projectId, accessToken);
+  const parent = runClient.locationPath(projectId, location);
+  const servicePath = runClient.servicePath(projectId, location, serviceId);
   const revisionName = `${serviceId}-${Date.now()}`; // Generate a unique revision name
 
   const containers =
@@ -101,10 +99,10 @@ async function deployToCloudRun(
 
   try {
     const exists = await checkCloudRunServiceExists(
-      context,
       projectId,
       location,
       serviceId,
+      accessToken,
       progressCallback
     );
 
@@ -121,7 +119,7 @@ async function deployToCloudRun(
         dryRunServiceConfig.name = servicePath;
         await callWithRetry(
           () =>
-            context.runClient.updateService({
+            runClient.updateService({
               service: dryRunServiceConfig,
               validateOnly: true,
             }),
@@ -130,7 +128,7 @@ async function deployToCloudRun(
       } else {
         await callWithRetry(
           () =>
-            context.runClient.createService({
+            runClient.createService({
               parent: parent,
               service: dryRunServiceConfig,
               serviceId: serviceId,
@@ -181,7 +179,7 @@ async function deployToCloudRun(
       );
       service.name = servicePath;
       [operation] = await callWithRetry(
-        () => context.runClient.updateService({ service }),
+        () => runClient.updateService({ service }),
         `updateService ${serviceId}`
       );
     } else {
@@ -191,7 +189,7 @@ async function deployToCloudRun(
       );
       [operation] = await callWithRetry(
         () =>
-          context.runClient.createService({
+          runClient.createService({
             parent: parent,
             service: service, // 'service' object might have invokerIamDisabled removed
             serviceId: serviceId,
@@ -242,7 +240,6 @@ async function deployToCloudRun(
  * @throws {Error} If any part of the deployment process fails.
  */
 async function deployWithZip(
-  context,
   projectId,
   region,
   serviceName,
@@ -250,7 +247,8 @@ async function deployWithZip(
   bucketName,
   deploymentAttrs,
   progressCallback,
-  skipIamCheck
+  skipIamCheck,
+  accessToken
 ) {
   await logAndProgress(
     `Attempting direct source deployment...`,
@@ -278,14 +276,14 @@ async function deployWithZip(
     }
 
     const bucket = await ensureStorageBucketExists(
-      context,
+      projectId,
       bucketName,
       region,
+      accessToken,
       progressCallback
     );
 
     await uploadToStorageBucket(
-      context,
       bucket,
       archiveBuffer,
       archiveName,
@@ -300,7 +298,6 @@ async function deployWithZip(
     });
 
     const service = await deployToCloudRun(
-      context,
       projectId,
       region,
       serviceName,
@@ -308,6 +305,7 @@ async function deployWithZip(
       progressCallback,
       skipIamCheck,
       DEPLOYMENT_TYPES.NO_BUILD,
+      accessToken,
       container,
       deploymentAttrs.runtime
     );
@@ -337,7 +335,6 @@ async function deployWithZip(
  * @throws {Error} If any part of the build or deployment process fails.
  */
 async function deployWithBuild(
-  context,
   projectId,
   region,
   serviceName,
@@ -345,14 +342,16 @@ async function deployWithBuild(
   hasDockerfile,
   bucketName,
   progressCallback,
-  skipIamCheck
+  skipIamCheck,
+  accessToken
 ) {
   const imageUrl = `${region}-docker.pkg.dev/${projectId}/${DEPLOYMENT_CONFIG.REPO_NAME}/${serviceName}:${DEPLOYMENT_CONFIG.IMAGE_TAG}`;
 
   const bucket = await ensureStorageBucketExists(
-    context,
+    projectId,
     bucketName,
     region,
+    accessToken,
     progressCallback
   );
 
@@ -360,7 +359,6 @@ async function deployWithBuild(
   const archiveName = DEPLOYMENT_CONFIG.ZIP_FILE_NAME;
 
   await uploadToStorageBucket(
-    context,
     bucket,
     archiveBuffer,
     archiveName,
@@ -369,8 +367,8 @@ async function deployWithBuild(
   await logAndProgress('Source code uploaded successfully', progressCallback);
 
   await ensureArtifactRegistryRepoExists(
-    context,
     projectId,
+    accessToken,
     region,
     DEPLOYMENT_CONFIG.REPO_NAME,
     'DOCKER',
@@ -380,7 +378,6 @@ async function deployWithBuild(
   await logAndProgress(`Dockerfile: ${hasDockerfile}`, progressCallback);
 
   const buildResult = await triggerCloudBuild(
-    context,
     projectId,
     region,
     bucketName,
@@ -388,20 +385,21 @@ async function deployWithBuild(
     DEPLOYMENT_CONFIG.REPO_NAME,
     imageUrl,
     hasDockerfile,
+    accessToken,
     progressCallback
   );
 
   const builtImageUrl = buildResult.results.images[0].name;
 
   const service = await deployToCloudRun(
-    context,
     projectId,
     region,
     serviceName,
     builtImageUrl,
     progressCallback,
     skipIamCheck,
-    DEPLOYMENT_TYPES.WITH_BUILD
+    DEPLOYMENT_TYPES.WITH_BUILD,
+    accessToken
   );
 
   await logAndProgress(`Deployment completed successfully`, progressCallback);
@@ -426,6 +424,7 @@ export async function deploy({
   files,
   progressCallback,
   skipIamCheck,
+  accessToken,
 }) {
   if (!projectId) {
     const errorMsg =
@@ -452,30 +451,11 @@ export async function deploy({
     }
   }
 
-  const { Storage } = await import('@google-cloud/storage');
-  const { CloudBuildClient } = await import('@google-cloud/cloudbuild');
-  const { ArtifactRegistryClient } = await import(
-    '@google-cloud/artifact-registry'
-  );
-  const { v2: CloudRunV2Module } = await import('@google-cloud/run');
-  const { ServicesClient } = CloudRunV2Module;
-  const { ServiceUsageClient } = await import('@google-cloud/service-usage');
-  const { Logging } = await import('@google-cloud/logging');
-
   try {
-    const context = {
-      storage: new Storage({ projectId }),
-      cloudBuildClient: new CloudBuildClient({ projectId }),
-      artifactRegistryClient: new ArtifactRegistryClient({ projectId }),
-      runClient: new ServicesClient({ projectId }),
-      serviceUsageClient: new ServiceUsageClient({ projectId }),
-      loggingClient: new Logging({ projectId }),
-    };
-
     await ensureApisEnabled(
-      context,
       projectId,
       REQUIRED_APIS.SOURCE_DEPLOY,
+      accessToken,
       progressCallback
     );
 
@@ -495,7 +475,6 @@ export async function deploy({
     if (canDeployWithoutBuild({ hasDockerfile, deploymentAttrs })) {
       try {
         return await deployWithZip(
-          context,
           projectId,
           region,
           serviceName,
@@ -503,7 +482,8 @@ export async function deploy({
           bucketName,
           deploymentAttrs,
           progressCallback,
-          skipIamCheck
+          skipIamCheck,
+          accessToken
         );
       } catch (error) {
         await logAndProgress(
@@ -515,7 +495,6 @@ export async function deploy({
     }
 
     return await deployWithBuild(
-      context,
       projectId,
       region,
       serviceName,
@@ -523,7 +502,8 @@ export async function deploy({
       hasDockerfile,
       bucketName,
       progressCallback,
-      skipIamCheck
+      skipIamCheck,
+      accessToken
     );
   } catch (error) {
     const deployFailedMessage = `Deployment Failed: ${error.message}`;
@@ -552,6 +532,7 @@ export async function deployImage({
   imageUrl,
   progressCallback,
   skipIamCheck,
+  accessToken,
 }) {
   if (!projectId) {
     const errorMsg =
@@ -577,20 +558,11 @@ export async function deployImage({
     }
   }
 
-  const { v2: CloudRunV2Module } = await import('@google-cloud/run');
-  const { ServicesClient } = CloudRunV2Module;
-  const { ServiceUsageClient } = await import('@google-cloud/service-usage');
-
   try {
-    const context = {
-      runClient: new ServicesClient({ projectId }),
-      serviceUsageClient: new ServiceUsageClient({ projectId }),
-    };
-
     await ensureApisEnabled(
-      context,
       projectId,
       REQUIRED_APIS.IMAGE_DEPLOY,
+      accessToken,
       progressCallback
     );
 
@@ -600,14 +572,14 @@ export async function deployImage({
     await logAndProgress(`Image URL: ${imageUrl}`, progressCallback);
 
     const service = await deployToCloudRun(
-      context,
       projectId,
       region,
       serviceName,
       imageUrl,
       progressCallback,
       skipIamCheck,
-      DEPLOYMENT_TYPES.IMAGE
+      DEPLOYMENT_TYPES.IMAGE,
+      accessToken
     );
 
     await logAndProgress(`Deployment completed successfully`, progressCallback);

package/lib/deployment/helpers.js

@@ -170,7 +170,7 @@ export function canDeployWithoutBuild({ hasDockerfile, deploymentAttrs }) {
  * Creates the container spec for a direct source deployment (no Cloud Build).
  * @param {object} params - The parameters for creating the container spec.
  * @param {string} params.bucketName - The GCS bucket name where the source is uploaded.
- * @param {string} params.fileName - The GCS object name (e.g., source.tar.gz).
+ * @param {string} params.fileName - The GCS object name (eg., source.tar.gz).
  * @param {{cmd: string[], args: string[], baseImage: string}} params.deploymentAttrs - Deployment attributes including command, args, and the base image to use.
  * @returns {object} The container specification object for the Cloud Run service.
  */

package/lib/middleware/oauth.js

@@ -0,0 +1,92 @@
+import { getOAuthClient } from '../clients.js';
+import { extractAccessToken } from '../util/helpers.js';
+
+const TOOLS_CALL_METHOD = 'tools/call';
+
+/**
+ * Verifies the validity of an access token and checks the audience.
+ * @param {string} accessToken - The access token to verify.
+ * @param {string} [audience] - Audience to check against the token's audience.
+ * @returns {Promise<object>} - The token info if valid.
+ * @throws {Error} - If the token is invalid or the audience does not match.
+ */
+async function verifyAccessToken(accessToken, audience) {
+  try {
+    const client = await getOAuthClient(accessToken);
+    const tokenInfo = await client.getTokenInfo(accessToken);
+
+    //An expired token will not have audience
+    if (audience && tokenInfo.aud !== audience) {
+      throw new Error(`Invalid audience: expected ${audience}`);
+    }
+
+    console.log('Access token verified successfully.');
+    return tokenInfo;
+  } catch (error) {
+    console.error('Error verifying access token:', error);
+    throw error;
+  }
+}
+
+/**
+ * Ensures that a valid OAuth token is present in the request headers
+ * and verifies it against the configured audience.
+ * @param {object} req - The request object.
+ * @param {object} res - The response object.
+ * @throws {Error} - If the token is missing or invalid.
+ */
+async function ensureOAuthTokenInEnv(req, res) {
+  try {
+    const audience = process.env.GOOGLE_OAUTH_AUDIENCE;
+    console.log('Verifying token');
+    if (req.headers.authorization === undefined) {
+      console.log('No authorization header found in request');
+      throw new Error('No authorization header');
+    }
+    console.log('Authorization header found.. Verifying token');
+    await verifyAccessToken(
+      extractAccessToken(req.headers.authorization),
+      audience
+    );
+    console.log('Token verified');
+  } catch (error) {
+    console.error('Authentication failed: ', error);
+    throw error;
+  }
+}
+
+/**
+ * Middleware to check for OAuth token if OAuth is enabled.
+ * If OAUTH_ENABLED is 'true', it verifies the Authorization header.
+ *
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+export const oauthMiddleware = async (req, res, next) => {
+  //If OAUTH_ENABLED is not true or the request is not a tools/call, skip the middleware
+  if (
+    process.env.OAUTH_ENABLED !== 'true' ||
+    req.body.method !== TOOLS_CALL_METHOD
+  ) {
+    return next();
+  }
+
+  try {
+    await ensureOAuthTokenInEnv(req, res);
+    next();
+  } catch (error) {
+    console.error('OAuth Middleware Error:', error);
+    // ensureOAuthTokenInEnv throws an error if auth fails.
+    // We catch it and send a 401 response.
+    res.status(401).json({
+      jsonrpc: '2.0',
+      error: {
+        code: -32001, // Custom auth error code or standard -32000
+        message: 'Authentication failed',
+        data: error.message,
+      },
+      id: null,
+    });
+  }
+};

package/lib/util/helpers.js

@@ -40,3 +40,15 @@ export async function logAndProgress(
     progressCallback({ level: severity, data: message });
   }
 }
+
+/**
+ * Extracts the access token from the Authorization header.
+ * @param {string} authorizationHeader - The Authorization header string.
+ * @returns {string | undefined} - The extracted access token or undefined if not found.
+ */
+export function extractAccessToken(authorizationHeader) {
+  if (!authorizationHeader) {
+    return undefined;
+  }
+  return authorizationHeader.split(' ')[1];
+}

package/mcp-server.js

@@ -28,7 +28,18 @@ import { SetLevelRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { registerPrompts } from './prompts.js';
 import { checkGCP } from './lib/cloud-api/metadata.js';
 import { ensureGCPCredentials } from './lib/cloud-api/auth.js';
-import 'dotenv/config';
+import { extractAccessToken } from './lib/util/helpers.js';
+import { oauthMiddleware } from './lib/middleware/oauth.js';
+import { config } from '@dotenvx/dotenvx';
+import {
+  SCOPES,
+  GCLOUD_AUTH,
+  BEARER_METHODS_SUPPORTED,
+  RESPONSE_TYPES_SUPPORTED,
+} from './constants.js';
+
+//Suppress the warning related to missing .env file in case of non-OAuth mode
+config({ quiet: true, ignore: ['MISSING_ENV_FILE'] });
 
 const gcpInfo = await checkGCP();
 let gcpCredentialsAvailable = false;
@@ -63,7 +74,7 @@ const allowedHosts = process.env.ALLOWED_HOSTS
   ? process.env.ALLOWED_HOSTS.split(',')
   : undefined;
 
-async function getServer() {
+async function getServer(accessToken = GCLOUD_AUTH) {
   // Create an MCP server with implementation details
   const server = new McpServer(
     {
@@ -97,6 +108,7 @@ async function getServer() {
       defaultServiceName,
       skipIamCheck,
       gcpCredentialsAvailable,
+      accessToken,
     });
   } else {
     console.log(
@@ -109,6 +121,7 @@ async function getServer() {
       defaultServiceName,
       skipIamCheck,
       gcpCredentialsAvailable,
+      accessToken,
     });
   }
 
@@ -118,7 +131,28 @@ async function getServer() {
   return server;
 }
 
-// stdio
+const getOAuthProtectedResource = (req, res) => {
+  res.json({
+    resource: process.env.OAUTH_PROTECTED_RESOURCE,
+    authorization_servers: [process.env.OAUTH_AUTHORIZATION_SERVER],
+    scopes_supported: [SCOPES.OPENID, SCOPES.EMAIL, SCOPES.CLOUD_PLATFORM],
+    bearer_methods_supported: [...BEARER_METHODS_SUPPORTED],
+  });
+  res.status(200).send();
+};
+
+const getOAuthAuthorizationServer = (req, res) => {
+  res.json({
+    issuer: process.env.OAUTH_PROTECTED_RESOURCE,
+    authorization_endpoint: process.env.OAUTH_AUTHORIZATION_ENDPOINT,
+    token_endpoint: process.env.OAUTH_TOKEN_ENDPOINT,
+    scopes_supported: [SCOPES.OPENID, SCOPES.EMAIL, SCOPES.CLOUD_PLATFORM],
+    response_types_supported: [...RESPONSE_TYPES_SUPPORTED],
+  });
+  res.status(200).send();
+};
+
+// stdio mode
 if (shouldStartStdio()) {
   gcpCredentialsAvailable = await ensureGCPCredentials();
   const stdioTransport = new StdioServerTransport();
@@ -128,7 +162,8 @@ if (shouldStartStdio()) {
 } else {
   // non-stdio mode
   console.log('Stdio transport mode is turned off.');
-  gcpCredentialsAvailable = await ensureGCPCredentials();
+  gcpCredentialsAvailable =
+    process.env.OAUTH_ENABLED === 'true' || (await ensureGCPCredentials());
 
   const app = enableHostValidation
     ? createMcpExpressApp({ allowedHosts })
@@ -141,9 +176,17 @@ if (shouldStartStdio()) {
     );
   }
 
-  app.post('/mcp', async (req, res) => {
+  app.get('/.well-known/oauth-protected-resource', getOAuthProtectedResource);
+
+  app.get(
+    '/.well-known/oauth-authorization-server',
+    getOAuthAuthorizationServer
+  );
+
+  app.post('/mcp', oauthMiddleware, async (req, res) => {
     console.log('/mcp Received:', req.body);
-    const server = await getServer();
+    const accessToken = extractAccessToken(req.headers.authorization);
+    const server = await getServer(accessToken);
     try {
       const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
@@ -204,7 +247,8 @@ if (shouldStartStdio()) {
   // Legacy SSE endpoint for older clients
   app.get('/sse', async (req, res) => {
     console.log('/sse Received:', req.body);
-    const server = await getServer();
+    const accessToken = extractAccessToken(req.headers.authorization);
+    const server = await getServer(accessToken);
     // Create SSE transport for legacy clients
     const transport = new SSEServerTransport('/messages', res);
     sseTransports[transport.sessionId] = transport;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@google-cloud/cloud-run-mcp",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "type": "module",
   "description": "Cloud Run MCP deployment tool",
   "main": "mcp-server.js",
@@ -50,7 +50,7 @@
     "@google-cloud/storage": "^7.16.0",
     "@modelcontextprotocol/sdk": "^1.24.3",
     "archiver": "^7.0.1",
-    "dotenv": "^17.2.1",
+    "@dotenvx/dotenvx": "^1.52.0",
     "express": "^5.1.0",
     "google-proto-files": "^5.0.0",
     "zod": "^3.25.76"
@@ -58,6 +58,6 @@
   "devDependencies": {
     "c8": "^10.1.3",
     "esmock": "^2.7.1",
-    "prettier": "3.6.2"
+    "prettier": "^3.8.0"
   }
 }