@google-cloud/cloud-run-mcp 1.8.0 → 1.10.0

package/.env.example

@@ -0,0 +1,13 @@
+PORT = 3000
+GCP_STDIO = false
+
+OAUTH_ENABLED = true
+GOOGLE_OAUTH_CLIENT_ID = YOUR_CLIENT_ID
+GOOGLE_OAUTH_CLIENT_SECRET = YOUR_CLIENT_SECRET
+GOOGLE_OAUTH_AUDIENCE = YOUR_AUDIENCE # generally, same as your client id
+GOOGLE_OAUTH_REDIRECT_URI = http://localhost:7777/oauth/callback
+
+OAUTH_PROTECTED_RESOURCE = http://localhost:${PORT}/mcp
+OAUTH_AUTHORIZATION_SERVER = http://localhost:${PORT}/auth/google
+OAUTH_AUTHORIZATION_ENDPOINT = https://accounts.google.com/o/oauth2/v2/auth
+OAUTH_TOKEN_ENDPOINT = https://oauth2.googleapis.com/token

package/.env.gcloud-sdk-oauth

@@ -0,0 +1,13 @@
+PORT = 3000
+GCP_STDIO = false
+
+OAUTH_ENABLED = true
+GOOGLE_OAUTH_CLIENT_ID = 32555940559.apps.googleusercontent.com
+GOOGLE_OAUTH_CLIENT_SECRET = ZmssLNjJy2998hD4CTg2ejr2
+GOOGLE_OAUTH_AUDIENCE = 32555940559.apps.googleusercontent.com
+GOOGLE_OAUTH_REDIRECT_URI = http://localhost:7777/oauth/callback
+
+OAUTH_PROTECTED_RESOURCE = http://localhost:${PORT}/mcp
+OAUTH_AUTHORIZATION_SERVER = http://localhost:${PORT}/auth/google
+OAUTH_AUTHORIZATION_ENDPOINT = https://accounts.google.com/o/oauth2/v2/auth
+OAUTH_TOKEN_ENDPOINT = https://oauth2.googleapis.com/token

package/README.md

@@ -235,4 +235,42 @@ With this option, you will only be able to deploy code to the same Google Cloud
       }
    ```
 
+## Using MCP Server with OAuth
+
+Cloud Run MCP server supports OAuth as an authentication mechanism. In order to use OAuth, create the OAuth client, and configure a `.env` file with the appropriate values pertaining to your OAuth client. A `.env.example` is provided for reference.
+
+The Cloud Run MCP server works seamlessly with Google Cloud SDK OAuth client. In order to leverage the Google Cloud SDK OAuth client, you can use the `.env.gcloud-sdk-oauth` file as your `.env` file as follows:
+
+```bash
+cp .env.gcloud-sdk-oauth .env
+node mcp-server.js
+```
+
+### Configure MCP Server on Gemini CLI to use OAuth
+
+When the Cloud Run MCP server is started in the OAuth mode, the MCP client should also be configured to use OAuth. You can setup the MCP server in OAuth mode in the Gemini CLI by using the following JSON in the `~/.gemini/settings.json` file:
+
+```json
+{
+  "mcpServers": {
+    "cloud-run": {
+      "httpUrl": "http://localhost:3000/mcp",
+      "oauth": {
+        "enabled": true,
+        "clientId": "<OAUTH_CLIENT_ID>",
+        "clientSecret": "<OAUTH_CLIENT_SECRET>"
+      }
+    }
+  }
+}
+```
+
+Post the configuration changes as shown above, start the Gemini CLI. You should authenticate the Cloud Run MCP server using the following prompt in the Gemini CLI:
+
+```
+/mcp auth cloud-run
+```
+
+This will take you to the authentication page on your browser, wherein you need to sign in using the appropriate gmail id, and accept the terms and conditions. Once the authentication is succcessful, you can come back to the Gemini CLI, and the Cloud Run MCP server will be ready to use.
+
 The Google Cloud Platform Terms of Service (available at https://cloud.google.com/terms/) and the Data Processing and Security Terms (available at https://cloud.google.com/terms/data-processing-terms) do not apply to any component of the Cloud Run MCP Server software.

package/constants.js

@@ -0,0 +1,8 @@
+export const SCOPES = {
+  OPENID: 'openid',
+  EMAIL: 'https://www.googleapis.com/auth/userinfo.email',
+  CLOUD_PLATFORM: 'https://www.googleapis.com/auth/cloud-platform',
+};
+export const BEARER_METHODS_SUPPORTED = ['header'];
+export const RESPONSE_TYPES_SUPPORTED = ['code'];
+export const GCLOUD_AUTH = 'gcloud_auth';

package/gemini-extension.json

@@ -7,5 +7,17 @@
       "args": ["-y", "@google-cloud/cloud-run-mcp"]
     }
   },
+  "settings": [
+    {
+      "name": "Project ID",
+      "description": "Google Cloud project ID to use for Cloud Run operations.",
+      "envVar": "GOOGLE_CLOUD_PROJECT"
+    },
+    {
+      "name": "Region",
+      "description": "Google Cloud region where Cloud Run services will be managed.",
+      "envVar": "GOOGLE_CLOUD_REGION"
+    }
+  ],
   "contextFileName": "gemini-extension/GEMINI.md"
 }

package/lib/clients.js

@@ -14,9 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { OAuth2Client } from 'google-auth-library';
+import { GCLOUD_AUTH } from '../constants.js';
+
+const CLIENT_ID = process.env.GOOGLE_OAUTH_CLIENT_ID;
+const CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET;
+const REDIRECT_URI = process.env.GOOGLE_OAUTH_REDIRECT_URI;
 const AUTHORIZATION_HEADER = 'Authorization';
 const BEARER_PREFIX = 'Bearer';
-const GCLOUD_AUTH = 'gcloud_auth';
 
 function keyGenerator(projectId, accessToken) {
   return accessToken !== GCLOUD_AUTH ? projectId + accessToken : projectId;
@@ -32,6 +37,7 @@ const clients = {
   logging: new Map(),
   billing: new Map(),
   projects: new Map(),
+  oauth: new Map(),
 };
 
 function getAuthClient(accessToken) {
@@ -44,6 +50,47 @@ function getAuthClient(accessToken) {
   };
 }
 
+/**
+ * Wraps an OAuth2Client to be compatible with gRPC-based Google Cloud clients.
+ *
+ * Some Google Cloud SDK clients (like Cloud Run, Service Usage, etc.) use gRPC
+ * and expect the `getRequestHeaders()` method of the auth client to return a
+ * `Map` of headers. However, the standard `OAuth2Client` from `google-auth-library`
+ * returns a plain Javascript object (e.g., `{ Authorization: 'Bearer ...' }`).
+ *
+ * This wrapper uses a Proxy to intercept calls to `getRequestHeaders`. It calls
+ * the original method and converts the result from a plain object to a `Map`
+ * if necessary, ensuring compatibility with gRPC-based clients while maintaining
+ * the original behavior for other properties.
+ *
+ * @param {OAuth2Client} authClient - The original OAuth2Client instance.
+ * @returns {Proxy<OAuth2Client>} A proxy compatible with gRPC clients.
+ */
+function wrapForGrpc(authClient) {
+  return new Proxy(authClient, {
+    get(target, prop, receiver) {
+      if (prop === 'getRequestHeaders') {
+        return async (...args) => {
+          const headers = await target.getRequestHeaders(...args);
+          if (headers instanceof Map) {
+            return headers;
+          }
+          // Convert plain object (from OAuth2Client) to Map (expected by grpc-js)
+          const headerMap = new Map();
+          for (const [k, v] of Object.entries(headers)) {
+            headerMap.set(k, v);
+          }
+          return headerMap;
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    },
+  });
+}
+
+// Services that use HTTP/REST (or prefer Object headers) instead of gRPC (Map headers)
+const HTTP_SERVICES = ['storage', 'logging'];
+
 export async function getClient(
   service,
   key,
@@ -55,7 +102,14 @@ export async function getClient(
     const ClientClass = await loadClient();
     const finalOptions = { ...options };
     if (accessToken && accessToken !== GCLOUD_AUTH) {
-      finalOptions.authClient = getAuthClient(accessToken);
+      const oauthClient = await getOAuthClient(accessToken);
+      // Storage and Logging use HTTP and expect the native OAuth2Client (headers as Object).
+      // Other services (Run, ServiceUsage, etc.) use gRPC and expect headers as Map.
+      if (HTTP_SERVICES.includes(service)) {
+        finalOptions.authClient = oauthClient;
+      } else {
+        finalOptions.authClient = wrapForGrpc(oauthClient);
+      }
     }
     clients[service].set(key, new ClientClass(finalOptions));
   }
@@ -220,3 +274,19 @@ export async function getProjectsClient(accessToken = GCLOUD_AUTH) {
     accessToken
   );
 }
+
+/**
+ * Gets an OAuth2 Client for the specified access token.
+ * @param {string} accessToken - The access token.
+ * @returns {Promise<OAuth2Client>}
+ */
+export async function getOAuthClient(accessToken) {
+  // Use the access token itself as the key since it's unique per session/user
+  if (!clients.oauth.has(accessToken)) {
+    const client = new OAuth2Client(CLIENT_ID, CLIENT_SECRET, REDIRECT_URI);
+    client.setCredentials({ access_token: accessToken });
+    clients.oauth.set(accessToken, client);
+  }
+
+  return clients.oauth.get(accessToken);
+}

package/lib/cloud-api/auth.js

@@ -23,6 +23,7 @@ import { GoogleAuth } from 'google-auth-library';
  * @async
  * @returns {Promise<boolean>} A promise that resolves to true if GCP auth are found, and false otherwise.
  */
+//TODO: Rename ensureGCPCredentials to ensureADCCredentials
 export async function ensureGCPCredentials() {
   console.error('Checking for Google Cloud Application Default Credentials...');
   try {

package/lib/cloud-api/billing.js

@@ -30,8 +30,8 @@ import { getBillingClient } from '../clients.js';
  * @returns {Promise<Array<{name: string, displayName: string, open: boolean}>>} A promise that resolves to an array of billing account objects,
  * each with 'name', 'displayName', and 'open' status. Returns an empty array on error.
  */
-export async function listBillingAccounts() {
-  const client = await getBillingClient();
+export async function listBillingAccounts(accessToken) {
+  const client = await getBillingClient('global', accessToken);
   try {
     const [accounts] = await client.listBillingAccounts();
     if (!accounts || accounts.length === 0) {
@@ -59,9 +59,10 @@ export async function listBillingAccounts() {
  */
 export async function attachProjectToBillingAccount(
   projectId,
-  billingAccountName
+  billingAccountName,
+  accessToken
 ) {
-  const client = await getBillingClient();
+  const client = await getBillingClient(projectId, accessToken);
   const projectName = `projects/${projectId}`;
 
   if (!projectId) {
@@ -111,8 +112,8 @@ export async function attachProjectToBillingAccount(
  * @param {string} projectId - The ID of the project to check.
  * @returns {Promise<boolean>} A promise that resolves to true if billing is enabled, false otherwise.
  */
-export async function isBillingEnabled(projectId) {
-  const client = await getBillingClient();
+export async function isBillingEnabled(projectId, accessToken) {
+  const client = await getBillingClient(projectId, accessToken);
   const projectName = `projects/${projectId}`;
   try {
     // getProjectBillingInfo requires cloudbilling.googleapis.com API to check billing status
@@ -136,10 +137,14 @@ export async function isBillingEnabled(projectId) {
  * @param {string} projectId The project ID to check billing for.
  * @param {function} progressCallback A callback function for progress updates.
  */
-export async function ensureBillingEnabled(projectId, progressCallback) {
-  if (!(await isBillingEnabled(projectId))) {
+export async function ensureBillingEnabled(
+  projectId,
+  accessToken,
+  progressCallback
+) {
+  if (!(await isBillingEnabled(projectId, accessToken))) {
     // Billing is disabled, try to fix it.
-    const accounts = await listBillingAccounts();
+    const accounts = await listBillingAccounts(accessToken);
 
     if (accounts && accounts.length === 1 && accounts[0].open) {
       // Exactly one open account found, try to attach it.
@@ -151,7 +156,8 @@ export async function ensureBillingEnabled(projectId, progressCallback) {
 
       const attachmentResult = await attachProjectToBillingAccount(
         projectId,
-        account.name
+        account.name,
+        accessToken
       );
 
       if (!attachmentResult || !attachmentResult.billingEnabled) {

package/lib/cloud-api/build.js

@@ -53,21 +53,23 @@ export async function triggerCloudBuild(
   targetRepoName,
   targetImageUrl,
   hasDockerfile,
+  accessToken,
   progressCallback
 ) {
   const serviceName = targetImageUrl.split('/').pop().split(/[:@]/)[0];
   const parent = `projects/${projectId}/locations/${location}`;
   const serviceFullName = `${parent}/services/${serviceName}`;
-  const buildsClient = await getBuildsClient(projectId);
-  const runClient = await getRunClient(projectId);
+  const buildsClient = await getBuildsClient(projectId, accessToken);
+  const runClient = await getRunClient(projectId, accessToken);
   const serviceExists = await checkCloudRunServiceExists(
     projectId,
     location,
     serviceName,
+    accessToken,
     progressCallback
   );
-  const cloudBuildClient = await getCloudBuildClient(projectId);
-  const loggingClient = await getLoggingClient(projectId);
+  const cloudBuildClient = await getCloudBuildClient(projectId, accessToken);
+  const loggingClient = await getLoggingClient(projectId, accessToken);
   let buildSteps;
 
   const servicePatch = {

package/lib/cloud-api/helpers.js

@@ -100,8 +100,16 @@ async function checkAndEnableApi(
  * @returns {Promise<void>} A promise that resolves when the API is enabled.
  * @throws {Error} If the API fails to enable or if there's an issue checking its status.
  */
-export async function enableApiWithRetry(projectId, api, progressCallback) {
-  const serviceUsageClient = await getServiceUsageClient(projectId);
+export async function enableApiWithRetry(
+  projectId,
+  api,
+  accessToken,
+  progressCallback
+) {
+  const serviceUsageClient = await getServiceUsageClient(
+    projectId,
+    accessToken
+  );
   const serviceName = `projects/${projectId}/services/${api}`;
   try {
     await checkAndEnableApi(
@@ -148,20 +156,25 @@ export async function enableApiWithRetry(projectId, api, progressCallback) {
  * @throws {Error} If an API fails to enable or if there's an issue checking its status.
  * @returns {Promise<void>} A promise that resolves when all specified APIs are enabled.
  */
-export async function ensureApisEnabled(projectId, apis, progressCallback) {
+export async function ensureApisEnabled(
+  projectId,
+  apis,
+  accessToken,
+  progressCallback
+) {
   for (const api of PREREQUISITE_APIS) {
-    await enableApiWithRetry(projectId, api, progressCallback);
+    await enableApiWithRetry(projectId, api, accessToken, progressCallback);
   }
 
   // Before enabling other APIs, ensure billing is enabled.
-  await ensureBillingEnabled(projectId, progressCallback);
+  await ensureBillingEnabled(projectId, accessToken, progressCallback);
 
   const message = 'Checking and enabling required APIs...';
   console.log(message);
   if (progressCallback) progressCallback({ level: 'info', data: message });
 
   for (const api of apis) {
-    await enableApiWithRetry(projectId, api, progressCallback);
+    await enableApiWithRetry(projectId, api, accessToken, progressCallback);
   }
   const successMsg = 'All required APIs are enabled.';
   console.log(successMsg);

package/lib/cloud-api/projects.js

@@ -26,8 +26,8 @@ import { getProjectsClient } from '../clients.js';
  * @function listProjects
  * @returns {Promise<Array<{id: string}>>} A promise that resolves to an array of project objects, each with an 'id' property. Returns an empty array on error.
  */
-export async function listProjects() {
-  const client = await getProjectsClient();
+export async function listProjects(accessToken) {
+  const client = await getProjectsClient(accessToken);
   try {
     const [projects] = await client.searchProjects();
     return projects.map((project) => ({
@@ -71,8 +71,8 @@ export function generateProjectId() {
  * @param {string} [parent] - Optional. The resource name of the parent under which the project is to be created. e.g., "organizations/123" or "folders/456".
  * @returns {Promise<{projectId: string}|null>} A promise that resolves to an object containing the new project's ID.
  */
-export async function createProject(projectId, parent) {
-  const client = await getProjectsClient();
+export async function createProject(projectId, parent, accessToken) {
+  const client = await getProjectsClient(accessToken);
   let projectIdToUse = projectId;
 
   if (!projectIdToUse) {
@@ -112,10 +112,14 @@ export async function createProject(projectId, parent) {
  * @param {string} [parent] - Optional. The resource name of the parent under which the project is to be created. e.g., "organizations/123" or "folders/456".
  * @returns {Promise<{projectId: string, billingMessage: string}>} A promise that resolves to an object containing the project ID and a billing status message.
  */
-export async function createProjectAndAttachBilling(projectIdParam, parent) {
+export async function createProjectAndAttachBilling(
+  projectIdParam,
+  parent,
+  accessToken
+) {
   let newProject;
   try {
-    newProject = await createProject(projectIdParam, parent);
+    newProject = await createProject(projectIdParam, parent, accessToken);
   } catch (error) {
     throw new Error(`Failed to create project: ${error.message}`);
   }
@@ -128,7 +132,7 @@ export async function createProjectAndAttachBilling(projectIdParam, parent) {
   let billingMessage = `Project ${projectId} created successfully.`;
 
   try {
-    const billingAccounts = await listBillingAccounts();
+    const billingAccounts = await listBillingAccounts(accessToken);
     if (billingAccounts && billingAccounts.length > 0) {
       const firstBillingAccount = billingAccounts.find((acc) => acc.open); // Prefer an open account
       if (firstBillingAccount) {
@@ -137,7 +141,8 @@ export async function createProjectAndAttachBilling(projectIdParam, parent) {
         );
         const billingInfo = await attachProjectToBillingAccount(
           projectId,
-          firstBillingAccount.name
+          firstBillingAccount.name,
+          accessToken
         );
         if (billingInfo && billingInfo.billingEnabled) {
           billingMessage += ` It has been attached to billing account ${firstBillingAccount.displayName}.`;
@@ -171,8 +176,8 @@ export async function createProjectAndAttachBilling(projectIdParam, parent) {
  * @param {string} projectId - The ID of the project to delete.
  * @returns {Promise<void>} A promise that resolves when the delete operation is initiated.
  */
-export async function deleteProject(projectId) {
-  const client = await getProjectsClient();
+export async function deleteProject(projectId, accessToken) {
+  const client = await getProjectsClient(accessToken);
   try {
     console.log(`Attempting to delete project with ID: ${projectId}`);
     await client.deleteProject({ name: `projects/${projectId}` });

package/lib/cloud-api/registry.js

@@ -33,12 +33,16 @@ import { logAndProgress } from '../util/helpers.js';
  */
 export async function ensureArtifactRegistryRepoExists(
   projectId,
+  accessToken,
   location,
   repositoryId,
   format = 'DOCKER',
   progressCallback
 ) {
-  const artifactRegistryClient = await getArtifactRegistryClient(projectId);
+  const artifactRegistryClient = await getArtifactRegistryClient(
+    projectId,
+    accessToken
+  );
   const parent = `projects/${projectId}/locations/${location}`;
   const repoPath = artifactRegistryClient.repositoryPath(
     projectId,

package/lib/cloud-api/run.js

@@ -23,14 +23,14 @@ import {
 import { callWithRetry, ensureApisEnabled } from './helpers.js';
 import { logAndProgress } from '../util/helpers.js';
 
-async function listCloudRunLocations(projectId) {
+async function listCloudRunLocations(projectId, accessToken) {
   const listLocationsRequest = {
     name: `projects/${projectId}`,
   };
 
   const availableLocations = [];
   try {
-    const runClient = await getRunClient(projectId);
+    const runClient = await getRunClient(projectId, accessToken);
     console.log('Listing Cloud Run supported locations:');
     const iterable = runClient.listLocationsAsync(listLocationsRequest);
     for await (const location of iterable) {
@@ -51,11 +51,11 @@ async function listCloudRunLocations(projectId) {
  * @param {string} projectId - The Google Cloud project ID.
  * @returns {Promise<object>} - A promise that resolves to an object mapping region to list of service objects in that region.
  */
-export async function listServices(projectId) {
-  const runClient = await getRunClient(projectId);
+export async function listServices(projectId, accessToken) {
+  const runClient = await getRunClient(projectId, accessToken);
 
-  await ensureApisEnabled(projectId, ['run.googleapis.com']);
-  const locations = await listCloudRunLocations(projectId);
+  await ensureApisEnabled(projectId, ['run.googleapis.com'], accessToken);
+  const locations = await listCloudRunLocations(projectId, accessToken);
 
   const allServices = {};
   for (const location of locations) {
@@ -85,8 +85,8 @@ export async function listServices(projectId) {
  * @param {string} serviceId - The ID of the Cloud Run service.
  * @returns {Promise<object>} - A promise that resolves to the service object.
  */
-export async function getService(projectId, location, serviceId) {
-  const runClient = await getRunClient(projectId);
+export async function getService(projectId, location, serviceId, accessToken) {
+  const runClient = await getRunClient(projectId, accessToken);
 
   const servicePath = runClient.servicePath(projectId, location, serviceId);
 
@@ -125,10 +125,10 @@ export async function getServiceLogs(
   projectId,
   location,
   serviceId,
+  accessToken,
   requestOptions
 ) {
-  const loggingClient = await getLoggingClient(projectId);
-
+  const loggingClient = await getLoggingClient(projectId, accessToken);
   try {
     const LOG_SEVERITY = 'DEFAULT'; // e.g., 'DEFAULT', 'INFO', 'WARNING', 'ERROR'
     const PAGE_SIZE = 100; // Number of log entries to retrieve per page
@@ -226,9 +226,10 @@ export async function checkCloudRunServiceExists(
   projectId,
   location,
   serviceId,
+  accessToken,
   progressCallback
 ) {
-  const runClient = await getRunClient(projectId);
+  const runClient = await getRunClient(projectId, accessToken);
   const servicePath = runClient.servicePath(projectId, location, serviceId);
   try {
     await callWithRetry(

package/lib/cloud-api/storage.js

@@ -34,9 +34,10 @@ export async function ensureStorageBucketExists(
   projectId,
   bucketName,
   location = 'us',
+  accessToken,
   progressCallback
 ) {
-  const storage = await getStorageClient(projectId);
+  const storage = await getStorageClient(projectId, accessToken);
   const bucket = storage.bucket(bucketName);
   try {
     const [exists] = await callWithRetry(

package/lib/deployment/constants.js

@@ -21,12 +21,14 @@ export const DEPLOYMENT_CONFIG = {
   IMAGE_TAG: 'latest',
   LABEL_CREATED_BY: 'cloud-run-mcp',
   DEFAULT_NODE_BASE_IMAGE: 'nodejs22',
+  DEFAULT_PYTHON_BASE_IMAGE: 'python314',
   NO_BUILD_IMAGE_TYPE: 'scratch',
 };
 
 export const TEMP_PATHS = {
   BASE: '.cloud-run-mcp',
   SUBDIR: 'source',
+  BIN_SUBDIR: 'bin',
 };
 
 export const REQUIRED_APIS = {
@@ -49,6 +51,7 @@ export const DEPLOYMENT_TYPES = {
 
 export const RUNTIMES = {
   NODEJS: 'nodejs',
+  PYTHON: 'python',
 };
 
 export const MAX_ALLOWED_DIRECT_SOURCE_SIZE_BYTES = 250 * 1024 * 1024; // 250 MiB