@google-cloud/cloud-run-mcp 1.9.0 → 1.11.0

package/README.md

@@ -274,3 +274,27 @@ Post the configuration changes as shown above, start the Gemini CLI. You should
 This will take you to the authentication page on your browser, wherein you need to sign in using the appropriate gmail id, and accept the terms and conditions. Once the authentication is succcessful, you can come back to the Gemini CLI, and the Cloud Run MCP server will be ready to use.
 
 The Google Cloud Platform Terms of Service (available at https://cloud.google.com/terms/) and the Data Processing and Security Terms (available at https://cloud.google.com/terms/data-processing-terms) do not apply to any component of the Cloud Run MCP Server software.
+
+# Cloud Run Skills
+
+We introduce Cloud Run skills to enable AI agents to perform actions on Cloud Run. You can use these skills with Gemini CLI and other agentic AI tools. The skills are available at [Cloud Run Skills](https://github.com/GoogleCloudPlatform/cloud-run-mcp/blob/main/skills/cloud-run/SKILL.md).
+
+The Cloud Run skills are based on top of gcloud cli for Cloud Run empowering agents to perform all the actions on the Cloud Run using gcloud, as can be performed by the GCP user using gcloud cli.
+
+In order to use Cloud Run skills:
+
+1. Ensure you have the `gcloud` CLI installed and authenticated with `gcloud auth login` and `gcloud auth application-default login`.
+2. Set your project with `gcloud config set project [PROJECT_ID]`.
+3. Enable the skills on your agentic AI tool. For example, you can enable the skills for Gemini CLI using the following command on your terminal:
+
+```bash
+gemini skills install https://github.com/GoogleCloudPlatform/cloud-run-mcp.git --path skills/cloud-run
+```
+
+4. Once the skills are enabled, you can use them to perform actions on Cloud Run. Here are some of the prompts for you to get started:
+
+- List the Cloud Run services in the project test-gcp-project in the region us-west1.
+
+- Deploy the folder /home/username/workspace/hello-world as Cloud Run service hello-world to the project test-gcp-project in the region us-west1.
+
+- Describe the Cloud Run job hello-job in the project test-gcp-project in the region europe-west1.

package/SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+To report a security issue, please use [g.co/vulnz](https://g.co/vulnz).
+
+The Google Security Team will respond within 5 working days of your report on [g.co/vulnz](https://g.co/vulnz).
+
+We use [g.co/vulnz](https://g.co/vulnz) for our intake, and do coordination and disclosure here using GitHub Security Advisory to privately discuss and fix the issue.

package/cloudbuild.yaml

@@ -0,0 +1,37 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Default cloudbuild.yaml for Cloud Shell custom images.
+# This file is used by the Cloud Build trigger that builds this image.
+
+substitutions:
+  _IMAGE_TAG: '${COMMIT_SHA}'
+
+steps:
+  - name: 'gcr.io/cloud-builders/docker'
+    args:
+      [
+        'build',
+        '-t',
+        'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:latest',
+        '-t',
+        'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:public-image-${_IMAGE_TAG}',
+        '.',
+      ]
+images:
+  - 'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:latest'
+  - 'us-docker.pkg.dev/${PROJECT_ID}/container/mcp:public-image-${_IMAGE_TAG}'
+
+options:
+  dynamicSubstitutions: true

package/example-sources-to-deploy/java/pom.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>3.2.2</version>
+		<relativePath/> <!-- lookup parent from repository -->
+	</parent>
+	<groupId>com.example</groupId>
+	<artifactId>helloworld</artifactId>
+	<version>0.0.1-SNAPSHOT</version>
+	<name>helloworld</name>
+	<description>Demo project for Spring Boot</description>
+	<properties>
+		<java.version>17</java.version>
+	</properties>
+	<dependencies>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-web</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-maven-plugin</artifactId>
+			</plugin>
+		</plugins>
+	</build>
+
+</project>

package/example-sources-to-deploy/java/src/main/java/com/example/helloworld/HelloworldApplication.java

@@ -0,0 +1,21 @@
+package com.example.helloworld;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@SpringBootApplication
+@RestController
+public class HelloworldApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(HelloworldApplication.class, args);
+	}
+
+	@GetMapping("/")
+	public String hello() {
+		return "Hello from Spring Boot on Cloud Run!";
+	}
+
+}

package/example-sources-to-deploy/java/src/main/resources/application.properties

@@ -0,0 +1 @@
+server.port=${PORT:8080}

package/example-sources-to-deploy/nodejs/index.js

@@ -0,0 +1,15 @@
+const express = require('express');
+const app = express();
+const port = process.env.PORT || 8080;
+
+app.get('/', (req, res) => {
+  res.send('Hello from Node.js on Cloud Run!');
+});
+
+app.get('/health', (req, res) => {
+  res.status(200).send('OK');
+});
+
+app.listen(port, () => {
+  console.log(`Nodejs sample app listening at http://localhost:${port}`);
+});

package/example-sources-to-deploy/nodejs/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "nodejs-sample-app",
+  "version": "1.0.0",
+  "description": "A simple Node.js sample application for Cloud Run",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js"
+  },
+  "dependencies": {
+    "express": "^4.18.2"
+  }
+}

package/example-sources-to-deploy/python/pip-project/main.py

@@ -0,0 +1,11 @@
+from flask import Flask, request
+
+app = Flask(__name__)
+
+@app.route('/')
+def hello():
+    user = request.args.get('user', 'World')
+    return f'Hello {user}'
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=8080)

package/example-sources-to-deploy/python/pip-project/requirements.txt

@@ -0,0 +1,2 @@
+Flask
+gunicorn

package/example-sources-to-deploy/python/pyproject-project/main.py

@@ -0,0 +1,11 @@
+from flask import Flask, request
+
+app = Flask(__name__)
+
+@app.route('/')
+def hello_world():
+    user = request.args.get('user', 'World')
+    return f'Hello {user}'
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=8080)

package/example-sources-to-deploy/python/pyproject-project/pyproject.toml

@@ -0,0 +1,10 @@
+[project]
+name = "pyproject-project"
+version = "0.1.0"
+dependencies = [
+    "Flask",
+    "gunicorn",
+]
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"

package/gemini-extension.json

@@ -7,5 +7,17 @@
       "args": ["-y", "@google-cloud/cloud-run-mcp"]
     }
   },
+  "settings": [
+    {
+      "name": "Project ID",
+      "description": "Google Cloud project ID to use for Cloud Run operations.",
+      "envVar": "GOOGLE_CLOUD_PROJECT"
+    },
+    {
+      "name": "Region",
+      "description": "Google Cloud region where Cloud Run services will be managed.",
+      "envVar": "GOOGLE_CLOUD_REGION"
+    }
+  ],
   "contextFileName": "gemini-extension/GEMINI.md"
 }

package/lib/clients.js

@@ -22,12 +22,15 @@ const CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET;
 const REDIRECT_URI = process.env.GOOGLE_OAUTH_REDIRECT_URI;
 const AUTHORIZATION_HEADER = 'Authorization';
 const BEARER_PREFIX = 'Bearer';
+const CLOUD_PLATFORM_SCOPE = 'https://www.googleapis.com/auth/cloud-platform';
 
-function keyGenerator(projectId, accessToken) {
-  return accessToken !== GCLOUD_AUTH ? projectId + accessToken : projectId;
+function keyGenerator(projectId, accessToken, region = '') {
+  const baseKey =
+    accessToken !== GCLOUD_AUTH ? projectId + accessToken : projectId;
+  return baseKey + (region || '');
 }
 
-const clients = {
+export const clients = {
   run: new Map(),
   builds: new Map(),
   serviceUsage: new Map(),
@@ -37,7 +40,9 @@ const clients = {
   logging: new Map(),
   billing: new Map(),
   projects: new Map(),
+  runV1: new Map(),
   oauth: new Map(),
+  secretManager: new Map(),
 };
 
 function getAuthClient(accessToken) {
@@ -275,6 +280,26 @@ export async function getProjectsClient(accessToken = GCLOUD_AUTH) {
   );
 }
 
+/**
+ * Gets a Secret Manager Client for the specified project.
+ * @param {string} projectId - The Google Cloud project ID.
+ * @returns {Promise<import('@google-cloud/secret-manager').SecretManagerServiceClient>}
+ */
+export async function getSecretManagerClient(
+  projectId,
+  accessToken = GCLOUD_AUTH
+) {
+  const key = keyGenerator(projectId, accessToken);
+  return getClient(
+    'secretManager',
+    key,
+    async () =>
+      (await import('@google-cloud/secret-manager')).SecretManagerServiceClient,
+    { projectId },
+    accessToken
+  );
+}
+
 /**
  * Gets an OAuth2 Client for the specified access token.
  * @param {string} accessToken - The access token.
@@ -290,3 +315,79 @@ export async function getOAuthClient(accessToken) {
 
   return clients.oauth.get(accessToken);
 }
+
+/**
+ * Gets a Cloud Run v1 Client (from googleapis).
+ * @param {string} projectId - The Google Cloud project ID.
+ * @param {string} accessToken - Access token for authentication.
+ * @param {string} [region] - The Google Cloud region (optional).
+ * @returns {Promise<import('googleapis').run_v1.Run>}
+ */
+export async function getRunV1Client(
+  projectId,
+  accessToken = GCLOUD_AUTH,
+  region = null
+) {
+  const key = keyGenerator(projectId, accessToken, region);
+  if (!clients.runV1.has(key)) {
+    const { google } = await import('googleapis');
+    const options = { version: 'v1' };
+
+    if (accessToken && accessToken !== GCLOUD_AUTH) {
+      options.auth = await getOAuthClient(accessToken);
+    } else {
+      // Use Application Default Credentials for GCLOUD_AUTH
+      const auth = new google.auth.GoogleAuth({
+        scopes: [CLOUD_PLATFORM_SCOPE],
+        projectId: projectId,
+      });
+      options.auth = auth;
+    }
+
+    if (region) {
+      const availableRegions = await getCloudRunRegions(projectId, accessToken);
+      if (!availableRegions.includes(region)) {
+        throw new Error(`Invalid region: ${region}.`);
+      }
+      options.rootUrl = `https://${region}-run.googleapis.com/`;
+    }
+    clients.runV1.set(key, google.run(options));
+  }
+  return clients.runV1.get(key);
+}
+
+let cachedRegions = null;
+
+/**
+ * Resets the cached regions. Used for testing.
+ */
+export function resetCachedRegions() {
+  cachedRegions = null;
+}
+
+/**
+ * Returns a list of supported Cloud Run regions by fetching them from Compute Engine API.
+ * This is the SDK equivalent of `gcloud compute regions list`.
+ * Note: This is not moved to utils as it is required by getRunV1Client. Moving it to utils
+ * would lead to circular dependency.
+ * @param {string} projectId - The project ID to fetch regions for.
+ * @param {string} accessToken - The access token for authentication.
+ * @returns {Promise<string[]>}
+ */
+export async function getCloudRunRegions(projectId, accessToken) {
+  if (cachedRegions) {
+    return cachedRegions;
+  }
+  const runClient = await getRunClient(projectId, accessToken);
+  const iterable = runClient.listLocationsAsync({
+    name: `projects/${projectId}`,
+  });
+
+  const regions = [];
+  for await (const region of iterable) {
+    regions.push(region.locationId);
+  }
+
+  cachedRegions = regions;
+  return cachedRegions;
+}

package/lib/cloud-api/build.js

@@ -14,6 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import path from 'node:path';
+import fs from 'node:fs';
 import {
   getCloudBuildClient,
   getLoggingClient,
@@ -21,8 +23,16 @@ import {
   getBuildsClient,
 } from '../clients.js';
 import { callWithRetry } from './helpers.js';
-import { logAndProgress } from '../util/helpers.js';
+import {
+  logAndProgress,
+  calculateSourceFingerprint,
+  sanitizeCloudRunServiceName,
+} from '../util/helpers.js';
 import { checkCloudRunServiceExists } from './run.js';
+import { ensureArtifactRegistryRepoExists } from './registry.js';
+import { ensureStorageBucketExists, uploadToStorageBucket } from './storage.js';
+import { zipFiles } from '../util/archive.js';
+import { DEPLOYMENT_CONFIG } from '../deployment/constants.js';
 
 const DELAY_WAIT_FOR_BUILD_LOGS = 10000; // 10 seconds delay to allow logs to propagate
 const BUILD_LOGS_LINES_TO_FETCH = 100; // Number of log lines to fetch for build logs snippet
@@ -54,9 +64,11 @@ export async function triggerCloudBuild(
   targetImageUrl,
   hasDockerfile,
   accessToken,
-  progressCallback
+  progressCallback,
+  ingress
 ) {
-  const serviceName = targetImageUrl.split('/').pop().split(/[:@]/)[0];
+  const rawServiceName = targetImageUrl.split('/').pop().split(/[:@]/)[0];
+  const serviceName = sanitizeCloudRunServiceName(rawServiceName);
   const parent = `projects/${projectId}/locations/${location}`;
   const serviceFullName = `${parent}/services/${serviceName}`;
   const buildsClient = await getBuildsClient(projectId, accessToken);
@@ -78,6 +90,10 @@ export async function triggerCloudBuild(
     },
   };
 
+  if (ingress) {
+    servicePatch.ingress = ingress;
+  }
+
   try {
     if (serviceExists) {
       await logAndProgress(
@@ -123,36 +139,76 @@ export async function triggerCloudBuild(
     throw new Error(`Dry-run deployment failed: ${err.message}`);
   }
 
-  const request = {
-    parent: `projects/${projectId}/locations/${location}`,
-    storageSource: {
-      bucket: sourceBucketName,
-      object: sourceBlobName,
-    },
-    imageUri: targetImageUrl,
-    client: 'cloud-run-mcp',
-  };
+  let buildId;
+  let completedBuild;
+
   if (hasDockerfile) {
-    request.dockerBuild = {};
+    // Docker builds need manual control via v1 createBuild to enable BuildKit support.
+    // This resolves issues with advanced Dockerfile instructions like heredocs (RUN <<EOF).
+    const build = {
+      images: [targetImageUrl],
+      source: {
+        storageSource: {
+          bucket: sourceBucketName,
+          object: sourceBlobName,
+        },
+      },
+      steps: [
+        {
+          name: 'gcr.io/cloud-builders/docker',
+          args: ['build', '-t', targetImageUrl, '.'],
+          env: ['DOCKER_BUILDKIT=1'],
+        },
+      ],
+      options: {
+        logging: 'CLOUD_LOGGING_ONLY',
+      },
+    };
+
+    await logAndProgress(
+      `Initiating Cloud Build (BuildKit enabled) for gs://${sourceBucketName}/${sourceBlobName} in ${location}...`,
+      progressCallback
+    );
+
+    const [operation] = await callWithRetry(
+      () =>
+        cloudBuildClient.createBuild({
+          parent: `projects/${projectId}/locations/${location}`,
+          build,
+        }),
+      'cloudBuild.createBuild'
+    );
+    buildId = operation.metadata.build.id;
   } else {
-    request.buildpackBuild = {};
-  }
+    // For simple buildpacks, use the high-level submitBuild API if possible or if preferred for simplicity.
+    const request = {
+      parent: `projects/${projectId}/locations/${location}`,
+      storageSource: {
+        bucket: sourceBucketName,
+        object: sourceBlobName,
+      },
+      imageUri: targetImageUrl,
+      client: 'cloud-run-mcp',
+      buildpackBuild: {},
+    };
 
-  await logAndProgress(
-    `Initiating Cloud Build for gs://${sourceBucketName}/${sourceBlobName} in ${location}...`,
-    progressCallback
-  );
+    await logAndProgress(
+      `Initiating Cloud Build (Buildpacks) for gs://${sourceBucketName}/${sourceBlobName} in ${location}...`,
+      progressCallback
+    );
+
+    const [submitBuildResponse] = await callWithRetry(
+      () => buildsClient.submitBuild(request),
+      'builds.submitBuild'
+    );
+    const encodedBuildId = submitBuildResponse.buildOperation.name
+      .split('/')
+      .pop();
+    buildId = Buffer.from(encodedBuildId, 'base64').toString('ascii');
+  }
 
-  const [submitBuildResponse] = await callWithRetry(
-    () => buildsClient.submitBuild(request),
-    'builds.submitBuild'
-  );
   await logAndProgress(`Cloud Build job started...`, progressCallback);
-  const encodedBuildId = submitBuildResponse.buildOperation.name
-    .split('/')
-    .pop();
-  const buildId = Buffer.from(encodedBuildId, 'base64').toString('ascii');
-  let completedBuild;
+
   while (true) {
     const [getBuildOperation] = await callWithRetry(
       () =>
@@ -247,3 +303,111 @@ export async function triggerCloudBuild(
     throw new Error(`Build ${buildId} failed.${buildLogsSnippet}`);
   }
 }
+
+/**
+ * Build source for services defined in resourcesConfig.source_builds
+ * @param {*} resourcesConfig - resourcesConfig received from `run-compose resource` call
+ * @param {*} accessToken - access token for authentication
+ * @param {*} projectId - GCP project id
+ * @param {*} region - GCP region
+ * @param {*} folderPath - Path to the folder containing the source code
+ * @param {*} progressCallback - Callback function to report progress
+ * @returns - Completed resourcesConfig object
+ */
+export async function composeBuild(
+  resourcesConfig,
+  accessToken,
+  projectId,
+  region,
+  folderPath,
+  progressCallback
+) {
+  if (
+    !resourcesConfig.source_builds ||
+    Object.keys(resourcesConfig.source_builds).length === 0
+  ) {
+    return resourcesConfig;
+  }
+
+  // Ensure AR Repo exists once
+  await ensureArtifactRegistryRepoExists(
+    projectId,
+    accessToken,
+    region,
+    DEPLOYMENT_CONFIG.REPO_NAME,
+    'DOCKER',
+    progressCallback
+  );
+
+  const bucketName = `${projectId}_cloudbuild`;
+
+  // Ensure Storage Bucket exists once
+  const bucket = await ensureStorageBucketExists(
+    projectId,
+    bucketName,
+    region,
+    accessToken,
+    undefined,
+    false,
+    progressCallback
+  );
+
+  const buildPromises = Object.entries(resourcesConfig.source_builds).map(
+    async ([serviceName, buildInfo]) => {
+      const contextDir = path.join(folderPath, buildInfo.context);
+      await logAndProgress(
+        `Building source for service ${serviceName} in ${contextDir}...`,
+        progressCallback
+      );
+
+      // Check for Dockerfile in context
+      const hasDockerfile = fs.existsSync(path.join(contextDir, 'Dockerfile'));
+
+      // Generate Fingerprint
+      const fingerprint = await calculateSourceFingerprint(contextDir);
+      const composeProject = resourcesConfig.project;
+
+      // Generate image URL
+      // Use format: {repo}/{project_name}_{container}:{tag} matching builder.py
+      const imageUrl = `${region}-docker.pkg.dev/${projectId}/${DEPLOYMENT_CONFIG.REPO_NAME}/${composeProject}_${serviceName}:${DEPLOYMENT_CONFIG.IMAGE_TAG}`;
+
+      // Create tar.gz archive in memory
+      const archiveBuffer = await zipFiles(
+        [contextDir],
+        true,
+        progressCallback
+      );
+      // Use format: {epoch}.{fingerprint}.tgz in source/ folder
+      const archiveName = `source/${Date.now()}.${fingerprint}.tgz`;
+
+      const file = await uploadToStorageBucket(
+        bucket,
+        archiveBuffer,
+        archiveName,
+        progressCallback
+      );
+
+      // Trigger build
+      const buildResult = await triggerCloudBuild(
+        projectId,
+        region,
+        bucket.name,
+        archiveName,
+        DEPLOYMENT_CONFIG.REPO_NAME,
+        imageUrl,
+        hasDockerfile,
+        accessToken,
+        progressCallback,
+        undefined
+      );
+
+      const builtImageUrl = buildResult.results.images[0].name;
+      // Update resourcesConfig with image_id
+      resourcesConfig.source_builds[serviceName].image_id = builtImageUrl;
+    }
+  );
+
+  await Promise.all(buildPromises);
+
+  return resourcesConfig;
+}