gcs-google-mcp-server 0.1.9 → 0.1.10

package/build/healthcheck.js

@@ -0,0 +1,37 @@
+import { logInfo } from '../shared/logging.js';
+/**
+ * Thrown when a constrained bucket cannot be reached (does not exist or the
+ * service account lacks access to it).
+ */
+export class BucketNotAccessibleError extends Error {
+    constructor(bucket) {
+        super(`Constrained bucket "${bucket}" does not exist or is not accessible`);
+        this.name = 'BucketNotAccessibleError';
+    }
+}
+/**
+ * Validate GCS credentials and connectivity.
+ *
+ * - When constrained to a single bucket (`GCS_BUCKET`), probe ONLY that bucket
+ *   via `headBucket`, which needs only bucket-level permissions
+ *   (`storage.buckets.get`). This path must NOT call `listBuckets()`, because
+ *   that requires the project-level `storage.buckets.list` permission, which a
+ *   least-privilege, bucket-scoped service account intentionally does not have.
+ * - Without a constraint, validate by listing buckets, which legitimately
+ *   requires project-level access.
+ *
+ * Throws on failure; callers decide how to surface it.
+ */
+export async function validateGcsCredentials(client, constrainedBucket) {
+    if (constrainedBucket) {
+        const bucketExists = await client.headBucket(constrainedBucket);
+        if (!bucketExists) {
+            throw new BucketNotAccessibleError(constrainedBucket);
+        }
+        logInfo('healthcheck', `Constrained bucket "${constrainedBucket}" verified`);
+    }
+    else {
+        await client.listBuckets();
+        logInfo('healthcheck', 'GCS credentials validated successfully');
+    }
+}

package/build/index.js

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'url';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createMCPServer, GoogleCloudStorageClient } from '../shared/index.js';
 import { logServerStart, logError, logWarning, logInfo } from '../shared/logging.js';
+import { validateGcsCredentials } from './healthcheck.js';
 // Read version from package.json
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = join(__dirname, '..', 'package.json');
@@ -108,18 +109,10 @@ async function performHealthChecks() {
             keyFilePath,
             keyFileContents,
         });
-        // Try to list buckets to validate credentials
-        await client.listBuckets();
-        logInfo('healthcheck', 'GCS credentials validated successfully');
-        // If GCS_BUCKET is set, verify it exists and is accessible
-        if (constrainedBucket) {
-            const bucketExists = await client.headBucket(constrainedBucket);
-            if (!bucketExists) {
-                logError('healthcheck', `Constrained bucket "${constrainedBucket}" does not exist or is not accessible`);
-                process.exit(1);
-            }
-            logInfo('healthcheck', `Constrained bucket "${constrainedBucket}" verified`);
-        }
+        // Validate credentials. When constrained to a single bucket, this probes
+        // only that bucket and never calls listBuckets(), so a least-privilege,
+        // bucket-scoped service account (without storage.buckets.list) can start.
+        await validateGcsCredentials(client, constrainedBucket);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gcs-google-mcp-server",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "MCP server for Google Cloud Storage operations with fine-grained tool access control",
   "mcpName": "com.pulsemcp/gcs",
   "main": "build/index.js",