Mmcp.market

Firebase MCP server

by dasasian·io.github.dasasian/firebase-mcp-server·v1.1.0

MCP server for Firebase — Firestore, Storage, Auth, and Cloud Logging, with schema validation.

A86/100grade A
What users say
No reviews yet
Be the first
Safety scan
A86/100

full report

Adoption
New

0 stars35 downloads/wk

Reviews

Write one

Nobody has reviewed Firebase yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Firebase tools (34, 8 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • firebase_auth_create_userwrite action

    SQL-style user creation. Maps to: INSERT INTO users (email, password, displayName, customClaims) VALUES (...). Creates new Firebase Auth user with optional properties. Use customClaims to set authorization data on creation (e.g., {admin: true, orgId: "org_123"}). No client-side rate limiting.

  • firebase_auth_delete_userwrite action

    SQL-style user deletion. Maps to: DELETE FROM users WHERE email=X OR uid=X. Permanently delete Firebase Auth user by email or uid. IRREVERSIBLE - user authentication and data will be permanently removed. Returns details of deleted user for confirmation.

  • firebase_auth_get_user

    SQL-style single user lookup. Maps to: SELECT * FROM users WHERE email=X OR uid=X. Get Firebase Auth user by email or uid. Returns full user data including customClaims (authorization data), account status, and metadata. Use before updating to see current state.

  • firebase_auth_list_users

    SQL-style user listing with filtering. Maps to: SELECT * FROM users WHERE ... LIMIT n. Lists Firebase Auth users with client-side filtering support. Supports email LIKE patterns (%@domain.com) and customClaims matching ({admin: true}). Auto-fetches all pages. Use for discovery before updating users.

  • firebase_auth_revoke_sessions

    SQL-style session revocation. Maps to: UPDATE users SET tokensValidAfterTime = NOW() WHERE uid = X. Revokes all refresh tokens for a Firebase Auth user, forcing them to sign out on all devices. User must sign in again to get new tokens. Use for security (compromised account, force logout) or administrative actions (suspend access temporarily).

  • firebase_auth_update_userwrite action

    SQL-style user update with claims merging. Maps to: UPDATE users SET customClaims.admin=true, email=X WHERE uid=Y. Updates Firebase Auth user properties and/or customClaims. Merges customClaims (doesn't replace) - only specified fields are updated. Use dot notation for claims: {"customClaims.admin": true} or direct object: {"customClaims": {admin: true}}. Set to null to remove: {"customClaims.admi

  • firebase_storage_cp

    Copy file within Firebase Storage bucket. Maps to Unix: cp source dest. Creates duplicate of file at new location. Original file remains unchanged. Use for backups, creating variants, or organizing files.

  • firebase_storage_find

    Search files in Firebase Storage with filters. Maps to Unix: find /path -name "*.png" -size +1M. Supports pattern matching (wildcards), content type filter, size filters, and date filters. Use for discovery like "find all large images" or "find PDFs from last month".

  • firebase_storage_get_access

    Check if Firebase Storage file is publicly accessible. Returns isPublic status and public URL if available. Use before sharing links to verify access permissions.

  • firebase_storage_get_url

    Get shareable download URL for Firebase Storage file. Returns public URL if file is public, otherwise generates signed URL with expiration. Use to share files with users or generate links for display.

  • firebase_storage_list_buckets

    List all Firebase Storage buckets in the project. Shows bucket names, locations, and storage classes. The default bucket is highlighted. Use this to discover available buckets before performing operations on non-default buckets.

  • firebase_storage_ls

    List files in Firebase Storage bucket. Maps to Unix: ls -la /path. Lists files with metadata including name, size, contentType, timestamps, and public URLs if available. Use for discovering files before read/download operations.

  • firebase_storage_mv

    Move or rename file within Firebase Storage bucket. Maps to Unix: mv source dest. File is moved to new location and deleted from source. Use for organizing files, renaming, or moving to different folders.

  • firebase_storage_pushwrite action

    Upload entire directory from local filesystem to Firebase Storage bucket. Maps to Unix: rsync local remote. Uploads all files in local directory to bucket path, preserving folder structure. Supports pattern filtering (e.g., "*.json" to upload only JSON files). Use for bulk upload, backup, or publishing processed files.

  • firebase_storage_read

    Download Firebase Storage file to temp directory for analysis. Maps to Unix: cat file. Downloads file to /tmp/firebase-{uuid}-{filename} and returns tempPath. Use Read tool on tempPath to analyze content (images, PDFs, text files, etc.). Enables Claude to work with Storage files like local files.

  • firebase_storage_rmwrite action

    Delete file from Firebase Storage bucket. Maps to Unix: rm file. Permanently removes file from storage. Returns deleted file details for confirmation. IRREVERSIBLE operation.

  • firebase_storage_set_access

    Set Firebase Storage file access permissions. Make file publicly accessible (public: true) or private (public: false). Public files have permanent URLs anyone can access. Private files require signed URLs with expiration. Use for controlling file visibility.

  • firebase_storage_stat

    Get file metadata from Firebase Storage. Maps to Unix: stat file. Returns detailed information about file including size, content type, creation/update times, MD5 hash. Use to check if file exists or get file info without downloading.

  • firebase_storage_sync

    Download entire directory from Firebase Storage to local filesystem. Maps to Unix: rsync remote local. Downloads all files in remote directory to local path, preserving folder structure. Use for bulk backup, local development with real data, or batch processing.

  • firebase_storage_uploadwrite action

    Upload local file to Firebase Storage bucket. Maps to Unix: cp local remote. Uploads file from local filesystem to bucket path. Auto-detects contentType from extension if not specified. Use after creating/editing files locally (via Write tool) to sync to cloud storage.

  • firestore_count

    Count documents in a collection WITHOUT fetching them. Achieves 99.96% context savings vs fetching all documents. Supports where clauses for filtered counts.

  • firestore_deletewrite action

    SQL-style document deletion. DELETE FROM collection WHERE conditions. Supports single document (id) or batch delete (where). Safety: requires WHERE or id, enforces limits (default: 100, max: 500), supports dryRun for preview. Returns deleted document paths.

  • firestore_export

    Export an entire Firestore collection to JSON. Works with or without schemas (discovery mode). Automatically serializes timestamps. Use limit to control size.

  • firestore_import

    Import document data to Firestore. DRY-RUN BY DEFAULT - shows diff before executing. Set dryRun=false to execute. Validates data if schema available.

  • firestore_query

    Query a Firestore collection with index-aware validation. Validates complex queries against firestore.indexes.json and suggests missing indexes. Supports where, orderBy, and limit.

  • firestore_query_collection_group

    Query across all instances of a subcollection (collection group query). For example, query all "events" subcollections across all organizations and products. Note: Collection group queries require indexes in production.

  • firestore_query_select

    SQL-style query with optional field projection. Maps to: SELECT fields FROM collection WHERE conditions ORDER BY fields LIMIT n. Supports LIKE operator for case-insensitive pattern matching. Automatically falls back to client-side scan when LIKE used or index missing. If unsure which collection to query, call firestore_show_collections first to see available collections. Omit "fields" to return al

  • firestore_read

    Read a single document from Firestore. Automatically serializes timestamps to ISO 8601 format. Optionally validates against schema if available.

  • firestore_select

    Fetch only specific fields from a document (field projection). Achieves 90% context savings by excluding unnecessary fields. Perfect for checking specific values without loading entire documents.

  • firestore_show_collections

    Maps to SQL: SHOW TABLES. Lists all available Firestore collections and subcollections with their paths and descriptions. ALWAYS call this FIRST when the user asks about data without specifying exact collection names (e.g., "bar locations" → check if "barLocations" collection exists, "products" → see all product collections). Helps you discover collection names and avoid guessing.

  • firestore_stats

    Get collection statistics and schema overview WITHOUT loading all documents. Achieves 99.3% context savings. Returns document count, field coverage, and inferred schema from samples. Perfect for exploration.

  • firestore_sum

    Sum a numeric field across a collection WITHOUT fetching full documents. Achieves 99.91% context savings. Also returns count and average. Perfect for analytics.

  • firestore_updatewrite action

    SQL-style update for one or more fields. Maps to: UPDATE path SET field1=value1, field2=value2 (single) or UPDATE collection SET field1=value1 WHERE conditions (batch). Supports dryRun for preview. Safety: enforces limits (default: 100, max: 500).

  • firestore_validate

    Validate a Firestore document against its schema. Shows detailed errors, warnings, and field status breakdown (official/experimental/legacy/unknown). Requires schema to be defined.

Public scan report

scanner v0.1.9 · 2026-09-23 · same rubric, same numbers if you re-run it

no findings
  • Code scan103 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 38 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 86/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the Firebase repository's README, as published. We do not edit it. Read it on GitHub

Firebase MCP Server

General-purpose Model Context Protocol (MCP) server for Firebase (Firestore, Storage, Auth, Functions Logging) with schema-driven validation and context-efficient tools.

Features

  • @ Mention Support - Reference Firestore documents with @firebase:firestore://users/user-123
  • Smart Autocomplete - MRU cache tracks accessed documents for quick re-reference
  • Auto-Discovery - Shows both schema-based AND discovered collections
  • Path-based schemas - Follows Firebase firestore.rules convention
  • Schema evolution - Field status metadata (experimental → official → legacy)
  • Hot reload - File watching, no restart needed when schemas change
  • Flexible validation - Three modes: strict, warn (default), permissive
  • Works without schemas - Discovery mode for exploring unknown databases
  • Context-efficient tools - 99% token reduction for large datasets
  • Index-aware queries - Validates queries against firestore.indexes.json
  • Functions logging - SQL-like queries for Cloud Functions logs with aggregations and label filtering

Install

Add it to your MCP client (e.g. Claude Code) — runs via npx, no global install needed:

{
  "mcpServers": {
    "firebase": {
      "command": "npx",
      "args": ["-y", "@dasasian/firebase-mcp-server", "start", "./firestore-schemas.json"]
    }
  }
}

start takes an optional schema config path (default ./firestore-schemas.json) and an optional indexes path (default ./firestore.indexes.json) — see Schema Format. Firebase auth uses Application Default Credentials.

Or install the CLI globally:

npm install -g @dasasian/firebase-mcp-server
firebase-mcp start ./firestore-schemas.json

Development (from source)

npm install
npm run build
npm run cli -- start --config ./examples/basic/firestore-schemas.json

@ Mention Support (Resources)

Reference Firestore documents directly in Claude Code:

What's the email for @firebase:firestore://users/user-123?
Show me all posts: @firebase:firestore://posts/*

How It Works

When you type @firebase in Claude Code:

Shows schema-based collections (with validation):

  • 📋 Users (User account documents)
  • 📋 Posts (Blog post documents)
  • 📋 Comments (Comments on posts)

Plus auto-discovered collections (no schema):

  • 🔍 analytics
  • 🔍 sessions
  • 🔍 audit_logs

Configuration

# Enable/disable auto-discovery (default: true)
export FIRESTORE_AUTO_DISCOVER=true

# Cache duration in seconds (default: 300 = 5 minutes)
export FIRESTORE_DISCOVERY_CACHE_TTL=300

Auto-discovery cost: ~$0.0003/day (negligible)

Tools

The server ships 33 tools in four groups. Every tool declares MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so a client can auto-approve reads and ask before writes.

Choosing which tools to load

All 33 tool definitions cost roughly 12k tokens of context on every session. If you only need part of the surface, narrow it:

# Only Firestore (12 tools, ~4.3k tokens)
firebase-mcp start --tools firestore

# Firestore plus Auth
firebase-mcp start --tools firestore,auth

Or set it in your MCP client config:

export FIREBASE_MCP_TOOLS=firestore,storage

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

Runs npx -y @dasasian/firebase-mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add firebase-mcp-server -- npx -y @dasasian/firebase-mcp-server
Add to Cursor

Firebase: common questions

Is Firebase MCP server safe?
Yes, by our scan: it is graded A (86/100). Read the Firebase safety report
How do I install Firebase?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Firebase need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Firebase maintained?
The last commit was 39 days ago (2026-08-16). The latest release is v1.1.0.
What can I use instead of Firebase?
Servers from other publishers that do the same job: Baserow Schema MCP server, Ticket Demo MCP server and ssh-mcp server. Compare all Firebase alternatives.

Alternatives to Firebase

Same job from other publishers: the closest match first, then the best rated.

All Firebase alternatives →
  • Baserow Schema MCP
    Generic Baserow API client MCP server with automatic 2FA (TOTP) auth and OpenAPI validation.
    B
  • Ticket Demo
    MCP server demo — tickets, schema discovery, auth, and PII gating. stdio + HTTP.
    B
  • ssh-mcp
    MCP gateway for controlled SSH access with per-client auth, command policies, and audit logging.
    B
  • spintax.net MCP server
    Write, validate, render and analyze spintax templates. Backed by @spintax/core. No auth.
    A
  • JAJ Dataverse Dev MCP
    Xrm/Power Platform/Dataverse MCP for devs, Azure CLI auth, Web API and multi-environment support
    A

More from dasasian →