The service account key stays a file and is found through an environment variable, which is the difference between handing an agent a path and handing it your database. Writes are part of the surface, so scope the service account to the collections you actually meant to open.
A Python bridge between an MCP client and Firebase Firestore, built on the official mcp SDK. It exposes Firestore reads and writes as tools, authenticated with a Firebase service account key.
- Documents read out of a Firestore collection you name
- Writes back into a Firestore collection
- Authentication from a service account key file, located by SERVICE_ACCOUNT_KEY_PATH or, failing that, by a serviceAccountKey.json sitting beside the server
Python 3.7 or later, the packages in requirements.txt installed with pip or uv, a Firebase project with Firestore enabled, and a service account key JSON. Set SERVICE_ACCOUNT_KEY_PATH when the server is launched by a client, since that is the flexible path; otherwise keep the key next to the server file.