Because it inherits the CLI's authentication and its active project, what an agent can reach is exactly what you can reach from that terminal — and firebase_update_environment is how you move it to a different project mid-session rather than restarting. Some tools route through Gemini in Firebase to generate SQL Connect schemas and answer product questions; Firebase's own guidance is to check that output before shipping it, which is worth taking seriously for generated security rules.
The Firebase CLI in MCP mode. It is launched as firebase-tools mcp over stdio, acts with the credentials that authorize the CLI in that environment, and groups its tools by Firebase product.
- Sign-in and the working environment — which account, which project directory, which active project the rest of the tools use — firebase_login, firebase_logout, firebase_get_environment, firebase_update_environment
- Projects and apps: list and create projects, register iOS, Android and Web apps, read back SDK config, add an Android SHA hash — firebase_list_projects, firebase_get_project, firebase_create_project, firebase_create_app, firebase_list_apps, firebase_get_sdk_config, firebase_create_android_sha
- Services initialized in the workspace, and deploys driven from firebase.json with a job id you can poll — firebase_init, firebase_deploy, firebase_deploy_status
- Security rules for Firestore, Storage and Realtime Database, retrieved and checked for syntax and validation errors — firebase_get_security_rules, firebase_validate_security_rules
- Firestore: collections listed, documents fetched by path, collections queried, documents deleted — firestore_list_collections, firestore_get_documents, firestore_query_collection, firestore_delete_document
- Authentication users looked up by UID or email, enabled, disabled or given custom claims, plus an SMS region policy — auth_get_users, auth_update_user, auth_set_sms_region_policy
- Crashlytics issues, their events and stack traces, aggregate reports and notes — crashlytics_get_issue, crashlytics_list_events, crashlytics_batch_get_events, crashlytics_get_report, crashlytics_update_issue, crashlytics_create_note, crashlytics_list_notes, crashlytics_delete_note
- Realtime Database reads and writes, Cloud Functions logs, Cloud Messaging sends, Remote Config templates, App Hosting backends and logs, and Storage download URLs — realtimedatabase_get_data, realtimedatabase_set_data, functions_get_logs, functions_list_functions, messaging_send_message, remoteconfig_get_template, remoteconfig_update_template, apphosting_list_backends, apphosting_fetch_logs, storage_get_object_download_url
- Firebase SQL Connect services listed, schemas and operations compiled, and GraphQL run against a service or its emulator — dataconnect_list_services, dataconnect_build, dataconnect_execute
- Google developer documentation searched and answered from a grounded corpus — developerknowledge_search_documents, developerknowledge_answer_query, developerknowledge_get_documents
- firebase:// resources the agent can read on its own: init guides for Firestore, Auth, Hosting and GenAI, Crashlytics investigation guides, and Firebase docs pages — firebase_read_resources
A Google Account signed in to the Firebase CLI — firebase_login can do it from inside the conversation. Node.js and npm; the server runs as npx -y firebase-tools@latest mcp over stdio, and there is also a Claude plugin and a Gemini CLI extension that install the same thing. Tool calls use whatever credentials authorize the Firebase CLI where the server runs, against whichever project is active.
One command — npx -y firebase-tools@latest mcp