How to Connect Firebase to Gemini via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Firebase, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Firebase + Gemini

Let your AI work with Firebase: list projects and apps, browse and query Cloud Firestore, create and update documents, look up and disable Authentication users, read Remote Config, and (switched off by default) publish Remote Config or send push notifications. Signs in with your Google account.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET

Step 1 — Get credentials

1. Open console.cloud.google.com and select the Google Cloud project of your Firebase project (it has the same project id). Creating the OAuth client there is simplest, because API calls count against the client's project and that project needs the APIs enabled.
2. Go to APIs & Services → Library and enable the APIs you will use: Firebase Management API, Cloud Firestore API, Identity Toolkit API, Firebase Remote Config API and Firebase Cloud Messaging API.
3. Open APIs & Services → OAuth consent screen. Choose Internal if you are on Google Workspace (the simplest option), otherwise External. For External, set the publishing status to In production: while the app is in Testing, Google revokes its refresh tokens after 7 days and the connector stops working every week.
4. Open APIs & Services → Credentials → Create credentials → OAuth client ID, choose the application type Web application and add the authorized redirect URI https://cloud.anythingmcp.com/api/mcp-oauth/callback. If you host AnythingMCP yourself, enter https://your-anythingmcp-host/api/mcp-oauth/callback instead.
5. Paste the client ID into GOOGLE_CLIENT_ID and the client secret into GOOGLE_CLIENT_SECRET, install the connector, then click Authorize with Provider and sign in with an account that is a member of the Firebase project.

One Google client for all Google connectors: the same Cloud project and OAuth client can serve every Google connector, from Gmail and Google Sheets to Search Console and BigQuery. Enable each API in that project, reuse the same client ID and secret, and authorize each connector once.

Scope and roles: the connector asks for https://www.googleapis.com/auth/cloud-platform, because the narrower Firebase scopes do not cover user administration and Remote Config. What the AI can do is limited by the account's roles in the project: for read-only use give it Firebase Viewer and Cloud Datastore Viewer; changes need roles such as Cloud Datastore User, Firebase Authentication Admin, Firebase Remote Config Admin and Firebase Cloud Messaging Admin.

What it does: list projects and their Android, iOS and web apps; browse Firestore collections and documents and query them with filters, ordering and a limit; create and update documents; look up and list Authentication users and disable or re-enable their sign-in; read the Remote Config template and its version history.

Changes wait for your yes: before firebase_create_document, firebase_update_document or firebase_set_user_disabled, the AI tells you exactly what will change and waits for a clear yes. Changes reach your live app at once. Firestore security rules do not apply here: the connector acts with the signed-in account's rights, like the Admin SDK.

Switched off at install: firebase_delete_document (deletes for good), firebase_publish_remote_config (replaces the live configuration of every app) and firebase_send_message (sends a real push notification to real devices). An admin turns them on one by one if needed; even then, the AI checks the change with a validation run first and publishes or sends only after your yes.

Firestore reads are billed: every document returned counts as a read on your Firebase bill, so the AI keeps pages small (20 documents by default) and asks only for the fields it needs. A filter on one field combined with ordering on another needs a composite index, and the error message links to the page that creates it. Password hashes and salts of users are never returned.

Not included: Crashlytics has no documented public REST API, so crash data is not available. Cloud Storage files, Realtime Database, Data Connect, App Check and Analytics are out of scope as well.

Common errors: 401 means the authorization expired or was revoked: click Authorize with Provider again. 403 PERMISSION_DENIED with "API has not been used in project" or SERVICE_DISABLED: enable that API in the Cloud project of the OAuth client; other 403s mean the account lacks the role. 404: a wrong project id, database id or path (a document path where a collection path is expected, or the other way round). 400 FAILED_PRECONDITION "The query requires an index": open the link in the message to create the index. 409 on publishing Remote Config: the template changed in the meantime, so the AI reads it again. 429: a quota is reached; wait and try again.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Gemini

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Gemini CLI reads MCP servers from ~/.gemini/settings.json (on Windows %USERPROFILE%\.gemini\settings.json). Add:

{
  "mcpServers": {
    "anythingmcp": {
      "httpUrl": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart gemini.
3. Run /mcp inside Gemini CLI (or gemini mcp list in your shell): anythingmcp should show as connected.
4. Start prompting: Gemini CLI can now call the Firebase tools.

Available tools

Example prompts

• "List my Firebase projects and the Android, iOS and web apps in each one."
• "In Firestore, show me the ten most recent documents in orders with the status open."
• "Is there a user with the email [email protected] in Firebase Authentication? When did she last sign in?"
• "Disable sign-in for the account [email protected]. Tell me which account it is before you do it."
• "What does our Remote Config template contain, and who published the last three versions?"

FAQ

Where does Gemini CLI look for MCP servers? In ~/.gemini/settings.json for your user, or in .gemini/settings.json inside a project. gemini mcp list shows each server and whether it connects.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT