Firebase

Firebase

This connector works with Firebase through Google's REST APIs: the Firebase Management API (projects and apps), the Cloud Firestore REST API (collections, documents, queries, creating and updating documents), Firebase Authentication user administration through the Identity Toolkit API (look up, list, disable users), Remote Config (read the template and its history, publish a new one) and Cloud Messaging (FCM HTTP v1, send a push notification). It signs in with your Google account (OAuth), so the AI acts with that account's rights in the Firebase project.

Setup (one-time, about 10 minutes)

1. Open https://console.cloud.google.com and select the Google Cloud project of your Firebase project (same project id). Creating the OAuth client there is simplest: API calls are counted against the client's project, so that project needs the APIs enabled.
2. APIs & Services → Library → enable Firebase Management API, Cloud Firestore API, Identity Toolkit API, Firebase Remote Config API and Firebase Cloud Messaging API (only the ones you will use).
3. APIs & Services → OAuth consent screen: Internal on Google Workspace, otherwise External with publishing status In production (in Testing, Google revokes the authorization after 7 days).
4. Credentials → Create credentials → OAuth client ID → Web application → authorized redirect URI <your AnythingMCP URL>/api/mcp-oauth/callback (on AnythingMCP Cloud: https://cloud.anythingmcp.com/api/mcp-oauth/callback).
5. Paste the client ID and secret into GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, install, then click Authorize with Provider and sign in with an account that is a member of the Firebase project.

Scope and roles: the connector asks for https://www.googleapis.com/auth/cloud-platform. The narrower Firebase scopes do not cover everything here: firebase and firebase.readonly cover projects, apps and listing users but not the admin user lookup or update, datastore covers only Firestore, and Remote Config accepts only cloud-platform. What the AI can do is limited by the account's IAM roles in the project: for read-only use give it Firebase Viewer (or Viewer) and Cloud Datastore Viewer; writes need e.g. Cloud Datastore User, Firebase Authentication Admin, Firebase Remote Config Admin and Firebase Cloud Messaging Admin.

Writes need confirmation. Before firebase_create_document, firebase_update_document or firebase_set_user_disabled, tell the user exactly what will change and wait for a clear yes. Changes reach the live app immediately. Switched off at install: firebase_delete_document (deletes permanently), firebase_publish_remote_config (replaces the live configuration of every app) and firebase_send_message (sends a real notification to real devices). Turn them on per tool only if needed.

Projects and apps: firebase_list_projects gives the projectId every other tool needs; firebase_get_project shows its default resources; firebase_list_apps lists the project's Android, iOS and web apps.

Firestore

• Paths are relative to the database. A collection path has an odd number of segments (users, users/abc/orders), a document path an even number (users/abc). database_id defaults to (default); pass it only for a named database.
• Start with firebase_list_collections (top level, or parent: "documents/users/abc" for a document's subcollections), then firebase_list_documents, firebase_get_document or firebase_query_documents.
• Values are typed: {"stringValue": "Anna"}, {"integerValue": "42"} (a string), {"doubleValue": 9.5}, {"booleanValue": true}, {"timestampValue": "2026-10-15T09:00:00Z"}, {"nullValue": null}, {"mapValue": {"fields": {...}}}, {"arrayValue": {"values": [...]}}, {"referenceValue": "projects/p/databases/(default)/documents/users/abc"}, {"geoPointValue": {"latitude": 1, "longitude": 2}}. Writes use the same format.
• firebase_query_documents runs a structured query on one collection id: where takes {"fieldFilter": {"field": {"fieldPath": "status"}, "op": "EQUAL", "value": {"stringValue": "open"}}}; combine with {"compositeFilter": {"op": "AND", "filters": [...]}}. Operators: LESS_THAN, LESS_THAN_OR_EQUAL, GREATER_THAN, GREATER_THAN_OR_EQUAL, EQUAL, NOT_EQUAL, ARRAY_CONTAINS, IN, ARRAY_CONTAINS_ANY, NOT_IN. orderBy: [{"field": {"fieldPath": "createdAt"}, "direction": "DESCENDING"}]. A filter on one field plus ordering on another needs a composite index: the error message contains a link to create it.
• Reads are billed per document returned (and at least one read per query). Keep limit and pageSize small (defaults 20) and use fields masks to keep answers small.
• firebase_update_document changes only the fields listed in update_fields (other fields stay); without update_fields it replaces the whole document. It never creates a missing document (that fails with 404): use firebase_create_document.
• Security rules do not apply to this connector: it acts with the IAM rights of the signed-in account, like the Admin SDK.

Authentication users: firebase_lookup_users finds users by emails, uids or phone_numbers; firebase_list_users pages through all users (nextPageToken). Password hashes and salts are never returned. firebase_set_user_disabled blocks or unblocks sign-in (existing sessions end when their ID token expires, at most one hour).

Remote Config

• firebase_get_remote_config returns the current template (conditions, parameters, groups, version) and its etag in _headers.etag. firebase_list_remote_config_versions shows the change history.
• firebase_publish_remote_config (switched off) replaces the whole template: send every condition, parameter and group you want to keep, not only the changed one, and pass the etag from the read right before. Run it once with validate_only: true, show the user the change and publish only after a yes. A stale etag fails with 409: read again.

Cloud Messaging: firebase_send_message (switched off) sends one message to a device token, a topic or a condition. Use validate_only: true to check a message without sending. Confirm the audience and text with the user before every real send.

Not available: Crashlytics has no documented public REST API (only an unannounced alpha used by Google's own tools), so crash data is not included. Cloud Storage files, Realtime Database, Data Connect, App Check and Analytics are also out of scope.

Common errors

• 401: the authorization expired or was revoked. Click Authorize with Provider again.
• 403 PERMISSION_DENIED "API has not been used in project" or "SERVICE_DISABLED": enable that API in the Cloud project of the OAuth client. Other 403s: the account lacks the IAM role.
• 404: wrong project id, database id or path (a document path where a collection path is expected, or the other way round).
• 400 FAILED_PRECONDITION "The query requires an index": open the link in the message to create the index.
• 409 on publish: the etag is stale; 429: quota, wait and retry.