Provides tools for Firebase project and app management, plus App Distribution for uploading builds to testers and managing tester groups.
Provides tools for Google Cloud Console core: Resource Manager (projects, IAM policy), IAM (service accounts, keys), and Service Usage (enable/disable APIs). Also includes Cloud Storage buckets/objects and Artifact Registry repositories under the storage domain.
Provides tools for managing Google Play Console: apps and edits, uploading new AAB/APK builds, managing release tracks (internal/alpha/beta/production, staged rollouts, pulling a bad version), store listings and screenshots, replying to reviews, in-app products and subscriptions, and testers.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@google-cloud-console-mcp ship my latest build to the internal testing track"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that gives AI assistants (Claude, etc.) hands-on control of Google Play Console and Google Cloud Console through a Google identity you authorize — a service account, or your own Google account via a one-time browser sign-in.
95 tools across four domains:
Play Console (play_*) — apps, edits, uploading new AAB/APK builds, managing release
tracks (internal/alpha/beta/production, staged rollouts, pulling a bad version), store listings
& screenshots, replying to reviews, in-app products & subscriptions, testers.
Cloud Console core (gcp_*) — Resource Manager (projects, IAM policy), IAM (service
accounts, keys), Service Usage (enable/disable APIs).
Firebase (firebase_*) — project/app management, App Distribution (upload builds to
testers, manage tester groups).
Storage (gcs_*, ar_*) — Cloud Storage buckets/objects, Artifact Registry repositories.
See docs/TOOLS.md for the full list with descriptions.
Pick a credential mode, then register the server with Claude Code. Full walkthrough (including
the required manual Play Console linking step) is in docs/SETUP.md.
Service account:
./scripts/setup-gcp.sh your-project-id # or scripts\setup-gcp.ps1 on Windows
claude mcp add google-cloud-console \
-e GOOGLE_APPLICATION_CREDENTIALS="/absolute/path/to/credentials/service-account.json" \
-e GOOGLE_CLOUD_PROJECT="your-project-id" \
-- npx -y google-cloud-console-mcpSign in with your Google account (browser OAuth):
export GOOGLE_OAUTH_CLIENT_ID=xxxxx.apps.googleusercontent.com
export GOOGLE_OAUTH_CLIENT_SECRET=xxxxx
npx -y google-cloud-console-mcp login # opens a browser once
claude mcp add google-cloud-console -- npx -y google-cloud-console-mcpSign in from Claude Code's native /mcp screen instead (no login step, but you run the
server yourself over HTTP — see docs/SETUP.md Path C):
export GOOGLE_OAUTH_CLIENT_ID=xxxxx.apps.googleusercontent.com
export GOOGLE_OAUTH_CLIENT_SECRET=xxxxx
npx -y google-cloud-console-mcp --http --port 3939 # keep this running
claude mcp add google-cloud-console --transport http http://127.0.0.1:3939/mcp
# then run /mcp in Claude Code and authenticate when promptedNot published to npm yet?
npx -y google-cloud-console-mcponly works once this package is published. Until then, runnpm run buildhere and pointclaude mcp addat the built file directly instead of-- npx -y google-cloud-console-mcp:claude mcp add google-cloud-console -e GOOGLE_APPLICATION_CREDENTIALS="..." -- node /path/to/google-cloud-console-mcp/dist/index.js
Then ask Claude to do something read-only first — "list my GCP projects", "list release tracks for com.example.app" — to confirm credentials are wired up before trying anything that writes.
Related MCP server: Google Play Store MCP Server
Add the block from examples/claude_desktop_config.json
to your Claude Desktop config (claude_desktop_config.json), filling in your own credential
values.
In HTTP mode (--http, Path C), each request carries its own verified Google access token
(from Claude Code's native /mcp OAuth sign-in) and that's used directly.
Otherwise (stdio mode, the default), the server picks the first of these that's available (see
src/auth/googleAuth.ts):
GOOGLE_SERVICE_ACCOUNT_JSON — service account key JSON, inline
GOOGLE_APPLICATION_CREDENTIALS — path to a service account key file
A token saved by google-cloud-console-mcp login (OAuth)
Standard Application Default Credentials discovery (gcloud auth application-default login,
or the GCE/Cloud Run metadata server when actually running on GCP infra)
By default every tool group is registered. To limit which ones are available (least privilege for what you're using it for right now), set:
GOOGLE_MCP_TOOL_GROUPS=playconsole,cloudcoreValid group names: playconsole, cloudcore, firebase, storage.
npm install
npm run build # tsc -> dist/
npm test # vitest
npm run typecheck
npm run dev # tsx watch, runs src/index.ts directly (no build step)
npm run gen:tools-doc # regenerate docs/TOOLS.md from the live tool registryProject layout:
src/
auth/ credential resolution, OAuth login flow, and the HTTP-mode OAuth bridge
(oauthBridgeProvider.ts — bridges Claude Code's native `/mcp` OAuth to Google)
lib/ shared helpers (tool definition, error formatting, logging, per-request auth context)
tools/
playconsole/ Android Publisher API tools
cloudcore/ Resource Manager, IAM, Service Usage tools
firebase/ Firebase project/app + App Distribution tools
storage/ Cloud Storage + Artifact Registry tools
server.ts builds the McpServer + registers every tool (shared by stdio and HTTP)
httpServer.ts HTTP transport + OAuth endpoints for Path C (`--http`)
index.ts CLI entrypoint (login/logout/whoami/--http/serve)Adding a tool: pick the right src/tools/<domain>/*.ts file, add a defineTool({...}) call, add
it to that file's exported array. It's picked up automatically — no registry to edit by hand.
This server can be granted very broad access on purpose — that's the point. Scope what you grant
it (IAM roles, Play Console permissions, GOOGLE_MCP_TOOL_GROUPS) to what you actually want an AI
assistant able to do unattended, and see the security notes in docs/SETUP.md. Never commit
credentials/ or .env.
MIT — see LICENSE.
Creates a new Artifact Registry repository (docker, maven, npm, python, apt, yum, go, generic, ...).
Inputs: location (required), repositoryId (required), format, projectId, +1 more.
Deletes a repository and all packages/versions inside it.
Inputs: location (required), repository (required), projectId.
Deletes one version of a package (e.g. an old Docker image tag/digest) to free up storage.
Inputs: version (required), location (required), repository (required), packageName (required), +1 more.
Lists packages (e.g. Docker image names) within a repository.
Inputs: location (required), repository (required), pageToken, projectId.
Lists Artifact Registry repositories in a project/location.
Inputs: location (required), pageToken, projectId.
Lists versions (e.g. image tags/digests) of one package.
Inputs: location (required), repository (required), packageName (required), pageToken, +1 more.
Enables Firebase on an existing GCP project, turning it into a Firebase project. This is a long-running operation; the response is an Operation resource — check its done field or poll it.
Inputs: projectId.
Creates tester resources for the given emails at the project level (not tied to a group).
Inputs: emails (required), projectId.
Adds tester emails to a group, creating tester resources for any that don't exist yet.
Inputs: emails (required), groupName (required).
Creates a new tester group under a Firebase project.
Inputs: displayName (required), groupId, projectId.
Deletes a tester group by its full resource name.
Inputs: groupName (required).
Deletes up to 100 releases at once, by their full resource names.
Inputs: appId (required), releaseNames (required).
Grants testers/groups access to an already-uploaded release and emails them. Creates testers that don't exist yet from testerEmails.
Inputs: releaseName (required), groupAliases, testerEmails.
Fetches one release by its full resource name.
Inputs: releaseName (required).
Lists tester groups for a Firebase project.
Inputs: pageToken, projectId.
Lists releases uploaded for a Firebase app, newest first by default.
Inputs: appId (required), filter, pageSize, pageToken.
Lists testers for a Firebase project.
Inputs: filter, pageToken, projectId.
Deletes tester resources for the given emails from a project entirely.
Inputs: emails (required), projectId.
Removes tester emails from a group (they lose access to releases shared with that group).
Inputs: emails (required), groupName (required).
Uploads a build (.apk/.aab for Android, .ipa for iOS) to Firebase App Distribution. This creates a new release (or updates an existing one if the binary is identical). Returns a long-running Operation — the release resource name is in the operation response once done. Follow up with firebase_appdistribution_distribute_release to notify testers.
Inputs: appId (required), filePath (required).
Registers a new Android app (by package name) under a Firebase project.
Inputs: packageName (required), projectId, displayName.
Registers a new iOS app (by bundle id) under a Firebase project.
Inputs: bundleId (required), projectId, appStoreId, displayName.
Registers a new web app under a Firebase project.
Inputs: displayName (required), projectId.
Fetches Firebase-specific metadata for a project (this requires Firebase to already be enabled on the GCP project — see firebase_add_firebase).
Inputs: projectId.
Lists the Android apps registered under a Firebase project.
Inputs: pageToken, projectId.
Lists the iOS apps registered under a Firebase project.
Inputs: pageToken, projectId.
Lists Firebase projects the authenticated identity can access.
Inputs: pageToken.
Lists the web apps registered under a Firebase project.
Inputs: pageToken, projectId.
Grants one role to one member on a project, preserving all existing bindings (read-modify-write against the current policy).
Inputs: role (required), member (required), projectId.
Creates a new GCP project. The caller's credentials need resourcemanager.projects.create permission (typically requires org/folder-level access, not just a service account scoped to one existing project).
Inputs: newProjectId (required), parentId, parentType, displayName.
Creates a new service account in a project.
Inputs: accountId (required), projectId, description, displayName.
Creates a new JSON key for a service account and returns the private key material base64-encoded (privateKeyData in the response) — save it immediately, Google does not let you retrieve it again after this call. Treat the output as a secret.
Inputs: email (required), projectId.
Requests deletion of a GCP project (soft delete — Google retains it for ~30 days and it can be restored with gcp_undelete_project within that window).
Inputs: projectId.
Deletes a service account. This is not immediately reversible after ~30 days.
Inputs: email (required), projectId.
Revokes a service account key by its key id.
Inputs: email (required), keyId (required), projectId.
Disables a Google API for a project. Dependent services may stop working.
Inputs: serviceName (required), projectId.
Enables a Google API for a project, e.g. "androidpublisher.googleapis.com".
Inputs: serviceName (required), projectId.
Checks whether a specific API is enabled for a project.
Inputs: serviceName (required), projectId.
Fetches details of a single GCP project.
Inputs: projectId.
Fetches the full IAM policy (role bindings) for a project.
Inputs: projectId.
Fetches one service account by email or by projects/{p}/serviceAccounts/{id} name.
Inputs: email (required), projectId.
Lists all APIs/services currently enabled for a project.
Inputs: pageToken, projectId.
Lists GCP projects visible to the authenticated identity. Supports Cloud Resource Manager filter syntax, e.g. filter: "state:ACTIVE" or "parent.id:1234567890".
Inputs: filter, pageSize, pageToken.
Lists key ids for a service account (never returns private key material for existing keys).
Inputs: email (required), projectId.
Lists all service accounts in a project.
Inputs: pageToken, projectId.
Revokes one role from one member on a project, preserving all other bindings.
Inputs: role (required), member (required), projectId.
Lists/searches Google APIs available to enable on a project (enabled or not). Use this to find the exact service name to pass to gcp_enable_api.
Inputs: pageToken, projectId.
Replaces the entire IAM policy for a project. Prefer gcp_add_project_iam_binding / gcp_remove_project_iam_binding for a single role change — this overwrites everything, so fetch with gcp_get_project_iam_policy first if you need to preserve existing bindings.
Inputs: bindings (required), projectId.
Restores a project that was recently soft-deleted (within the ~30 day retention window).
Inputs: projectId.
Creates a new Cloud Storage bucket. Bucket names are globally unique across all of GCS.
Inputs: bucket (required), location, projectId, storageClass, +1 more.
Deletes an empty bucket. Delete all objects in it first with gcs_delete_object.
Inputs: bucket (required).
Deletes one object from a bucket.
Inputs: bucket (required), object (required).
Downloads an object's content to a local file path.
Inputs: bucket (required), object (required), destinationPath (required).
Fetches metadata (location, storage class, versioning, etc.) for a bucket.
Inputs: bucket (required).
Fetches metadata for one object (size, contentType, md5Hash, generation, ...) without downloading its content.
Inputs: bucket (required), object (required).
Lists all Cloud Storage buckets in a project.
Inputs: pageToken, projectId.
Lists objects in a bucket, optionally filtered by prefix (folder-like path).
Inputs: bucket (required), prefix, delimiter, pageToken.
Uploads a local file to a bucket at the given object path/key.
Inputs: bucket (required), object (required), filePath (required), contentType.
Commits an edit, making all changes made within it (new bundle, track updates, listing changes, ...) live on Google Play. This is the point of no return for a release.
Inputs: editId (required), packageName (required), changesNotSentForReview.
Starts a new edit transaction for a Play Console app. Required before uploading a new bundle/APK or changing tracks, listings, or details. Returns an editId to pass to the other play_* tools, and must be finished with play_commit_edit (or discarded with play_delete_edit).
Inputs: packageName (required).
Creates a new managed in-app product (one-time purchase).
Inputs: sku (required), packageName (required), defaultPrice (required), defaultTitle (required), +4 more.
Deletes every image in a given image slot for a language (e.g. clear all phoneScreenshots).
Inputs: editId (required), language (required), imageType (required), packageName (required).
Discards an in-progress edit without applying any of its changes.
Inputs: editId (required), packageName (required).
Deletes a single uploaded image by its imageId (from play_list_images).
Inputs: editId (required), imageId (required), language (required), imageType (required), +1 more.
Deletes an in-app product by SKU.
Inputs: sku (required), packageName (required).
Removes the store listing for one localized language entirely.
Inputs: editId (required), language (required), packageName (required).
Fetches app-wide details: default language and developer contact info (email, phone, website).
Inputs: editId (required), packageName (required).
Fetches the status of an existing edit (e.g. to check it hasn't expired).
Inputs: editId (required), packageName (required).
Fetches one in-app product by SKU.
Inputs: sku (required), packageName (required).
Fetches the store listing (title, short/full description, video URL) for one language.
Inputs: editId (required), language (required), packageName (required).
Fetches one review by id.
Inputs: reviewId (required), packageName (required), translationLanguage.
Fetches one subscription product by product id.
Inputs: productId (required), packageName (required).
Fetches the tester list (individual emails, and/or Google Groups) configured for a testing track.
Inputs: track (required), editId (required), packageName (required).
Fetches the current releases on a single track (e.g. "production").
Inputs: track (required), editId (required), packageName (required).
Lists all APKs present in an edit.
Inputs: editId (required), packageName (required).
Lists all App Bundles present in an edit, with their versionCode and sha256.
Inputs: editId (required), packageName (required).
Lists uploaded images of a given type (screenshots, icon, feature graphic, ...) for a language.
Inputs: editId (required), language (required), imageType (required), packageName (required).
Lists all managed in-app products (non-subscription) for an app.
Inputs: packageName (required), token.
Lists the store listing (title, descriptions, ...) for every localized language.
Inputs: editId (required), packageName (required).
Lists user reviews for an app, optionally filtered and paginated.
Inputs: packageName (required), token, maxResults, startIndex, +1 more.
Lists all subscription products for an app (Play Subscriptions API v2).
Inputs: packageName (required), pageToken.
Lists all release tracks (internal, alpha, beta, production, and any custom tracks) for an app within an edit, including which versionCodes are on each and their rollout status.
Inputs: editId (required), packageName (required).
High-level helper for the common 'ship this build' workflow: creates an edit, sets the given track's release to exactly the given versionCode(s) with the given status/rollout, and commits. Use this instead of manually chaining play_create_edit + play_update_track + play_commit_edit unless you need finer control (e.g. multiple simultaneous releases on a track, or editing other things in the same edit first).
Inputs: track (required), packageName (required), versionCodes (required), status, +3 more.
Removes one versionCode from a track's active releases (e.g. to pull a bad build off production) by fetching the track, filtering it out, and committing. Note this only unpublishes the version from that track — it does not delete the uploaded artifact itself (Google Play does not support deleting uploaded bundles/APKs).
Inputs: track (required), packageName (required), versionCode (required).
Posts (or updates) the developer reply to a user review. There can only be one developer reply per review — calling this again replaces the previous reply.
Inputs: reviewId (required), replyText (required), packageName (required).
Updates app-wide default language and/or developer contact info.
Inputs: editId (required), packageName (required), contactEmail, contactPhone, +2 more.
Updates an existing in-app product's status/price/listing. Pass allowMissing:true to upsert (create if it doesn't exist yet).
Inputs: sku (required), packageName (required), status, allowMissing, +4 more.
Updates the store listing text for one language (title, short description, full description, promo video). Only provided fields are sent; omit a field to leave it server-side unless the underlying API requires full replacement (it does — fetch with play_get_listing first if you need to preserve untouched fields).
Inputs: editId (required), language (required), packageName (required), title, +3 more.
Replaces the full tester list for a track. Provide googleGroups (Google Group email addresses) and/or googleGroups-managed testers per the Play API — most projects manage testers via a Google Group, so pass that group's email in googleGroups.
Inputs: track (required), editId (required), packageName (required), googleGroups.
Replaces the full set of releases on a track. This is how you publish a new version to a track, change rollout percentage, halt a rollout, or remove a version (by omitting its versionCode from the releases array). Must be followed by play_commit_edit to go live. For a simple 'add this new version to this track' use play_release_to_track instead.
Inputs: track (required), editId (required), releases (required), packageName (required).
Uploads a new APK file into an open edit. Prefer play_upload_bundle (.aab) for new apps — Google Play requires App Bundles for new apps as of Aug 2021 — APK upload remains for existing APK-based apps.
Inputs: editId (required), filePath (required), packageName (required).
Uploads a new Android App Bundle (.aab) file into an open edit. Provide a local file path. After uploading, assign the returned versionCode to a track with play_update_track and then play_commit_edit to publish it.
Inputs: editId (required), filePath (required), packageName (required), ackBundleInstallationWarning.
Uploads a ProGuard/R8 mapping file (or native debug symbols) for a given APK/bundle versionCode, so Play Console can de-obfuscate crash stack traces.
Inputs: editId (required), filePath (required), packageName (required), apkVersionCode (required), +1 more.
Uploads one image (PNG/JPEG) into a store listing image slot for a language.
Inputs: editId (required), filePath (required), language (required), imageType (required), +1 more.
Validates an edit without committing it — checks e.g. that uploaded bundles and track changes are consistent. Useful to sanity-check a release before play_commit_edit.
Inputs: editId (required), packageName (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 95 tools
Tools are generally distinguishable by resource and action, but there are multiple high-level helpers (gcp_add_project_iam_binding vs gcp_set_project_iam_policy, play_update_track vs play_release_to_track vs play_remove_version_from_track) with overlapping intent that could confuse an agent about which to use. The descriptions do provide guidance, but the overlaps remain significant.
Most tool names follow a consistent gcp_/firebase_/gcs_/ar_/play_ prefix and verb_noun pattern, which is good. However, play_ tools use verbs like 'commit', 'validate', 'release', 'reply' that break the strict verb_noun convention, and firebase_appdistribution_* has very long multi-word names, creating mixed readability.
95 tools is extremely heavy for a single MCP server, spanning GCP, Firebase, GCS, Artifact Registry, and Play Console. This likely overwhelms an agent's selection process and indicates the server conflates multiple distinct domains into one surface.
Coverage across the stated domains is broad: GCP projects/APIs/IAM/service accounts, Firebase apps and App Distribution, GCS buckets/objects, Artifact Registry repos, and Play Console releases/listings/testers/products. Minor gaps exist (e.g., no gcp_list_orgs or firebase_delete_app), but core CRUD and lifecycle operations are well represented.
Ship a new Android app from chat. AI runs Google Play Console listings, screenshots, releases, uplo…
Manage App Store and Google Play apps: listings, screenshots, builds, releases, reviews, metrics.
App Store and Google Play reviews, ratings, sentiment and developer replies as agent tools.
Read and edit GA4, Search Console and Google Tag Manager from any MCP client. 29 tools.