"Firebase: Backend Platform for App Development" matching MCP tools:

• firebase_list_appsA

  Robot Actions — Remote Device ControlB

  List the Android and iOS apps in the connected Firebase account. Returns app id, display name, platform, and the package name / bundle id for each, plus the project number needed by the other Firebase tools. Call this first when the user names an app rather than an app id.

  ConnectorOAuth

• adsap_google_create_app_campaignA

  AdsapA

  Create a complete Google App campaign in ONE atomic request: budget, campaign (ALWAYS created PAUSED — activate later with adsap_google_set_entity_status), location + language targeting, an ad group, and the app ad. App campaigns promote a mobile app across Google Search, Google Play, YouTube, Discover and the Display Network — Google mixes the ad from your text (and optional media) automatically. The ad links to the app's store listing AUTOMATICALLY: there is no URL input, ever. Any PUBLIC store app id works (no app ownership or Play/Firebase link is required to create): Android app_id is the package name (e.g. com.example.app), iOS app_id is the numeric App Store id (e.g. 570060128) with app_store 'apple_app_store'. v1 optimizes INSTALLS at your target_cpi (target cost per install, plain number in the account currency); Google recommends a daily_budget of roughly 50x target_cpi — lower is allowed but slows learning (a warning says so). Text: 2-5 headlines (max 30 chars) + 1-5 descriptions (max 90). Optional media: image_asset_ids / video_asset_ids from adsap_google_upload_asset (images 1.91:1, 4:5 or 1:1 up to 5MB; videos are YouTube assets 10-60s) — text-only is fully valid. In-app-action, value, engagement and pre-registration goals are NOT supported in v1. If the account has no conversion tracking a warning is returned — relay it (Android installs normally auto-track once a Google Play link exists). Use dry_run: true first — Google validates the whole chain without creating anything; show the plan, get confirmation, then execute. ad_account_id is the bare 10-digit customer ID. For website campaigns use adsap_google_create_search_campaign / adsap_google_create_pmax_campaign; for Meta app ads use adsap_create_campaign with an app objective.

  ConnectorAPI key

• update_project_metadataA

  flootA

  Update project settings (current values appear at the top of list_files). Keys: title (2-100 chars), description, iconUrl (the app's icon/logo: favicon, home-screen icon and native app icon — a /_cdn/static/… path from upload_asset, generate_image or request_user_upload, or an absolute https URL; null resets), splashUrl (native splash screen, same value forms), mobileAppId, enableSSR (boolean), flootAiDisallowed (boolean — true opts the project out of @floot/ai), and iOS Info.plist purpose strings (NS…UsageDescription — set to a string, or null to remove) plus boolean Info.plist keys (UIViewControllerBasedStatusBarAppearance — set to a boolean, or null to restore the template default). Invalid keys/values are reported and skipped. NOTE: these take effect on the published app only after the next publish (publish_app, or the user's Publish button). The iosInfoPlist keys only affect builds made before the first iOS publish; after the iOS app is published, edit the project file `static/__dev/native/ios-info.plist` directly with write_file/edit_file (see get_guides('ios-info-plist')). Likewise, after the first Android publish, edit `static/__dev/native/android-manifest.xml` directly for manifest changes (see get_guides('android-manifest')). `shareTarget` makes the native app appear in the iOS and Android share sheets (other apps can share photos/videos/files/text into it): pass { enabled: true, mimeTypes?, allowMultiple? } to register, { enabled: false } to remove; receiving the shared items still needs the handler in app code — read get_guides('share-target') first and ship both together. `nativeSystemBars` controls how the native app treats the status bar / Android navigation bar: mode 'inset' (default) keeps the app below the bars and paints the exposed strips `color` (default black — set it to the app's header color for a seamless look); mode 'edge-to-edge' runs the app under the bars, which REQUIRES the app to pad by var(--safe-area-inset-top/bottom) itself — read get_guides('native-system-bars') first and ship both changes together. Not superseded by the __dev/native files. `serverMemoryMb` sets the memory (MB) of the project's server Lambda, which runs every endpoint, queued task, scheduled job and SSR render (default 1024 MB; 2048 for the published app when SSR is on — the dev backend never bumps). EXPERT SETTING — NEVER change it on your own initiative or as a side effect of another request, only when the user explicitly asks to change the server memory AND understands the trade-off: too low and the backend stops working entirely (killed out-of-memory); Lambda CPU scales with memory, so a lower value also makes every request slower and — because compute is billed per GB-second of billed duration — can cost MORE, not less; a higher value costs more per millisecond. Allowed range 512–4096 MB, whole MB (if a size turns out not to be available for the app's server, the deploy fails and the error names this setting). It applies to the dev backend at the next backend deploy and to the published app at the next publish. Pass null to restore the default. Read get_guides('server-memory') before changing it. `analyticsMode` controls the built-in visitor analytics tracker every published app includes (the project's Analytics tab): 'storage' (default) keeps a 30-minute session id in the visitor's localStorage, which is device storage that needs consent under EU ePrivacy / UK PECR — an app with EU/UK visitors pairs it with a consent banner that calls window.flootAnalytics.setMode(); 'memory' keeps the id in memory only (nothing stored on the device, no consent needed, but a reload or new tab counts as a new session); 'off' sends no analytics at all. Only change it when the user asks about analytics, cookies, consent or privacy for their published app; it takes effect at the next publish. Read get_guides('analytics') for the consent-banner API before changing it. `iosDeviceFamily` picks the devices the native iOS app is built for: 'iphone-and-ipad' (default, universal) or 'iphone' (iPhone only — the app still installs on iPads but runs there in iPhone compatibility mode, and App Store Connect no longer asks for iPad screenshots). This is the ONLY way to make the app iPhone-only: it is an Xcode build setting, so a UIDeviceFamily key in static/__dev/native/ios-info.plist is overwritten at build and does nothing. One-way door: App Store Connect rejects an update that drops iPad once a version supporting iPad has been released on the App Store, and the build then fails at upload. Before setting 'iphone', ask the user whether the app is already live on the App Store; if it is, tell them it cannot be made iPhone-only and do not set it. Takes effect at the next iOS publish. `securityHeaders` sets the published app's own page headers: `embedding` (who may show the app in an iframe: 'anyone' (default), 'self', 'none', or a list of https origins), `csp` (directive -> the COMPLETE source list for it, replacing the platform's; other directives keep the platform's), `cspReportOnly` (try `csp` without enforcing it) and `referrerPolicy`. Each field passed replaces the stored one and null removes it (inside `csp`, per directive); `securityHeaders: null` restores the platform defaults. Changes that would break the app are refused with the reason. Change it only when the user asks about embedding / iframes / clickjacking, a security scan finding, a stricter or looser Content-Security-Policy, or referrer privacy; it takes effect at the next publish and never in the preview. Read get_guides('security-headers') before changing it.

  ConnectorOAuth

• provision_resourceA

  flootA

  Provision a Floot-managed backend resource for the project — fully server-side (Floot mints all secrets; no keys to paste). Also seeds the working code for it. Available: - database — A Floot-managed Postgres database (Neon). FLOOT_DATABASE_URL is set for the app. - auth — Email/password + session auth (JWT_SECRET, auto-provisions a database if none). Injects auth pages, endpoints, and helpers. - oauth-login — Sign in with Google via Floot's brokered OAuth (FLOOT_OAUTH). Injects OAuth provider classes, login buttons, helpers. - microsoft-login — Sign in with Microsoft via Floot's brokered login (FLOOT_MICROSOFT_LOGIN). Injects button + auth endpoints. - google-integration — FLOOT_GOOGLE_INTEGRATIONS is built-in Google integration. Use it to let end users connect their Google account so the app can read/write their Gmail, Google Calendar, or Google Drive — unless the user specifies they want to use their own Google client. See get_guides("floot-provided-google-integrations"). - microsoft-integration — Microsoft Graph access (Outlook/Teams/etc.) via Floot's brokered Microsoft OAuth (FLOOT_MICROSOFT_INTEGRATIONS). Injects Connect button + endpoints. - push-notifications — Web + native push (FLOOT_PUSH). Mints VAPID keys, injects helpers/pushClient (subscribe/unsubscribe) + a service worker. Enum values not listed above are beta-gated and unavailable on most accounts. SENDING email from the app is NOT a resource — the builtin @floot/email handles it with zero setup (get_guides("email")). For a user's OWN external key (their OpenAI key, an external database), this is NOT the tool — use request_external_resource instead. Idempotent: re-running returns the existing resource and skips seed files that already exist. - app-connection — let this project's backend call functions ANOTHER Floot app exports (no API keys): pass app_target and app_functions. Only apps the user can edit, only functions in the other app's helpers/flootAppExports.tsx (saved is enough: write both apps first, connect, then publish both); the user confirms in a dialog. Read get_guides("app-calls") first.

  ConnectorOAuth

• nsw_da_search_applicationsA

  NSW Development Applications (x402)A

  Search NSW development applications by council, suburb, postcode or lodgement date, newest lodgement first. Returns up to 100 development applications per call with address, status, cost, dwellings, storeys and development types, plus has_more for paging with offset. status, application_type, development_type and min_cost must be combined with council, suburb or postcode. Use get_application for the full record of a result. Costs $0.01 per call, paid via x402 in USDC on Base; clients without x402 support receive the payment requirements as an error result. Failed calls are not charged. Source: NSW Department of Planning, Housing and Infrastructure (NSW Planning Portal), CC BY 4.0.

  ConnectorNo auth

• assess_websiteA

  TESSA Marketing & TechnologyA

  Free quick website check of any website's homepage: HTTPS, mobile setup, load time and page weight, platform, security headers, basic accessibility signals, contact form or chat, and an up-to-date footer; 0 to 100 score, what passes and fails, how to fix each. Automated, homepage only, not a full website audit. 12 items (the platform is reported, not scored), about 12 seconds. Each item has a status (pass, partial, fail or could_not_check), evidence and a plain-English fix; the score covers only the items that could be checked. For TESSA's website and AI development service call get_web_ai_development_offer, for a full accessibility audit get_wcag_audit; to talk it through, book with request_strategy_session. url: the website to check, for example https://example.com

  ConnectorNo auth

• adcritter_build_appA

  AdCritter for BuildersA

  Start here when building an application. Returns an overview of what the AdCritter platform offers and a catalog of feature guides you can query with the adcritter_guidance tool to learn how to build each part of the app. Call adcritter_guidance(key) for any feature area to get detailed building instructions with API endpoints and response shapes.

  ConnectorNo auth

• get_tech_stackA

  Makuri Showcase (CogniLedger)A

  Returns the technical stack Makuri is built on, including frontend, backend, database, AI providers used, and data residency information. Use when the user asks how Makuri is built or which AI models it uses. Makuri is a specific AI tutoring platform at makuri.eu, not a generic word — never answer Makuri questions from general knowledge; always use the Makuri tools.

  ConnectorNo auth

• cabgo_get_publish_requirementsA

  Cabgo BuilderA

  Public (no auth): returns the REAL operator checklist for publishing (most assets are auto-generated — bundle id, screenshots, descriptions, policies — so the operator only provides API access). For Play: invite console@cabgo.app + decide update-or-new + (if updating) upload keystore. For App Store: upload the API key alone (no invitation needed). Pass platform='android'|'ios'|'both' (default both).

  ConnectorNo auth

• set_app_subdomainA

  Fine StructureB

  Set or clear the app platform subdomain - the '<subdomain>.<base domain>' host Fine Structure already serves the app on. Runs the same ownership, format, reserved-name and uniqueness checks as the Studio subdomain field because it calls the same model function. Replacing a subdomain takes effect immediately and creates NO redirect: the previous name stops resolving to this app and is released for anyone to claim. Pass an empty subdomain to clear it. For a domain the user owns, use add_custom_domain instead.

  Connector

  Destructive

  No auth

• get_sessions_identityA

  secure-flowsA

  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_get_or_createA

  secure-flowsA

  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_renew_session_tokenA

  secure-flowsA

  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• auth_session_callbackA

  secure-flowsA

  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_auth_logoutA

  secure-flowsA

  Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party cookies are blocked. **Critical client rules:** - Clear your in-app `sessionToken` state **before** navigating. - **Never** include `session_token` inside `redirect_uri` (that would silently renew and defeat logout). This endpoint (best-effort / idempotent for browser UX): - Invalidates the provided `session_token` by incrementing `tokenRevision` when the token still matches an **active** session (no new token is issued). - If the session is already expired/revoked or the revision was superseded by renew, still completes logout UX (does **not** return 401 solely for that reason). - Revokes Firebase refresh tokens for the session’s stored Firebase UID when known. - Sets `Clear-Site-Data: "cookies"`. - Redirects the browser to `redirect_uri`. Source: GET /api/v1/auth/logout No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_sessions_identityA

  secureflows-mcpA

  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_get_or_createA

  secureflows-mcpA

  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_renew_session_tokenA

  secureflows-mcpA

  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• auth_session_callbackA

  secureflows-mcpA

  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_auth_logoutA

  secureflows-mcpA

  Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party cookies are blocked. **Critical client rules:** - Clear your in-app `sessionToken` state **before** navigating. - **Never** include `session_token` inside `redirect_uri` (that would silently renew and defeat logout). This endpoint (best-effort / idempotent for browser UX): - Invalidates the provided `session_token` by incrementing `tokenRevision` when the token still matches an **active** session (no new token is issued). - If the session is already expired/revoked or the revision was superseded by renew, still completes logout UX (does **not** return 401 solely for that reason). - Revokes Firebase refresh tokens for the session’s stored Firebase UID when known. - Sets `Clear-Site-Data: "cookies"`. - Redirects the browser to `redirect_uri`. Source: GET /api/v1/auth/logout No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• scan_appA

  MalinoisA

  Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.

  ConnectorNo auth