Firebase MCP Server: Tools, Setup and Security

The Firebase MCP server lets AI coding tools work with your Firebase projects. It can read and write Firestore documents, look up Auth users, read Crashlytics issues, update Remote Config and deploy your project. Google ships it as part of the Firebase CLI, and it runs locally on your machine.

Checked against: Firebase MCP server docs on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The docs group tools by Firebase product. Highlights:

• core (always on): firebase_login, firebase_logout, firebase_list_projects, firebase_get_project, firebase_create_project, firebase_create_app, firebase_get_sdk_config, firebase_init, firebase_get_security_rules, firebase_validate_security_rules, firebase_deploy, firebase_deploy_status and more.
• firestore: firestore_get_document, firestore_add_document, firestore_update_document, firestore_delete_document, firestore_list_collections, firestore_query_collection, firestore_run_aggregation_query, plus database, index and backup schedule tools such as firestore_delete_database.
• auth: auth_get_users, auth_update_user, auth_set_sms_region_policy.
• realtimedatabase: realtimedatabase_get_data, realtimedatabase_set_data.
• dataconnect: dataconnect_build, dataconnect_list_services, dataconnect_execute.
• crashlytics: crashlytics_get_issue, crashlytics_list_events, crashlytics_get_report, crashlytics_update_issue and note tools.
• remoteconfig: remoteconfig_get_template, remoteconfig_update_template.
• messaging: messaging_send_message.
• storage: storage_get_object_download_url.
• functions and apphosting: log and list tools.
• developerknowledge: documentation search tools.

How to connect it

The docs give one stdio config for Claude Desktop, Cursor, Windsurf (now Devin Desktop), Cline, Antigravity and others:

{
  "mcpServers": {
    "firebase-mcp-server": {
      "command": "npx",
      "args": ["-y", "firebase-tools@latest", "mcp"]
    }
  }
}

In Claude Code you can run:

claude mcp add firebase npx -- -y firebase-tools@latest mcp

Or install the plugin with claude plugin install firebase@firebase.

Two optional flags help. --dir ABSOLUTE_DIR_PATH sets the project folder. --only FEATURE_1,FEATURE_2 loads only the feature groups you name, for example --only firestore,crashlytics.

The server signs in the same way the Firebase CLI does. If you are already logged in to the CLI, it uses that account. The firebase_login and firebase_logout tools manage this from the AI app.

Security notes

Firebase's page does not label tools as destructive and has no separate security section. It says the tools work "with your approval," and that some tools pass requests to remote Firebase services. So your client's approval prompts are the main safety check.

Read the tool names before you approve. These can change or delete data, send messages or ship code:

Ways to reduce risk:

• Use --only. Load just the groups a task needs. A debugging session may need only crashlytics.
• Use a dev project. The server acts with your CLI login, which may have broad rights on the project. Point it at a development project first. See excessive permissions.
• Watch user data. auth_get_users can return user account data. Think about who sees the AI's output. Read data exfiltration through MCP.
• Local process. It runs with your user's rights on your machine. See sandboxing local MCP servers.

More in the MCP security hub.

Alternatives

• Supabase MCP Server: a hosted backend server built on Postgres.
• MongoDB MCP Server: document database tools with a --readOnly flag.
• Google BigQuery MCP Server: Google's remote server for analytics data.

More profiles are in the MCP server directory.

Next step

Start with --only set to one feature group and a development project. Add write-heavy groups later. If you need help planning AI access to a Firebase app, our MCP development team can help.

Frequently asked questions