fix(mcp): Address auth issues with Firebase Studio environment

[mbleigh]

• Removes auth check from list tools call when in Firebase Studio
• Adds timeouts to feature checks and auth generally
• Centralized place to check environment stuff instead of messing with variables
• Creates a special FIREBASE_MCP_DEBUG_LOG variable that when used will log the entire MCP transcript to the specified file.

[gemini-code-assist]

Summary of Changes

Hello @mbleigh, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request primarily focuses on enhancing the stability and debuggability of the Firebase MCP (Model Context Protocol) server, especially within the Firebase Studio environment. It addresses authentication challenges by conditionally skipping auto-auth, improves system resilience by implementing timeouts for critical operations, centralizes environment detection logic, and introduces a powerful new debug logging mechanism for MCP communication.

Highlights

• Authentication Handling for Firebase Studio: The pull request introduces changes to skip the automatic authentication check (requireAuth) for the mcpListTools call when the environment is detected as Firebase Studio. This aims to resolve authentication issues specific to the Firebase Studio environment.
• Robustness with Timeouts: Timeouts have been added to several asynchronous operations to prevent indefinite hanging. This includes getCredentials during auto-authentication (shorter timeout for MCP), detectProjectRoot's readiness check, and checkFeatureActive API checks, improving the overall stability and responsiveness of the system.
• Centralized Environment Detection: A new module (src/env.ts) has been created to centralize environment checks, providing isFirebaseStudio() and isFirebaseMcp() helper functions. This replaces direct process.env.MONOSPACE_ENV checks, making environment detection more consistent and maintainable.
• MCP Debug Logging: A new FIREBASE_MCP_DEBUG_LOG environment variable is introduced. When set, it enables a special LoggingStdioServerTransport that logs the entire Model Context Protocol (MCP) communication transcript (both incoming and outgoing messages) to a specified file, greatly aiding in debugging MCP interactions.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

[mbleigh]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several fixes and improvements for authentication and environment handling, particularly for the Firebase Studio environment. It centralizes environment checks, adds timeouts to network-dependent operations to improve resilience, and introduces a new debug logging mechanism for MCP.

The review identified a few issues, including a critical operator precedence bug that could lead to incorrect client name resolution, and a high-severity issue where a new tool filtering mechanism was not being used. Other medium-severity issues include inefficient caching, another operator precedence bug in a log message, use of synchronous I/O in an async function, and a bug in timeout handling logic. Code suggestions have been provided for all identified issues.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 44.44444% with 15 lines in your changes missing coverage. Please review.

Project coverage is 52.05%. Comparing base (a6188c3) to head (473a5b1).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
src/timeout.ts	22.22%	7 Missing ⚠️
src/requireAuth.ts	44.44%	5 Missing ⚠️
src/env.ts	62.50%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #8871   +/-   ##
=======================================
  Coverage   52.04%   52.05%           
=======================================
  Files         413      416    +3     
  Lines       30609    30641   +32     
  Branches     6333     6340    +7     
=======================================
+ Hits        15931    15949   +18     
- Misses      13247    13261   +14     
  Partials     1431     1431           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[joehan]

We have monospace specific logic in autoAuth that sets the user from the returned access token as the active user (so that it appears like the user is logged in). I'm concerned about the case where these tokens are present but expired - MCP server will tell them to login, but I think firebase login might not work as expected.

I think we probably need to clean up the auth strategy overall ASAP - what you have here is probably still an improvement over the current state tho