Firebase MCP

Connect AI agents to Firebase. Keep control.

Your projects. Your permissions. Your approval.

Chiselbase is a desktop app with a Firebase MCP server. Give Claude Code, Cursor and other MCP clients scoped access per connection. Writes outside development wait for your approval.

Download for Windows Compare Free and Pro

Keep Google credentials in the Rust core.

Connect your agent with a dedicated client token while Chiselbase handles Firebase authentication. In Chiselbase, your Google credentials never reach the interface or an agent. Agents and the proxy only see a client token and tool results.

Your agent

Claude Code, Cursor or another MCP client starts the proxy over stdio.
Proxy

Passes requests on. Holds no Google credentials, only the client token.
Loopback

127.0.0.1, port 48620 by default, with a token.
Chiselbase

The Rust process checks grant, write protection and approval. It holds your Google credentials.
Firebase

Called by the Rust process, never by the agent.

Choose what each agent can access.

Each agent client gets its own registration, and Read and Write are separate grants per connection. Start with read access on a development project, then grant additional rights when you need them. A new client has no project access until you choose it.

Revoke a client, switch off agent access or disable individual tools whenever you need to.

Dialog titled “What may Claude Desktop see?”. It says that without a grant the tool sees nothing at all, and asks you to decide per project whether it may read and whether it may write. Five connections, each with a Read and a Write checkbox: Fernway Development, Fernway Staging and Fernway Production have both checked, Fernway Analytics and the emulator demo-fernway have neither. Under Staging and Production: “Here every write waits for your confirmation.” Under Development, an unchecked option “Ask before every write”. Buttons: Cancel and Save rights. — Claude Desktop may read and write three of five connections. On staging and production, every write waits for your confirmation. In development, “Ask before every write” is your choice.

Four checks before an agent writes.

An agent that writes on its own is handy in development. On production, you want to see the change first.

Panel titled “An agent wants to write in Fernway Production”, with the project ID fernway-prod and the countdown Expires in 2:38. A highlighted box says it writes 2 documents in one step, 2 to change, all or nothing: if one operation fails, none of them runs. Under To be changed (2): orders/ord_10388 with 2 fields and a customers document with 2 fields. Below, a fold Show full arguments for firestore_write. Buttons: Deny and Allow overwrite. — An agent wants to write. Two updates in one commit on Fernway Production. No answer within 180 s counts as Deny.

Write grant

The client needs Write on this connection.
No write protection

Write protection blocks agents too. New production connections start write-protected.
Your approval

Outside Development, every write waits for Allow or Deny. After 180 s without an answer, it’s denied. In Development you can switch approval off.
Confirmation

Your Allow click is the confirmation, redeemed as a one-time token.

Follow agent activity back to its source.

Agent writes are logged as mcp:<client>. You (ui) and the built-in chat (chat) have actors of their own. The app attempts to record agent activity and its result after each write. Recording failures do not block the write. Choose a local data policy that keeps audit entries; the none policy disables logging.

Chiselbase AI agent page. At the top: Access on, this computer only (127.0.0.1:48620), with a Turn access off button. Under Tools, two clients, each with Rights, Commands and Revoke access: Claude Desktop may read and write on Fernway Development without asking, and read and write on Fernway Staging and Fernway Production. Cursor may only read, on all three. The chronicle, set to Everything, lists a Firestore change by Claude Desktop in Fernway Production with firestore_write, two reads by Claude Desktop, a delete attempt by Cursor in Fernway Production marked refused with the note “no write grant for this project”, and two reads by Cursor. Below that, a failed attempt by Claude Desktop to change Firestore in Fernway Production, then more reads, the last one cut off. — Claude Desktop and Cursor, request by request. Cursor may only read, so its delete in production was refused: no write grant.

82 tools, 38 of them write.

Reading tools need a Read grant. Writing tools go through the four checks above. Three tools are always on.

Always on

list_connections
job_status
job_cancel

Tool family	Tools	Writing
Firestore data	9	4
Firestore queries	5	1
Firestore indexes	5	3
Firestore backups	9	6
Import, export, migration	7	6
Realtime Database	5	3
Authentication	6	3
Storage	10	5
Rules	4	1
Cloud Functions	3	0
Boards	6	3
Audit log and undo	3	1
Connections	4	0
All tools	82	38

The total includes 6 Remote Config tools, 2 of them writing.

12 clients. The app builds your config snippet.

Pick your client in the app, and Chiselbase builds the snippet in that client’s format. The proxy path and the client token are already filled in.

Claude Code
Claude Desktop
Cursor
Windsurf
VS Code
Cline
Continue
Gemini CLI
Codex
Zed
JetBrains
Generic

Google’s Firebase MCP server, for reference.

Google ships its own MCP server for Firebase, and it works differently. The difference is where the rules sit. In Chiselbase, grants per connection, approval and the audit log sit between the agent and your project.

It runs locally with npx -y firebase-tools@latest mcp.
It uses the same credentials as your Firebase CLI login.
Its tools read, write and delete data, for example firestore_query_collection and firestore_delete_document.
The documentation describes no read-only mode. Approval prompts come from the agent client, not from the server.
Google also offers a remote Firestore MCP endpoint, with access controlled by IAM.

From Google’s documentation, last updated 2026-09-24. Checked on 2026-09-30.

Work with AI directly in your Firebase workspace.

The built-in chat supports the Anthropic protocol or any OpenAI-compatible endpoint with your own base URL. Your API key is stored in the OS keystore. The chat’s writes appear in the audit log as chat.

Try it on a development connection.

Connect your preferred AI client and choose which projects it can access. The 14-day trial starts inside the app, with an email code and no card.

Download for Windows Compare Free and Pro

Windows · x64 or ARM64 · Installer (.exe)