Cloud Run MCP

Findings (11)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@8.3.2: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@9.0.1: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.8: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@10.5.0: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.7.2: 1 known vulnerability

  GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.6: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.7: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)
• lowLow. Minor, or common in normal tools. Shown for information.
  Contacted these domains while starting up (no manifest to compare against)

  metadata.google.internal, metadata.google.internal.ovd3si0xbhietcln32ozia51rg.yx.internal.cloudapp.net

Network activity

Tools exposed (8)

• list_projects

  Lists available GCP projects

• create_project

  Creates a new GCP project and attempts to attach it to the first available billing account. A project ID can be optionally specified; otherwise it will be automatically generated.

• list_services

  Lists all Cloud Run services in a given project.

• get_service

  Gets details for a specific Cloud Run service.

• get_service_log

  Gets Logs and Error Messages for a specific Cloud Run service.

• deploy_local_folder

  Deploy a local folder to Cloud Run. Takes an absolute folder path from the local filesystem that will be deployed. Use this tool if the entire folder content needs to be deployed.

• deploy_file_contents

  Deploy files to Cloud Run by providing their contents directly. Takes an array of file objects containing filename and content. Use this tool if the files only exist in the current chat context.

• deploy_container_image

  Deploys a container image to Cloud Run. Use this tool if the user provides a container image URL.