From 1f8ee6d03f7f1b191f35993cf04fbbb6c5822fad Mon Sep 17 00:00:00 2001 From: djiang-jq Date: Wed, 21 Oct 2026 14:56:23 -0700 Subject: [PATCH] feat(google-cloud-bigquery): require user-supplied OAuth client ID and secret Co-authored-by: Cursor --- .../.cursor-plugin/plugin.json | 24 ++++++++++++++++- .../google-cloud-bigquery/CHANGELOG.md | 5 ++++ third_party/google-cloud-bigquery/README.md | 26 ++++++++++++++++--- third_party/google-cloud-bigquery/mcp.json | 7 ++++- 4 files changed, 56 insertions(+), 6 deletions(-) diff --git a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json index 37ffa2837..2da013f51 100644 --- a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json +++ b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "google-cloud-bigquery", "displayName": "Google Cloud BigQuery", - "version": "1.0.0", + "version": "1.1.0", "minClientVersions": { "cursor": "3.13.0" }, @@ -32,5 +32,27 @@ "sql", "mcp" ], + "variables": { + "type": "object", + "additionalProperties": false, + "properties": { + "CLIENT_ID": { + "type": "string", + "title": "OAuth Client ID", + "description": "Client ID of a Web application OAuth client in your Google Cloud project (APIs & Services → Credentials)." + }, + "CLIENT_SECRET": { + "type": "string", + "title": "OAuth Client Secret", + "description": "Client secret from the same Google Cloud OAuth client.", + "writeOnly": true, + "format": "password" + } + }, + "required": [ + "CLIENT_ID", + "CLIENT_SECRET" + ] + }, "mcpServers": "./mcp.json" } diff --git a/third_party/google-cloud-bigquery/CHANGELOG.md b/third_party/google-cloud-bigquery/CHANGELOG.md index 1789565cd..edbc80eb9 100644 --- a/third_party/google-cloud-bigquery/CHANGELOG.md +++ b/third_party/google-cloud-bigquery/CHANGELOG.md @@ -2,6 +2,11 @@ All notable changes to this plugin will be documented here. +## 1.1.0 — bring your own OAuth client + +- Added required `CLIENT_ID` and `CLIENT_SECRET` plugin variables, because Google's OAuth server has no dynamic client registration. Users create a Web application OAuth client in their Google Cloud project and enter its credentials. +- Requests the `https://www.googleapis.com/auth/bigquery` scope, which the server advertises in its protected resource metadata. + ## 1.0.0 — initial release - Added the `google-cloud-bigquery` MCP server pointing at Google Cloud BigQuery's hosted Streamable HTTP endpoint (`https://bigquery.googleapis.com/mcp`). diff --git a/third_party/google-cloud-bigquery/README.md b/third_party/google-cloud-bigquery/README.md index bedfbfe19..822e1b09e 100644 --- a/third_party/google-cloud-bigquery/README.md +++ b/third_party/google-cloud-bigquery/README.md @@ -8,7 +8,7 @@ Explore datasets and tables and run SQL queries. 1. Open **Cursor Settings → Plugins**. 2. Search for **Google Cloud BigQuery**. -3. Click **Install**, then complete the Google Cloud BigQuery sign-in prompt. +3. Click **Install**, then set the OAuth Client ID and Client Secret (below) and complete the Google sign-in prompt. Or run `/add-plugin google-cloud-bigquery` in chat. @@ -19,18 +19,36 @@ Or run `/add-plugin google-cloud-bigquery` in chat. "mcpServers": { "google-cloud-bigquery": { "type": "http", - "url": "https://bigquery.googleapis.com/mcp" + "url": "https://bigquery.googleapis.com/mcp", + "auth": { + "CLIENT_ID": "${CLIENT_ID}", + "CLIENT_SECRET": "${CLIENT_SECRET}", + "scopes": ["https://www.googleapis.com/auth/bigquery"] + } } } } ``` -Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects — there is no client ID or personal access token to configure. - ## Before you connect You need a Google Cloud project with the BigQuery API enabled, and your Google account needs the MCP Tool User role (`roles/mcp.toolUser`) plus BigQuery Job User and Data Viewer on that project. +## Setup + +Google's OAuth server does not support Dynamic Client Registration, so you have to bring your own OAuth client. + +1. In the Google Cloud console, open **APIs & Services → OAuth consent screen** and configure it if the project doesn't have one yet. Add the `https://www.googleapis.com/auth/bigquery` scope. +2. Open [**APIs & Services → Credentials**](https://console.cloud.google.com/apis/credentials), click **Create credentials → OAuth client ID**, and choose **Web application**. +3. Add both authorized redirect URIs: + - Desktop: `http://localhost:8787/callback` + - Web and Cloud Agents: `https://www.cursor.com/agents/mcp/oauth/callback` +4. Copy the **Client ID** and **Client secret**. +5. In **Dashboard → Plugins → Configure**, set **OAuth Client ID** and **OAuth Client Secret** from that client. +6. Complete the Google OAuth login when Cursor prompts. + +On a team marketplace an admin can set the credentials once for everyone; each member still completes their own Google login, so queries run with that member's IAM permissions. If the consent screen is in **Testing**, only listed test users can sign in. + ## What agents can do | Category | Capabilities | diff --git a/third_party/google-cloud-bigquery/mcp.json b/third_party/google-cloud-bigquery/mcp.json index 4068482cc..13f3642de 100644 --- a/third_party/google-cloud-bigquery/mcp.json +++ b/third_party/google-cloud-bigquery/mcp.json @@ -2,7 +2,12 @@ "mcpServers": { "google-cloud-bigquery": { "type": "http", - "url": "https://bigquery.googleapis.com/mcp" + "url": "https://bigquery.googleapis.com/mcp", + "auth": { + "CLIENT_ID": "${CLIENT_ID}", + "CLIENT_SECRET": "${CLIENT_SECRET}", + "scopes": ["https://www.googleapis.com/auth/bigquery"] + } } } }