feat(google-cloud-bigquery): require user-supplied OAuth client ID and secret

third_party/google-cloud-bigquery/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "google-cloud-bigquery",
   "displayName": "Google Cloud BigQuery",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "minClientVersions": {
     "cursor": "3.13.0"
   },
@@ -32,5 +32,27 @@
     "sql",
     "mcp"
   ],
+  "variables": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "CLIENT_ID": {
+        "type": "string",
+        "title": "OAuth Client ID",
+        "description": "Client ID of a Web application OAuth client in your Google Cloud project (APIs & Services → Credentials)."
+      },
+      "CLIENT_SECRET": {
+        "type": "string",
+        "title": "OAuth Client Secret",
+        "description": "Client secret from the same Google Cloud OAuth client.",
+        "writeOnly": true,
+        "format": "password"
+      }
+    },
+    "required": [
+      "CLIENT_ID",
+      "CLIENT_SECRET"
+    ]
+  },
   "mcpServers": "./mcp.json"
 }

third_party/google-cloud-bigquery/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to this plugin will be documented here.
 
+## 1.1.0 — bring your own OAuth client
+
+- Added required `CLIENT_ID` and `CLIENT_SECRET` plugin variables, because Google's OAuth server has no dynamic client registration. Users create a Web application OAuth client in their Google Cloud project and enter its credentials.
+- Requests the `https://www.googleapis.com/auth/bigquery` scope, which the server advertises in its protected resource metadata.
+
 ## 1.0.0 — initial release
 
 - Added the `google-cloud-bigquery` MCP server pointing at Google Cloud BigQuery's hosted Streamable HTTP endpoint (`https://bigquery.googleapis.com/mcp`).

third_party/google-cloud-bigquery/README.md

@@ -8,7 +8,7 @@ Explore datasets and tables and run SQL queries.
 
 1. Open **Cursor Settings → Plugins**.
 2. Search for **Google Cloud BigQuery**.
-3. Click **Install**, then complete the Google Cloud BigQuery sign-in prompt.
+3. Click **Install**, then set the OAuth Client ID and Client Secret (below) and complete the Google sign-in prompt.
 
 Or run `/add-plugin google-cloud-bigquery` in chat.
 
@@ -19,18 +19,36 @@ Or run `/add-plugin google-cloud-bigquery` in chat.
   "mcpServers": {
     "google-cloud-bigquery": {
       "type": "http",
-      "url": "https://bigquery.googleapis.com/mcp"
+      "url": "https://bigquery.googleapis.com/mcp",
+      "auth": {
+        "CLIENT_ID": "${CLIENT_ID}",
+        "CLIENT_SECRET": "${CLIENT_SECRET}",
+        "scopes": ["https://www.googleapis.com/auth/bigquery"]
+      }
     }
   }
 }
 ```
 
-Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects — there is no client ID or personal access token to configure.
-
 ## Before you connect
 
 You need a Google Cloud project with the BigQuery API enabled, and your Google account needs the MCP Tool User role (`roles/mcp.toolUser`) plus BigQuery Job User and Data Viewer on that project.
 
+## Setup
+
+Google's OAuth server does not support Dynamic Client Registration, so you have to bring your own OAuth client.
+
+1. In the Google Cloud console, open **APIs & Services → OAuth consent screen** and configure it if the project doesn't have one yet. Add the `https://www.googleapis.com/auth/bigquery` scope.
+2. Open [**APIs & Services → Credentials**](https://console.cloud.google.com/apis/credentials), click **Create credentials → OAuth client ID**, and choose **Web application**.
+3. Add both authorized redirect URIs:
+   - Desktop: `http://localhost:8787/callback`
+   - Web and Cloud Agents: `https://www.cursor.com/agents/mcp/oauth/callback`
+4. Copy the **Client ID** and **Client secret**.
+5. In **Dashboard → Plugins → Configure**, set **OAuth Client ID** and **OAuth Client Secret** from that client.
+6. Complete the Google OAuth login when Cursor prompts.
+
+On a team marketplace an admin can set the credentials once for everyone; each member still completes their own Google login, so queries run with that member's IAM permissions. If the consent screen is in **Testing**, only listed test users can sign in.
+
 ## What agents can do
 
 | Category | Capabilities |

third_party/google-cloud-bigquery/mcp.json

@@ -2,7 +2,12 @@
   "mcpServers": {
     "google-cloud-bigquery": {
       "type": "http",
-      "url": "https://bigquery.googleapis.com/mcp"
+      "url": "https://bigquery.googleapis.com/mcp",
+      "auth": {
+        "CLIENT_ID": "${CLIENT_ID}",
+        "CLIENT_SECRET": "${CLIENT_SECRET}",
+        "scopes": ["https://www.googleapis.com/auth/bigquery"]
+      }
     }
   }
 }