From 017da53ffe3e987a4e16a4ebeeca90ed4cde97e8 Mon Sep 17 00:00:00 2001 From: djiang-jq Date: Wed, 21 Oct 2026 16:33:34 -0700 Subject: [PATCH 1/2] google-cloud-bigquery: add optional team OAuth client variables Co-authored-by: Cursor --- .../.cursor-plugin/plugin.json | 21 +++++++++++++++++-- .../google-cloud-bigquery/CHANGELOG.md | 4 ++++ third_party/google-cloud-bigquery/README.md | 17 +++++++++++++-- third_party/google-cloud-bigquery/mcp.json | 6 +++++- 4 files changed, 43 insertions(+), 5 deletions(-) diff --git a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json index 37ffa2837..59a3a8e52 100644 --- a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json +++ b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json @@ -1,9 +1,9 @@ { "name": "google-cloud-bigquery", "displayName": "Google Cloud BigQuery", - "version": "1.0.0", + "version": "1.1.0", "minClientVersions": { - "cursor": "3.13.0" + "cursor": "3.19.0" }, "description": "Explore datasets and tables and run SQL queries.", "author": { @@ -32,5 +32,22 @@ "sql", "mcp" ], + "variables": { + "type": "object", + "additionalProperties": false, + "properties": { + "CLIENT_ID": { + "type": "string", + "title": "Client ID", + "description": "Optional. A Google OAuth client your team created, shared by every member. Leave empty to use Cursor's client." + }, + "CLIENT_SECRET": { + "type": "string", + "title": "Client secret", + "writeOnly": true, + "format": "password" + } + } + }, "mcpServers": "./mcp.json" } diff --git a/third_party/google-cloud-bigquery/CHANGELOG.md b/third_party/google-cloud-bigquery/CHANGELOG.md index 1789565cd..36a350624 100644 --- a/third_party/google-cloud-bigquery/CHANGELOG.md +++ b/third_party/google-cloud-bigquery/CHANGELOG.md @@ -2,6 +2,10 @@ All notable changes to this plugin will be documented here. +## 1.1.0 + +- Added optional `CLIENT_ID` and `CLIENT_SECRET` team variables so a team admin can set one shared Google OAuth client for every member. Leaving them empty keeps signing in with Cursor's client. Requires Cursor 3.19.0 or later. + ## 1.0.0 — initial release - Added the `google-cloud-bigquery` MCP server pointing at Google Cloud BigQuery's hosted Streamable HTTP endpoint (`https://bigquery.googleapis.com/mcp`). diff --git a/third_party/google-cloud-bigquery/README.md b/third_party/google-cloud-bigquery/README.md index bedfbfe19..928bd4c5a 100644 --- a/third_party/google-cloud-bigquery/README.md +++ b/third_party/google-cloud-bigquery/README.md @@ -19,13 +19,26 @@ Or run `/add-plugin google-cloud-bigquery` in chat. "mcpServers": { "google-cloud-bigquery": { "type": "http", - "url": "https://bigquery.googleapis.com/mcp" + "url": "https://bigquery.googleapis.com/mcp", + "auth": { + "CLIENT_ID": "${CLIENT_ID:-}", + "CLIENT_SECRET": "${CLIENT_SECRET:-}" + } } } } ``` -Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects — there is no client ID or personal access token to configure. +Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects. By default it signs in with Cursor's Google OAuth client, so there is nothing to configure. A team can use its own client instead; see below. + +## Use your team's own OAuth client + +A team admin can have every member sign in under one Google OAuth client the team owns, so consent and audit show the team's own app. + +1. In the Google Cloud console, create an OAuth client for a **Web application** and add Cursor's OAuth callback URL as an authorized redirect URI. Add the `https://www.googleapis.com/auth/bigquery` scope to the project's OAuth consent screen. +2. In the Cursor dashboard, open the team's plugin settings for **Google Cloud BigQuery** and enter the **Client ID** and **Client secret**. + +Members then sign in to BigQuery under that client. The secret is stored encrypted and stays on Cursor's backend; it is never sent to members' machines. Leave both fields empty to use Cursor's client. Changing the client signs members out, and they reconnect once. ## Before you connect diff --git a/third_party/google-cloud-bigquery/mcp.json b/third_party/google-cloud-bigquery/mcp.json index 4068482cc..754fa58a1 100644 --- a/third_party/google-cloud-bigquery/mcp.json +++ b/third_party/google-cloud-bigquery/mcp.json @@ -2,7 +2,11 @@ "mcpServers": { "google-cloud-bigquery": { "type": "http", - "url": "https://bigquery.googleapis.com/mcp" + "url": "https://bigquery.googleapis.com/mcp", + "auth": { + "CLIENT_ID": "${CLIENT_ID:-}", + "CLIENT_SECRET": "${CLIENT_SECRET:-}" + } } } } From 23bc01d64cf47489418ba27532d07bc8d41db362 Mon Sep 17 00:00:00 2001 From: djiang-jq Date: Wed, 21 Oct 2026 17:04:05 -0700 Subject: [PATCH 2/2] google-cloud-bigquery: require the team OAuth client variables Co-authored-by: Cursor --- .../google-cloud-bigquery/.cursor-plugin/plugin.json | 6 +++++- third_party/google-cloud-bigquery/CHANGELOG.md | 2 +- third_party/google-cloud-bigquery/README.md | 12 ++++++------ third_party/google-cloud-bigquery/mcp.json | 4 ++-- 4 files changed, 14 insertions(+), 10 deletions(-) diff --git a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json index 59a3a8e52..afae3a1b6 100644 --- a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json +++ b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json @@ -35,11 +35,15 @@ "variables": { "type": "object", "additionalProperties": false, + "required": [ + "CLIENT_ID", + "CLIENT_SECRET" + ], "properties": { "CLIENT_ID": { "type": "string", "title": "Client ID", - "description": "Optional. A Google OAuth client your team created, shared by every member. Leave empty to use Cursor's client." + "description": "A Google OAuth client your team created. Every team member signs in under it." }, "CLIENT_SECRET": { "type": "string", diff --git a/third_party/google-cloud-bigquery/CHANGELOG.md b/third_party/google-cloud-bigquery/CHANGELOG.md index 36a350624..f0d43b050 100644 --- a/third_party/google-cloud-bigquery/CHANGELOG.md +++ b/third_party/google-cloud-bigquery/CHANGELOG.md @@ -4,7 +4,7 @@ All notable changes to this plugin will be documented here. ## 1.1.0 -- Added optional `CLIENT_ID` and `CLIENT_SECRET` team variables so a team admin can set one shared Google OAuth client for every member. Leaving them empty keeps signing in with Cursor's client. Requires Cursor 3.19.0 or later. +- Added required `CLIENT_ID` and `CLIENT_SECRET` team variables. A team admin sets one Google OAuth client that every member signs in under, and the plugin no longer uses Cursor's own client. Existing installs need these set before the next connect. Requires Cursor 3.19.0 or later. ## 1.0.0 — initial release diff --git a/third_party/google-cloud-bigquery/README.md b/third_party/google-cloud-bigquery/README.md index 928bd4c5a..c6102bbbd 100644 --- a/third_party/google-cloud-bigquery/README.md +++ b/third_party/google-cloud-bigquery/README.md @@ -21,24 +21,24 @@ Or run `/add-plugin google-cloud-bigquery` in chat. "type": "http", "url": "https://bigquery.googleapis.com/mcp", "auth": { - "CLIENT_ID": "${CLIENT_ID:-}", - "CLIENT_SECRET": "${CLIENT_SECRET:-}" + "CLIENT_ID": "${CLIENT_ID}", + "CLIENT_SECRET": "${CLIENT_SECRET}" } } } } ``` -Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects. By default it signs in with Cursor's Google OAuth client, so there is nothing to configure. A team can use its own client instead; see below. +Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects. It signs in with a Google OAuth client your team provides; see below. -## Use your team's own OAuth client +## Set up your team's OAuth client -A team admin can have every member sign in under one Google OAuth client the team owns, so consent and audit show the team's own app. +A team admin provides one Google OAuth client, and every member signs in under it, so consent and audit show the team's own app. The Client ID and Client secret are required. 1. In the Google Cloud console, create an OAuth client for a **Web application** and add Cursor's OAuth callback URL as an authorized redirect URI. Add the `https://www.googleapis.com/auth/bigquery` scope to the project's OAuth consent screen. 2. In the Cursor dashboard, open the team's plugin settings for **Google Cloud BigQuery** and enter the **Client ID** and **Client secret**. -Members then sign in to BigQuery under that client. The secret is stored encrypted and stays on Cursor's backend; it is never sent to members' machines. Leave both fields empty to use Cursor's client. Changing the client signs members out, and they reconnect once. +Members then sign in to BigQuery under that client. The secret is stored encrypted and stays on Cursor's backend; it is never sent to members' machines. Changing the client signs members out, and they reconnect once. ## Before you connect diff --git a/third_party/google-cloud-bigquery/mcp.json b/third_party/google-cloud-bigquery/mcp.json index 754fa58a1..72e3884a0 100644 --- a/third_party/google-cloud-bigquery/mcp.json +++ b/third_party/google-cloud-bigquery/mcp.json @@ -4,8 +4,8 @@ "type": "http", "url": "https://bigquery.googleapis.com/mcp", "auth": { - "CLIENT_ID": "${CLIENT_ID:-}", - "CLIENT_SECRET": "${CLIENT_SECRET:-}" + "CLIENT_ID": "${CLIENT_ID}", + "CLIENT_SECRET": "${CLIENT_SECRET}" } } }