Google Cloud Storage Plugin
Google's plugin with six skills and two MCP servers for Cloud Storage: buckets, objects, access errors and security audits
- 34 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Tools delete buckets and objects and overwrite data in a Google Cloud project using your credentials
- The security assessment skill reads the project's IAM, audit logs and organization policies
- The plugin starts local servers through `npx` and `uv`, which download dependencies on first run
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/google-cloud-storage-pluginDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Tools delete buckets and objects and overwrite data in a Google Cloud project using your credentials
- The security assessment skill reads the project's IAM, audit logs and organization policies
- The plugin starts local servers through `npx` and `uv`, which download dependencies on first run
This is third-party code. Review the repository files before installing.
What it does
The plugin installs six Google Cloud Storage skills into the agent. One covers everyday bucket and object work, one designs a new bucket for a given workload, and one sets up mounts through Cloud Storage FUSE. A fourth traces access failures such as 403 Permission Denied through IAM policies, ACLs and VPC Service Controls perimeters. A fifth assesses the security of projects and buckets against the Secure AI Framework, and the sixth searches data in the Open Knowledge Format. Alongside the skills the plugin connects a local Cloud Storage MCP server built on MCP Toolbox. It starts through `npx` and gives the agent 14 tools: bucket listing, metadata and IAM policy, object reads and writes, upload, copy, move and delete. A second server, `google-cloud-storage-okf`, serves the `peek`, `list_regions`, `expand` and `write_okf` tools for the OKF skill and runs through `uv`. Authorization goes through Application Default Credentials. The Google Cloud project is set with the `CLOUD_STORAGE_PROJECT` variable. Five tools delete or overwrite data: `delete_bucket`, `delete_object`, `move_object`, `write_object` and `upload_object`. The developer requires the agent to ask for explicit permission before calling them.
Who it is for. Engineers who keep data in Google Cloud Storage and work in Claude Code, Codex or Gemini CLI: they create buckets, mount them in GKE and trace access denials.
Good fit when
- A new bucket for archives, logs or media: the agent picks location, storage class and lifecycle rules before creating it
- An application gets 403 Permission Denied from a bucket and the cause hides in IAM, an ACL or a VPC Service Controls perimeter
- A bucket is mounted in GKE, Compute Engine or Cloud Run and the `gcsfuse` caches are tuned for reads and writes
- Before an audit you want a risk map of projects and buckets, including setting combinations that look harmless one by one
Not a fit when
- The data sits in Amazon S3 or Azure Blob: the plugin knows only Google Cloud Storage
- The agent must not change data in the project: write and delete tools ship in the same MCP server
- The machine has no `gcloud` with Application Default Credentials and installing it is not an option
Example request
Create a bucket for a log archive with seven-year retention and suggest lifecycle rulesLimitations
- Without `gcloud auth application-default login` the skills get no tokens for Google Cloud API calls.
- The local MCP server starts through `npx`, so Node.js is required, and the OKF server needs `uv`. A `spawn npx ENOENT` error means Node.js is not on `PATH`.
- Reading objects needs `roles/storage.objectViewer`, copying and deleting objects needs `roles/storage.objectAdmin`, creating buckets needs `roles/storage.admin`. Without extra roles the security assessment marks unreadable signals as `UNKNOWN`.
- The `npx skills add` command installs the skills only, without the MCP server.
How to disable. Remove the plugin through the agent's plugin manager; in Claude Code the `/plugin` command lists it. Application Default Credentials stay on the machine until you revoke them yourself.
FAQ
How do I install the plugin in Claude Code?
Run `claude plugin install google-cloud-storage@claude-plugins-official`. The plugin is in the built-in Claude Code marketplace, so no marketplace needs adding. Pass the Google Cloud project with `--config cloud_storage_project=<project-id>` or through `/plugin`.
Which tools delete or overwrite data?
Five: `delete_bucket`, `delete_object`, `move_object` (it deletes the source), `write_object` and `upload_object`. The developer requires the agent to ask permission before each of them.
Which Google Cloud permissions are needed?
`roles/storage.objectViewer` is enough for reading. Copying, moving and deleting objects needs `roles/storage.objectAdmin`, and creating or deleting buckets needs `roles/storage.admin`. The permission list for the security assessment is in `PERMISSIONS.md`, with a ready role in `gcs-security-assessment-role.yaml`.
What should I do about `spawn npx ENOENT`?
Install Node.js and make sure `npx` is on `PATH`, then restart the agent. For the OKF server the similar `spawn uv ENOENT` error means `uv` is missing.
How does the security assessment differ from a plain settings check?
The skill correlates Storage Intelligence telemetry with project settings and looks for risky combinations. Each setting looks harmless alone and together they open a critical gap. Signals the skill cannot read are marked `UNKNOWN`.
Can I install the skills without the MCP server?
Yes, with `npx skills add GoogleCloudPlatform/google-cloud-storage-plugin`. The prompt lets you pick skills, and the `--skill` flag installs a single one. The developer recommends the native plugin install as the full package.
Discussion
No questions or reviews yet.
Related
PluginsGoogle Cloud MCP servers: gcloud commands, logs and metrics, Cloud Storage and Backup and DR
Agent Skills for Google products
Agent Skills for Google products and technologies
Official Google skill collection for working with Google Cloud, BigQuery, GKE, ads and analytics from an agent
Google's MCP server for deploying apps to Cloud Run from an agent, with service listing and log reading
Cloudflare's official agent skills: Workers, Durable Objects, wrangler, Pages, storage and an MCP server
Azure Skills
Azure Skills Plugin
Microsoft's official plugin: Azure skills plus the Azure MCP Server and Foundry MCP wired in for real cloud actions
Google Cloud's MCP server and Gemini CLI extension for GKE clusters: resources, logs, deploys, costs and upgrade risks
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Google Cloud Storage Plugin (this card) | yes | 34 | ||
| Agent Skills for Google products | no | 22,726 | a general skill collection across many Google products rather than Cloud Storage alone | |
| gcloud MCP Server | yes | OAuth | 946 | a set of MCP servers around `gcloud`, without skills for bucket design or security audits |
README in short
The page opens with install commands for Antigravity CLI, Claude Code, Codex and Gemini CLI. It continues with skill descriptions, a table of 14 MCP tools, `gcloud` and role requirements, example prompts and a reminder on hardening the agent environment.