firebase-security-rules-auditor

Overview

The Firebase security-rules auditor skill gives an agent a structured checklist for reviewing Firestore and Cloud Storage rules. Its instructions examine differences between create and update permissions, the source of role or ownership authority, field restrictions, data types and size limits. The review also asks whether legitimate application workflows remain possible under the rules. It is intended for rule assessment rather than Firebase deployment or general database operations. Providing the application’s roles and expected access patterns helps the agent distinguish a restrictive rule that breaks intended use from a rule that correctly enforces the design.

Getting started

Install the skill from the Firebase agent-skills repository and provide the actual rules and expected user roles. Review findings against representative allowed and denied operations before making changes.

Compatibility and requirements

Targets Firebase Security Rules for Firestore and Cloud Storage.

Things to know

The instructions support a review process; they do not certify a ruleset as secure. Test the application’s intended access paths and relevant denial cases.

Sources and documentation

• https://github.com/firebase/agent-skills/blob/main/skills/firebase-security-rules-auditor/SKILL.md
• https://github.com/firebase/agent-skills

Browse the MCP server directory