{
  "markdown": "# Google Cloud Storage Plugin\n\nThe official plugin for\n[Google Cloud Storage](https://cloud.google.com/storage). It bundles a growing\ncollection of [Agent Skills](https://agentskills.io/home) with a\n[Cloud Storage MCP server](#cloud-storage-mcp-server), so your coding agent gets\nboth vetted GCS expertise and structured tools for buckets and objects.\n\nThe skills let you work with your storage resources through natural language in\nyour preferred CLI or IDE: everyday bucket and object management, file-system\nmounts with Cloud Storage FUSE, access-error diagnostics, security assessments,\nand infrastructure code generation.\n\n> [!NOTE]\n> This plugin is under active development. More skills will be added\n> over time.\n\n> [!IMPORTANT]\n> **We Want Your Feedback!** Please share your thoughts with us by\n> opening an issue on\n> [GitHub](https://github.com/gemini-cli-extensions/google-cloud-storage/issues).\n> Your input is invaluable and helps us improve the project for everyone.\n\n## Contents\n\n-   [Installation](#installation)\n-   [Available Skills](#available-skills)\n-   [Cloud Storage MCP Server](#cloud-storage-mcp-server)\n-   [Prerequisites](#prerequisites)\n-   [Authentication](#authentication)\n-   [Additional Setup: GCS Security Assessment](#additional-setup-gcs-security-assessment)\n-   [Example Use Cases](#example-use-cases)\n-   [Security Reminder: Agent Environment Hardening](#security-reminder-agent-environment-hardening)\n-   [Support](#support)\n-   [Contributing](#contributing)\n-   [License](#license)\n\n## Installation\n\n### Installing in Gemini CLI\n\n```bash\ngemini extensions install https://github.com/gemini-cli-extensions/google-cloud-storage\n```\n\n### Installing in Claude Code\n\nThis plugin is listed in Claude Code's official marketplace, which is built in,\nso no marketplace needs to be added first:\n\n```bash\nclaude plugin install google-cloud-storage@claude-plugins-official\n```\n\n### Installing in Codex\n\nAdd this repository as a marketplace, then install from it:\n\n```bash\ncodex plugin marketplace add gemini-cli-extensions/google-cloud-storage\ncodex plugin add google-cloud-storage@google-cloud-storage\n```\n\n### Installing in Antigravity CLI\n\n```bash\nagy plugin install https://github.com/gemini-cli-extensions/google-cloud-storage\n```\n\n## Available Skills\n\n-   [**Google Cloud Storage Basics**](./skills/google-cloud-storage-basics/) —\n    Everyday GCS expertise: create and configure buckets; upload, download, and\n    transfer data; control access; manage storage classes, lifecycle, cost, and\n    data protection — via the gcloud CLI, JSON/XML APIs, client libraries,\n    Terraform, or Cloud Storage MCP servers.\n-   [**Google Cloud Storage Bucket Architect**](./skills/google-cloud-storage-bucket-architect/)\n    — Creates Google Cloud Storage (GCS) buckets: analyzes the workload\n    (sensitive data, media hosting, ingestion, web hosting, archiving, backup,\n    logging, analytics, AI/ML, or general-purpose), validates project-level\n    security settings, and designs a secure-by-default, cost-effective\n    configuration (location, storage class, security, lifecycle) before creating\n    it via gcloud, JSON/REST API, Terraform, or SDK client libraries (C++, Java,\n    Python, and Go).\n-   [**Google Cloud Storage FUSE**](./skills/google-cloud-storage-fuse/) — Mount\n    buckets as a POSIX file system with gcsfuse: decide when to use FUSE vs.\n    direct storage reads, deploy tuned mounts on GKE, Compute Engine, and Cloud\n    Run, size the file, stat, and list caches, keep file writes and ML\n    checkpointing safe, and diagnose slow or costly mounts with gcsfuse metrics.\n-   [**Google Cloud Storage Diagnostic**](./skills/google-cloud-storage-diagnostic/)\n    — Root-cause access failures: diagnose 403 Permission Denied and other\n    access errors by analyzing IAM policy bindings, ACLs, Uniform Bucket-Level\n    Access, Bucket-Level IP Filtering, and VPC Service Controls perimeters, then\n    walk through a verified fix.\n-   [**GCS Security Assessment**](./skills/gcs-security-assessment/) — Assess\n    the security posture of GCS projects and buckets against Google's\n    [Secure AI Framework (SAIF)](https://saif.google/secure-ai-framework/saif-map):\n    correlate real telemetry signals to surface **toxic combinations** of\n    vulnerabilities — scenarios where individually low-risk configurations\n    combine into a critical exposure — with actionable, verified remediation.\n    Needs [additional setup](#additional-setup-gcs-security-assessment) for a\n    complete assessment.\n\n## Cloud Storage MCP Server\n\nInstalling the plugin also configures a local Cloud Storage MCP server, so your\nagent can call structured storage tools instead of only shelling out to the CLI.\nThe server is [MCP Toolbox](https://github.com/googleapis/mcp-toolbox) running\nits prebuilt `cloud-storage` tools over stdio. It starts on demand through\n`npx`, so there is no binary to download, but Node.js must be installed.\n\nIt authenticates with the same Application Default Credentials as the skills\n(see [Authentication](#authentication)), and needs the `roles/storage.*` roles\nfor the operations you call: `roles/storage.objectViewer` to read,\n`roles/storage.objectAdmin` to copy, move, and delete objects, and\n`roles/storage.admin` to create or delete buckets.\n\n### Configuration\n\nThe server needs one setting:\n\n*   `CLOUD_STORAGE_PROJECT`: the Google Cloud project it operates on.\n\nHow you supply it depends on the harness:\n\n*   **Gemini CLI**: prompted on install. View or update later with `gemini\n    extensions config google-cloud-storage` (restart the CLI to apply).\n*   **Claude Code**: pass `--config cloud_storage_project=<project-id>` on\n    install, or run `/plugin` inside Claude Code.\n*   **Codex** and **Antigravity**: export it before starting your agent:\n\n```bash\nexport CLOUD_STORAGE_PROJECT=\"<your-project-id>\"\n```\n\n### Available Tools\n\nTool                    | Description\n:---------------------- | :----------------------------------------------\n`list_buckets`          | List buckets in the project.\n`get_bucket_metadata`   | Get a bucket's metadata.\n`get_bucket_iam_policy` | Get a bucket's IAM policy.\n`create_bucket`         | Create a bucket.\n`delete_bucket`         | Delete an empty bucket.\n`list_objects`          | List objects in a bucket.\n`get_object_metadata`   | Get an object's metadata.\n`read_object`           | Read UTF-8 text content (up to 8 MiB).\n`download_object`       | Download an object (binary included) to a file.\n`write_object`          | Write text content to an object (overwrites).\n`upload_object`         | Upload a local file (binary included).\n`copy_object`           | Copy an object.\n`move_object`           | Rename an object; deletes the source.\n`delete_object`         | Delete an object.\n\n> [!CAUTION]\n> Five of these tools destroy or overwrite data: `delete_bucket`,\n> `delete_object`, `move_object` (deletes the source), `write_object`, and\n> `upload_object`. Your agent must ask for explicit permission before calling\n> them.\n\nFor a comparison with the Google-hosted remote Cloud Storage MCP server, which\nsupports Model Armor screening and IAM deny policies, see the\n[MCP usage reference](./skills/google-cloud-storage-basics/references/mcp-usage.md).\n\nIf your agent reports `spawn npx ENOENT`, Node.js is not installed or `npx` is\nnot on your `PATH`.\n\n## Prerequisites\n\nEnsure you have the following:\n\n*   **A Google Cloud project** with the resources you want to work with.\n*   **Google Cloud SDK (gcloud CLI):**\n    [Install and initialize](https://cloud.google.com/sdk/docs/install) the\n    gcloud CLI and ensure\n    [Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/provide-credentials-adc)\n    are configured.\n*   **A compatible coding agent**, such as Gemini CLI, Claude Code, Codex, or\n    Antigravity CLI.\n*   **[Node.js](https://nodejs.org/)**: the\n    [Cloud Storage MCP server](#cloud-storage-mcp-server) runs via `npx`.\n\n## Authentication\n\nBefore using the skills, authenticate with Google Cloud so your agent can read\nyour storage resources and run any changes you approve. It is recommended to run\n**both** of the following commands:\n\n```bash\ngcloud auth login\ngcloud auth application-default login\n```\n\n*   **`gcloud auth application-default login`** is **required**: skill scripts\n    use Application Default Credentials (ADC) to generate access tokens for GCP\n    API calls.\n*   **`gcloud auth login`** allows the agent (or you) to run standard `gcloud`\n    commands to explore configurations or dig deeper into specific resources\n    beyond what the skill scripts cover.\n\n## Additional Setup: GCS Security Assessment\n\nThe GCS Security Assessment skill runs with nothing more than working\nApplication Default Credentials (see [Authentication](#authentication)) — there\nis no required IAM permission. However, signals the skill cannot read are\nreported as `UNKNOWN`, so for a complete assessment grant the recommended\n**read-only** roles covering Storage Insights telemetry (bucket/object analysis)\nand project-level posture (IAM and audit config, org policies, VPC Service\nControls, and Model Armor). See **[PERMISSIONS.md](./PERMISSIONS.md)** for the\nfull permission tables and a ready-to-apply custom IAM role\n([`gcs-security-assessment-role.yaml`](./gcs-security-assessment-role.yaml)).\n\n> [!TIP]\n> For the best analysis, we highly recommend being a\n> [Storage Intelligence](https://docs.cloud.google.com/storage/docs/storage-intelligence/overview)\n> customer. When Storage Intelligence is enabled, the skill can query your\n> Storage Insights datasets to perform deep, bucket-level and object-level\n> assessments. Without it, the skill falls back to a project-level assessment\n> only.\n\nThe other skills need no permissions beyond the [prerequisites](#prerequisites)\nand whatever IAM access your identity already has to the buckets you work with.\n\n## Example Use Cases\n\nThe skills cover the full storage lifecycle — provisioning, data movement,\nfile-system access, access control, troubleshooting, protection and compliance,\ncost, security, and automation. Interact with Google Cloud Storage using natural\nlanguage, right from your coding agent:\n\n### Design and provision storage for any workload\n\n*   **Quick start:** \"Create a new GCS bucket named 'audio-video-assets' in the\n    'my-gcp-project' project\"\n*   **Sensitive data:** \"Create a secure GCS bucket to store PII and other\n    sensitive data. Make sure the data is protected against exfiltration and\n    unauthorized public exposure\"\n*   **Media serving:** \"I am building a high-performance media streaming service\n    that delivers millions of high-definition images and videos to a global\n    audience. Set up a Cloud Storage bucket as the origin, paired with a global\n    Content Delivery Network (CDN), to minimize latency and ensure optimal\n    streaming performance at scale\"\n*   **AI/ML workloads:** \"I have a large-scale model training and checkpointing\n    use case. Help me set up GCS to optimize performance\"\n\n### Mount buckets as a file system\n\n*   **Workload fit:** \"Should my ML training workload use Cloud Storage FUSE,\n    native gs:// reads, or Filestore? It reads millions of small files every\n    epoch\"\n*   **Tuned mounts:** \"Help me mount the 'ml-datasets' bucket as a local file\n    system with gcsfuse, with mount options tuned for high-throughput model\n    training\"\n*   **GKE deployment:** \"Deploy a gcsfuse mount on my GKE training cluster with\n    the CSI driver, with caches sized for repeated reads of the training\n    dataset\"\n*   **Performance diagnosis:** \"My training job reads from a gcsfuse mount and\n    GPU utilization is low. Diagnose whether the mount is the bottleneck and\n    tune it\"\n*   **Cost diagnosis:** \"My GCS bill spiked after we moved to gcsfuse. Figure\n    out which mount options are causing the excess operations\"\n\n### Move, replicate, and migrate data at scale\n\n*   **Cloud migration:** \"Migrate the data in my S3 bucket 'legacy-exports' into\n    a new GCS bucket\"\n*   **Disaster recovery:** \"Set up continuous replication of bucket 'ops-bucket'\n    to bucket 'vault-bucket-isolated', and ensure all the existing historical\n    data is copied as well\"\n*   **Zero-downtime moves:** \"Relocate my 'analytics-archive' bucket from\n    us-east1 to us-central1 without downtime\"\n\n### Control who can access your data\n\n*   **Temporary sharing:** \"How can I temporarily give one of my users access to\n    upload a large video to my bucket?\"\n*   **Least privilege:** \"Give the analytics team read-only access to the\n    'reports' bucket without granting them anything else in the project\"\n\n### Diagnose and fix access errors\n\n*   **403 Permission Denied:** \"User alice@example.com is getting a 403\n    Permission Denied when trying to list objects in gs://my-team-bucket. Help\n    me diagnose and fix it\"\n*   **Confusing denials:** \"Diagnose why reading gs://data-bucket/object.txt\n    fails even though I have object viewer permissions\"\n*   **IP filtering lockout:** \"I am getting a 403 error on gs://my-secure-bucket\n    due to IP filtering restrictions\"\n*   **Service agents:** \"Pub/Sub notifications on my bucket stopped working\n    after we enabled CMEK. Check whether the service agents have the right\n    permissions\"\n\n### Protect data and meet compliance requirements\n\n*   **Recovery:** \"I accidentally deleted objects from the 'prod-reports'\n    bucket. Can I get them back?\"\n*   **Immutability:** \"Configure my 'audit-logs' bucket so objects cannot be\n    deleted or modified for 7 years\"\n\n### Optimize storage costs\n\n*   **Cost analysis:** \"Analyze my buckets and recommend storage classes and\n    lifecycle rules to reduce storage costs\"\n*   **Usage insight:** \"Find my largest and least-accessed datasets across all\n    buckets in the project\"\n\n### Assess and harden your security posture\n\n*   **Targeted assessment:** \"Assess the security posture of buckets [BUCKET_1],\n    [BUCKET_2] in project [PROJECT_ID]\"\n*   **Project-wide assessment:** \"Run a security assessment of project\n    [PROJECT_ID] and show me the exact commands to remediate any toxic\n    combinations you find\"\n*   **Follow-up investigation:** \"Explain why the 'ml-training-data' bucket is\n    flagged as a toxic combination, and show me the exact command to remediate\n    the public access finding\"\n\n### Generate infrastructure and application code\n\n*   **Terraform:** \"Generate a Terraform configuration to provision a GCS bucket\n    in us-central1 for application logs. Make sure public access is prevented\n    and Uniform Bucket-Level Access is enabled, and add a lifecycle rule to\n    transition logs to Nearline storage after 30 days and delete them after 365\n    days\"\n*   **Client libraries:** \"Generate Java code to upload a local directory to my\n    'app-backups' bucket in parallel using the Cloud Storage client library\"\n\n### Set up and secure Cloud Storage MCP servers\n\n*   **Guarded setup:** \"Set up the Cloud Storage MCP server for my coding agent,\n    and integrate Model Armor with it to screen tool calls for prompt injection\"\n*   **Authentication and tools:** \"How do I authenticate and authorize with the\n    remote Cloud Storage MCP server, and what tools are available on it?\"\n*   **Choosing a server:** \"For downloading large files from my buckets, which\n    Cloud Storage MCP server should I use?\"\n*   **Read-only enforcement:** \"Lock down the Cloud Storage remote MCP server\n    with an IAM deny policy so my agent can only call read-only tools\"\n\n### Build event-driven and AI-powered workflows\n\n*   **Event notifications:** \"Send a Pub/Sub notification whenever new objects\n    land in my 'ingest' bucket so my pipeline can process them\"\n*   **Agentic workflows:** \"Scan the 'retail-raw-products' bucket for assets\n    related to 'ProductX', draft a promotional social media campaign listing,\n    and write the draft output file to bucket 'retail-campaigns'\"\n\n## Security Reminder: Agent Environment Hardening\n\nYour agent can execute tools and commands on your behalf. Protect your Google\nCloud resources by enforcing **The Principle of Least Privilege** across all\nCLIs, MCP servers and other resources available to your agents.\n\n*   **Service Accounts:** Use\n    [service accounts](https://docs.cloud.google.com/docs/authentication/use-service-account-impersonation)\n    instead of end user credentials to access Google Cloud resources.\n*   **Limited Permissions:** Assign roles with\n    [limited permissions](https://docs.cloud.google.com/iam/docs/roles-overview)\n    to the service account that you're using for authentication.\n*   **Principal Access Boundaries:** Prevent unwanted cross-org agent access by\n    using\n    [Principal Access Boundary policies](https://docs.cloud.google.com/iam/docs/principal-access-boundary-policies#use-case-one-project)\n    to scope your agent to projects you intend it to access.\n*   [Include a condition in the policy binding](https://docs.cloud.google.com/iam/docs/principal-access-boundary-policies#use-case-one-project)\n    to ensure that the policy only applies to the service accounts that you\n    intend to restrict.\n\nYou can read more\n[here](https://docs.cloud.google.com/data-cloud-extension/vs-code/prompt-injection-risk)\non how to mitigate prompt injection attacks with Google Cloud MCP.\n\n## Support\n\nIf you need help or encounter issues with this plugin, search for existing\nissues or open a new one in the\n[GitHub Issue Tracker](https://github.com/gemini-cli-extensions/google-cloud-storage/issues).\n\n## Contributing\n\nWe welcome contributions to improve this plugin. You can help by:\n\n*   [Reporting bugs or inaccuracies](https://github.com/gemini-cli-extensions/google-cloud-storage/issues)\n    in the skill files.\n*   Suggesting new skills to add to this plugin by filing a feature request.\n\n## License\n\nYou are free to copy, modify, and distribute this plugin under the terms of the\nApache 2.0 license. See the `LICENSE` file for details.\n",
  "bytes": 17953,
  "sha": "06c0bcf71bb6dad66306481d038e3091caef08b0c52e932f7d4a240d2849c796",
  "repo_slug": "gemini-cli-extensions/google-cloud-storage",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_gemini_cli_extensions_google_cloud_stora_6531ef69/readme"
}