
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@pulsemcp/cloud-storage
Advanced tools
MCP server for cloud storage operations (GCS, with future support for S3)
Note: This package is part of the MCP Servers monorepo. For the latest updates and full source code, visit the Cloud Storage MCP Server directory.
MCP server for cloud storage operations. Currently supports Google Cloud Storage (GCS) with planned support for AWS S3 in the future.
| Tool | Group | Description |
|---|---|---|
save_file | write, admin | Save a file to cloud storage (inline content or local file) |
get_file | readonly+ | Get a file from cloud storage (inline or save to local file) |
search_files | readonly+ | Search/list files with prefix filtering and pagination |
delete_file | admin | Delete a file from cloud storage |
Files in the cloud storage bucket are automatically exposed as MCP resources:
| Resource | Description |
|---|---|
cloud-storage://config | Server configuration and status (for debugging) |
cloud-storage://file/{path} | Individual files in the bucket |
Control which tools are available via the ENABLED_TOOLGROUPS environment variable:
| Group | Description |
|---|---|
readonly | Read-only operations (get_file, search_files) |
write | Write operations (includes readonly + save_file) |
admin | All operations (includes write + delete_file) |
Examples:
ENABLED_TOOLGROUPS="readonly" - Only read operationsENABLED_TOOLGROUPS="readonly,write" - Read and write, no delete| Variable | Required | Description | Default |
|---|---|---|---|
GCS_BUCKET | Yes | Google Cloud Storage bucket name | - |
GCS_ROOT_DIRECTORY | No | Optional root directory prefix in the bucket | Bucket root |
GCS_PROJECT_ID | No | Google Cloud project ID | From default creds |
GCS_KEY_FILE | No | Path to service account JSON key file | Uses default creds |
GCS_CLIENT_EMAIL | No | Service account email (alternative to key file) | Uses key file |
GCS_PRIVATE_KEY | No | Service account private key (use with CLIENT_EMAIL) | Uses key file |
ENABLED_TOOLGROUPS | No | Comma-separated tool groups to enable | All enabled |
SKIP_HEALTH_CHECKS | No | Skip bucket connectivity check at startup | false |
The server supports three authentication methods (in order of priority):
Individual Credential Environment Variables (recommended for secrets managers):
GCS_CLIENT_EMAIL, GCS_PRIVATE_KEY, and GCS_PROJECT_ID\n for newlines)Service Account Key File:
GCS_KEY_FILE to the path of your service account JSON key fileGCS_PROJECT_ID (often included in the key file)Application Default Credentials (ADC):
gcloud auth application-default loginmacOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Using key file:
{
"mcpServers": {
"cloud-storage": {
"command": "npx",
"args": ["-y", "@pulsemcp/cloud-storage"],
"env": {
"GCS_BUCKET": "my-bucket-name",
"GCS_KEY_FILE": "/path/to/service-account-key.json",
"GCS_ROOT_DIRECTORY": "optional/prefix"
}
}
}
}
Using individual credential env vars:
{
"mcpServers": {
"cloud-storage": {
"command": "npx",
"args": ["-y", "@pulsemcp/cloud-storage"],
"env": {
"GCS_BUCKET": "my-bucket-name",
"GCS_PROJECT_ID": "my-project-id",
"GCS_CLIENT_EMAIL": "my-sa@my-project-id.iam.gserviceaccount.com",
"GCS_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"
}
}
}
}
Use the save_file tool to save a configuration file:
- path: "config/settings.json"
- content: "{\"debug\": true, \"version\": \"1.0\"}"
- content_type: "application/json"
Use the save_file tool to upload an image:
- path: "images/logo.png"
- local_file_path: "/tmp/logo.png"
Use the get_file tool to retrieve a file:
- path: "config/settings.json"
Use the get_file tool to download an image:
- path: "images/logo.png"
- local_file_path: "/tmp/downloaded-logo.png"
Use the search_files tool to list files:
- prefix: "documents/"
- limit: 50
Use the delete_file tool:
- path: "temp/old-file.txt"
npm run build
# Run functional tests
npm test
# Run integration tests
npm run test:integration
# Run manual tests (requires GCS credentials)
npm run test:manual
MIT
FAQs
MCP server for cloud storage operations (GCS, with future support for S3)
The npm package @pulsemcp/cloud-storage receives a total of 0 weekly downloads. As such, @pulsemcp/cloud-storage popularity was classified as not popular.
We found that @pulsemcp/cloud-storage demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.