MCP util.js: Platform detection bug causes 'nul' file creation on macOS

[greatimon]

Bug Description

The commandExistsSync function in lib/mcp/util.js incorrectly executes Windows-specific code on macOS, resulting in the creation of a file named nul (Windows null device) in the working directory.

Environment

• OS: macOS (Darwin 24.6.0)
• firebase-tools version: 14.15.2 (globally installed via npm)
• Node.js: v22.x
• Context: Using Firebase MCP server with Claude Code CLI

Steps to Reproduce

1. Install firebase-tools globally: npm install -g firebase-tools
2. Use Firebase MCP server (e.g., via Claude Code or any MCP-compatible client)
3. The MCP server periodically checks for command availability
4. A file named nul appears in the working directory

Expected Behavior

On macOS/Linux, the function should execute:

which "command" > /dev/null 2> /dev/null

Actual Behavior

On macOS, the function executes the Windows branch:

where "command" > nul 2> nul

This results in:

1. /bin/sh: where: command not found error
2. A file named nul created in the working directory containing the error message

Root Cause

File: lib/mcp/util.js (lines 42-49)

function commandExistsSync(command) {
    try {
        const isWindows = (0, os_1.platform)() === "win32";
        const commandToCheck = isWindows
            ? `where "${command}" > nul 2> nul`
            : `which "${command}" > /dev/null 2> /dev/null`;
        (0, child_process_1.execSync)(commandToCheck);
        return true;
    }
    catch (error) {
        return false;
    }
}

The platform detection os_1.platform() === "win32" appears to fail or return an unexpected value in certain execution contexts (possibly related to how the MCP server is spawned).

Evidence

Contents of the nul file created on macOS:

/bin/sh: where: command not found

Simultaneously, firebase-debug.log is created with API calls showing empty project IDs:

GET https://serviceusage.googleapis.com/v1/projects//services/firebaseappdistribution.googleapis.com

Suggested Fix

Consider one of the following approaches:

1. Add defensive check for platform detection:

const platform = os_1.platform();
const isWindows = platform === "win32" || platform === "windows";

2. Use a cross-platform library like command-exists npm package

3. Add fallback logic if the first command fails:

function commandExistsSync(command) {
    const commands = [
        `which "${command}" > /dev/null 2> /dev/null`,
        `where "${command}" > nul 2> nul`,
        `command -v "${command}" > /dev/null 2> /dev/null`
    ];
    // Try each until one succeeds
}

Workaround

Add nul to .gitignore:

# Firebase MCP bug artifact
nul

Additional Context

This bug is triggered whenever the Firebase MCP server initializes or checks for tool availability, causing repeated file creation.

[aalej]

hey @greatimon, thanks for the detailed report. I'm looking though our repository for the commandExistsSync method, and it seems like it isn't used in the MCP server. On the latest version of firebase-tools, from what I can tell it's only present in 2 files. https://github.com/search?q=repo%3Afirebase%2Ffirebase-tools%20commandExistsSync&type=code

1. The actual method implementation in src/utils.ts
   

   firebase-tools/src/utils.ts

   Lines 1027 to 1044 in 7f787bf

   	export function commandExistsSync(command: string): boolean {
   	try {
   	const isWindows = platform() === "win32";
   	// For Windows, `where` is more appropriate. It also often outputs the path.
   	// For Unix-like systems, `which` is standard.
   	// The `2> nul` (Windows) or `2>/dev/null` (Unix) redirects stderr to suppress error messages.
   	// The `>` nul / `>/dev/null` redirects stdout as we only care about the exit code.
   	const commandToCheck = isWindows
   	? `where "${command}" > nul 2> nul`
   	: `which "${command}" > /dev/null 2> /dev/null`;
   	execSync(commandToCheck);
   	return true; // If execSync doesn't throw, the command was found (exit code 0)
   	} catch (error) {
   	// If the command is not found, execSync will throw an error (non-zero exit code)
   	return false;
   	}
   	}

2. Used during Firebase DataConnect SDK initialization to determine if you have npx and flutter installed on your machine
   

   firebase-tools/src/init/features/dataconnect/sdk.ts

   Lines 55 to 68 in 7f787bf

   	export async function askQuestions(setup: Setup): Promise<void> {
   	const info: SdkRequiredInfo = {
   	apps: [],
   	};
   	info.apps = await chooseApp();
   	if (!info.apps.length) {
   	const npxMissingWarning = commandExistsSync("npx")
   	? ""
   	: clc.yellow(" (you need to install Node.js first)");
   	const flutterMissingWarning = commandExistsSync("flutter")
   	? ""
   	: clc.yellow(" (you need to install Flutter first)");

It seems like the commandExistsSync method was removed from src/mcp/utils.ts in https://github.com/firebase/firebase-tools/pull/9084/changes#diff-c17eb6129837af8f978853cf3b98fa4f730feff2114c7b6df1d8d91561451b41, which is included in firebase-tools v14.16.0. Just to verify, are you still encountering this issue using the latest version of the MCP server? If so, does it occur when the MCP server starts up, or when it runs a tool like firebase_get_project, firebase_list_apps, etc.

Also, how is your MCP server configured? Does it looks something like:

{
  "mcpServers": {
    "firebase": {
      "command": "npx",
      "args": ["-y", "firebase-tools@latest", "mcp"]
    }
  }
}