# Stack Firebase

> >

- **Type:** Skill
- **Install:** `agentstack add skill-e-t-y-b-etyb-skills-firebase`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [e-t-y-b](https://agentstack.voostack.com/s/e-t-y-b)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [e-t-y-b](https://github.com/e-t-y-b)
- **Source:** https://github.com/e-t-y-b/etyb-skills/tree/main/stacks/firebase
- **Website:** https://etyb.ai

## Install

```sh
agentstack add skill-e-t-y-b-etyb-skills-firebase
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Firebase Stack — Team Briefing

This is a **knowledge overlay**, not a new specialist. The existing ETYB team does the work — backend-architect writes the backend code, devops-engineer wires the deploys, security-engineer enforces the boundary. This pack tells each role where the current Firebase knowledge lives.

## Where the full briefing lives

The full Stack briefing lives in this same folder. Per-product and per-role pages are siblings of this `SKILL.md`. Every page carries `last_verified_on` stamps and authoritative-source URLs in its frontmatter; see `skills/etyb/core/knowledge-currency.md` for the drift-check protocol that uses them.

- **Stack briefing:** [`stacks/firebase/index.md`](index.md)
- **Per-product pages:** `stacks/firebase/.md` — one per entry in `products_covered` above
- **Per-role views:** `stacks/firebase/.md` — one per role in `applies_to_roles` above

When ETYB is installed locally these are read directly from disk. For third-party agents without the install, the same content is reachable as raw markdown at `https://raw.githubusercontent.com/e-t-y-b/etyb-skills/main/stacks/firebase/.md`.

When `delegate_to_skills` (frontmatter above) lists a first-party vendor MCP/skill that's installed in the user's environment, ETYB defers to it first. The in-repo Stack content is the curated fallback.
## What changed in 2025-2026 that older training data misses

Critical context — an LLM with a 2024 cutoff will get these wrong:

- **Project IDX is now Firebase Studio** (renamed 2025). Same product surface, new branding, deeper Firebase + Gemini integration. If you say "Project IDX" you're using the old name.
- **Vertex AI in Firebase is now Firebase AI Logic** (renamed 2025). The client-side Gemini SDK that talks to either Vertex AI or the Gemini Developer API behind App Check. The name change matters because the SDK packages were renamed too (`@firebase/ai` replaces `@firebase/vertexai`).
- **Firebase App Hosting GA** (2024) — the SSR-aware successor for Next.js and Angular. Cloud Run + Cloud Build under the hood, GitHub-integrated, replaces the brittle "Hosting + Cloud Functions rewrites" pattern that everyone built circa 2022.
- **Firebase Data Connect GA** (2024-2025) — managed Cloud SQL Postgres + GraphQL with generated, typed clients. Firebase now has a first-class relational option; "Firebase = NoSQL only" is out of date.
- **Cloud Functions Gen 2 is the default** for new functions, backed by Cloud Run with concurrent request handling, better cold-start economics, and a different deploy/runtime model. Gen 1 is on the deprecation roadmap — write all new code on v2 (`firebase-functions/v2`).
- **Firestore multi-database per project** (GA 2024). You can now provision multiple Firestore databases per project (named, distinct rules, distinct locations). This replaces "one project per database scope" workarounds.
- **App Check Replay Protection** (GA 2024) — single-use App Check tokens for callable functions, defending against captured-token replay. Worth enabling on every privileged path.
- **FCM legacy HTTP and XMPP server APIs are deprecated**. Use **HTTP v1 API** or the Admin SDK. Old code calling `fcm.googleapis.com/fcm/send` with a server key will break — that endpoint was sunset.
- **Firebase Authentication ↔ Identity Platform** convergence (2024-2025). The classic Firebase Auth tier and the paid Identity Platform tier (with MFA, SAML/OIDC SSO, advanced security) share the same surface and billing model now; "upgrading to Identity Platform" is a project toggle, not a re-architecture.
- **Modular Web SDK is the only supported shape** for `firebase` v9+. Namespaced v8 imports (`firebase.auth().signInWithEmailAndPassword(...)`) are legacy and tree-shake badly. New code uses tree-shakable modular imports.
- **Genkit JS GA**, with Python, Go, and Dart maturing through 2025-2026. Genkit's flow/tool/prompt API has churned multiple times — any sample older than mid-2024 likely has out-of-date shapes (`defineFlow` → `ai.defineFlow` etc.).

If you find yourself recommending any retired product, deprecated CLI, or renamed feature from the list above, you're using stale knowledge. Read the relevant sibling file in this folder before continuing.

## Standing instructions for every role on a Firebase engagement

1. **Anchor to currency.** Before recommending API shapes, syntax, product names, or pricing, read the relevant sibling file in this folder and check its `last_verified_on`. If it's older than 6 months, also probe the vendor's authoritative source (in `authoritative_sources` above).

2. **Defer to verticals on domain compliance.** This pack covers platform mechanics. HIPAA, PCI/PSD2, SOC 2 specifics belong to `healthcare-architect`, `fintech-architect`, `saas-architect`. Route to the vertical; don't restate compliance content from this pack.

3. **Respect platform-specific limits.** Governor limits, request quotas, billing units, concurrency caps — every recommendation that implies volume must consider them. If the user's volume doesn't fit, recommend the platform's escape hatch (batch, queue, partition, scale tier) — don't write code and hope.

4. **App Check on every privileged backend in production.** Cloud Functions, Firestore, Storage, RTDB, Data Connect, AI Logic. Enable in monitoring/shadow mode first to size the impact; enforce after a clean week.

## When to escalate out of this pack

| Situation | Escalate to |
|-----------|-------------|
| Compliance specifics (HIPAA, PCI, SOC 2) | `healthcare-architect` / `fintech-architect` / `saas-architect` |
| Multi-stack architecture spanning vendors | `system-architect` (without the pack overlay) |
| Vendor-agnostic work that happens to touch Firebase | the relevant specialist (without the pack overlay) |

## Stack composition

If the user is running Firebase alongside another stack that has its own pack registered, both overlays load. Each pack handles its own platform; neither should pretend to know the other's depth.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [e-t-y-b](https://github.com/e-t-y-b)
- **Source:** [e-t-y-b/etyb-skills](https://github.com/e-t-y-b/etyb-skills)
- **License:** MIT
- **Homepage:** https://etyb.ai

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-e-t-y-b-etyb-skills-firebase
- Seller: https://agentstack.voostack.com/s/e-t-y-b
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.