Cloud Functions, logs, Hosting, Pub/Sub, queues and Remote Config

The Services page

1. In the sidebar, open a project and choose Services under it (or press Ctrl+K and type Services).
2. The page shows a card for each service the project has turned on: Cloud Functions, Logs, Hosting, Pub/Sub, Queues (Cloud Tasks) and Remote Config. The others are listed under Not turned on, with a link to turn them on in the Google Cloud console.
3. Choose Open on a card. Each service opens in a tab of its own, one per project.

Firetool asks Google which services are on only when the page opens, and keeps the answer for 10 minutes; Refresh asks again. When Google refuses something, the page says why in plain words: the service isn't turned on (with a link to turn it on), or the role your account is missing (see Roles).

Everything that changes something (calling a function, a rollback, a message, a task run, a publish) follows the project's rules, as edits to documents do: a read-only project refuses, a production project asks you to type its project ID first, and each change is recorded in the audit log. Bodies, message data and Remote Config values aren't copied into the audit log.

Reading these services doesn't use Firestore reads: the "documents read" counter doesn't move. Logs, Monitoring, Functions, Hosting, Cloud Tasks and Remote Config reads have no charge from Google; Pub/Sub charges by data, and calling a function, publishing a message or running a task runs real code, which costs what that code costs.

Logs

1. Open Logs from the Services page, or choose View logs on a function, a Hosting site, a topic, a queue or a Firestore query error: it opens already filtered.
2. Choose the time range, the lowest severity, a source (a function, Cloud Run, Firestore, Hosting, Cloud Tasks or Pub/Sub, and its name) and any text to look for. Entries come newest first, 100 at a time; Load more brings older ones.
3. Choose a row to see the whole entry, with Only this source and a link to its trace.
4. Follow shows new entries as they arrive: Firetool asks every 5 seconds while the tab is on screen and stops when it isn't. Google allows about 60 searches a minute per project; when it says it's busy, Follow waits longer and says so.

Hide personal data is on by default: email addresses, phone numbers, tokens and keys are masked before entries reach the window. The text you type is always searched as text, so it can't change the rest of the search. Export… saves the listed entries as CSV or JSON Lines, following the export rules and recorded in the audit log. Nothing else is saved.

Functions

1. Open Cloud Functions. Every function of the project is listed, 1st and 2nd gen, in every region, with its trigger (HTTP, callable, Firestore, Authentication, Pub/Sub, Storage, scheduled or task queue), state, runtime, last deploy and memory. Find by name, or show one kind of trigger.
2. Choose a function to see its settings, its trigger's filters, its labels, its environment variable names and its secrets by name. Show values reads the variables' values when you need them; they aren't kept. Secret values are never read.
3. The chart shows its calls, errors and time per call over the last 24 hours or 7 days (from Cloud Monitoring). View logs opens its log entries.
4. Call… runs an HTTP or callable function: choose the method, path, headers and body (for a callable function, the data), and whether to call as nobody, as the service account you're signed in with, or as another service account your account may act as. The answer, its status and the time it took are shown.

A call runs the function for real. On production Firetool asks for the project ID first; a read-only project refuses; the audit log records the call, its sizes and status, never the body. With a Google sign-in, Google won't give Firetool a token for a private function as you, so call as nobody or as a service account. Deploying and deleting functions stay with the Firebase CLI.

Hosting

1. Open Hosting and pick a site (the project's default site comes first).
2. Releases lists the live releases, newest first: the version, who released it, when, its message and its file count. Choose one to see its settings: headers, redirects, rewrites and clean URLs.
3. Roll back to this… makes an earlier version live again. It shows the settings lines that change and both file counts first, and it's refused if someone released the site after you looked. The audit entry offers Put back version…, which opens the same rollback for the version that was live.
4. Preview channels lists each channel's address, expiry and last release: Extend… by up to 30 days, or delete it. Domains shows each custom domain's state and certificate, and what's left to do.

Uploading a new version of a site stays with the Firebase CLI.

Pub/Sub

1. Open Pub/Sub. Topics shows each topic's schema, how long messages are kept, labels and subscriptions; Subscriptions shows pull or push, deadline, filter, dead-letter topic, retries and exactly-once delivery, with how many messages wait and how old the oldest is; Snapshots and Schemas are listed too.
2. Publish… sends one message, as JSON or text, with attributes. If the topic has a schema, the message is checked against it first. The size is shown before you send.
3. Watch new messages shows what's published to a topic from then on, through a temporary subscription of Firetool's own (named firetool-watch-…). It acknowledges only its own messages, so nobody else's are taken, and it's deleted when you choose Stop watching or close the tab (Google removes a forgotten one after a day). Hide personal data applies here too.
4. New topic…, New subscription… and Delete… make and remove them. A deleted one's settings stay in its audit entry, which can make it again.

Firetool doesn't pull from your own subscriptions: pulling would hand their messages out of turn.

Queues

1. Open Queues. Every Cloud Tasks queue in every location is listed: running or paused, how many tasks wait and how old the oldest is, how fast they're sent and how often they're tried.
2. Show tasks lists a queue's tasks, 100 at a time: when each runs, how many times it was tried and the last answer. Choose a task, then Show body to see its body and headers, with personal data hidden until you switch that off; authorization headers and cookies are always hidden.
3. Run now… and Delete… act on one task; Pause…, Resume… and Purge… on the whole queue. Purge says how many tasks it deletes first.

Google can't bring back a deleted or purged task, so there's no undo, and the confirm says so. On production each change asks for the project ID.

Remote Config

1. Open Remote Config. Parameters shows each parameter with its group, type, default and conditional values; Conditions lists them in the order that decides which value wins; Versions lists who published each version, when and how, and shows the lines that differ between any two.
2. Changes go to a draft in the tab: New parameter…, Edit…, New condition… or Edit as JSON…. Each change is checked before it gets there. A bar says what's changed, with Publish… and Discard.
3. Publish… shows every line that changes. If someone published since you started, it's refused and your draft is kept, so you can look again.
4. Roll back… makes an earlier version live again. Both are recorded in the audit log, whose entry offers Put back version….

A draft isn't kept when you close the tab. Client templates are shown (not server templates); personalization and rollout values are shown and kept as they are.

Compare services

1. Choose Tools, Compare services… (or Compare with another project… on a Services page), pick projects A and B, and tick the services.
2. Each service lists what's only in A, only in B and different; a row shows the lines that differ. Functions are compared by their settings, trigger and the names of their variables and secrets; Compare values… reads both functions' values into a dialog when you need them. Hosting compares each site's live settings; Pub/Sub its topics, subscriptions and schemas; Queues their settings; Remote Config its parameters and conditions.
3. Each project's own ID is ignored, so a site or service account named after my-app lines up with the one named after my-app-staging.
4. For Remote Config, Put in B's draft (or Put every difference in B's draft) opens B's Remote Config with A's parameters in its draft. Nothing is sent until you choose Publish… there, with its checks.

Comparing only reads. To compare documents, indexes and rules too, see Compare and migrate.

From the terminal

firetool functions list my-app
firetool logs my-app "timeout" --since 1h --severity ERROR
firetool hosting releases my-app --site my-app
firetool compare my-app-staging my-app --with functions,hosting,pubsub,queues,remoteconfig

Logs are masked unless you add --unmasked. firetool compare … --with exits with code 6 when it finds differences, so a CI job can stop on drift; add documents (or use all) to compare the databases too. These commands only read and need Pro on that computer. See The firetool command.

AI assistant and MCP

The AI assistant can read these services when you turn on Services in Settings, AI; assistants you connect through MCP can when you tick each read under Services it may read. Both are off until you turn them on and can only read. Logs they read always have email addresses, phone numbers, tokens and keys hidden, a day and 200 entries at a time at most; Remote Config values whose names look like secrets are hidden. See AI assistant and MCP.

Roles your account needs

Your Google account or service account needs Google's roles for each service. When one is missing, Firetool names it.

• Which services are on: Service Usage Viewer.
• Logs: Logs Viewer (Private Logs Viewer for Data Access logs).
• Functions: Cloud Functions Viewer, and Monitoring Viewer for the chart; to call one, Cloud Functions Invoker or Cloud Run Invoker.
• Hosting: Firebase Hosting Viewer; to roll back or change channels, Firebase Hosting Admin.
• Pub/Sub: Pub/Sub Viewer; to publish, Pub/Sub Publisher; to watch, make or delete, Pub/Sub Editor.
• Queues: Cloud Tasks Viewer; to run or delete tasks, Cloud Tasks Task Runner or Task Deleter; to pause, resume or purge, Cloud Tasks Queue Admin.
• Remote Config: Firebase Remote Config Viewer; to publish or roll back, Firebase Remote Config Admin.

Questions

Related

• Features: new in 4.5.2: the services at a glance.
• Roles and production safety: read-only and production projects, the audit log.
• Compare and migrate environments: documents, rules and indexes between projects.
• The firetool command: every command and exit code.