Google Cloud

Google Cloud

Use the unified MCP server for authenticated Google Cloud REST APIs, Artifact Registry and gcr.io OCI Distribution HTTP, finite gRPC request streams carried directly over HTTP/2, bounded Vertex/Gemini Live WSS sessions, and finite Firebase Realtime Database SSE observations. gRPC supports both raw framed protobuf and descriptor-driven ProtoJSON conversion. The gateway accepts only exact official Google API, Registry, or Firebase Database endpoints and gets access tokens from the official Google Auth ADC chain. It never executes gcloud, Docker, a credential helper, grpcurl, protoc, or any other CLI at runtime.

Workflow

1. Call cloud_provider_status with provider="gcp"; treat available as adapter readiness and credential_status=unverified as pending live authentication.
2. Use gcp_api_discover(service=<discovery-name>, operation=<version>) to read the public Google Discovery document when REST transcoding is available; for gRPC-only methods use the official RPC reference and protobuf definitions.
3. Use gcp_api_read for REST GET, HEAD, or OPTIONS. With auth_scheme="grpc", read-like RPC names such as Get, List, Recognize, and StreamingRecognize are conservatively accepted even though gRPC itself uses HTTP POST. Exact official Firestore Listen and Cloud Logging TailLogEntries paths are also read-only; lookalike Listen methods are not.
4. Artifact Registry and Artifact Registry-backed gcr.io repositories use gcp_api_read(auth_scheme="artifact-registry", service="artifact-registry", ...) for OCI Distribution reads. The server applies ADC Bearer only to an exact <location>-docker.pkg.dev or supported gcr.io host. Writes use the mutation gate; upload bodies must be monolithic because Google does not support Docker chunked PATCH uploads.
5. Firebase Realtime Database listeners use gcp_api_read(auth_scheme="firebase-sse", service="firebase-database", operation="Listen", method="GET"), an exact official .json URL, a bounded plan, and response_file. The server requests the two documented Firebase OAuth scopes internally and never accepts auth, access_token, or headers from the caller.
6. Vertex/Gemini Live uses auth_scheme="vertex-live-ws" and always requires gcp_api_mutate(force=true) because it starts a paid stateful session. In addition to caller-prepared official client messages, bounded tool_handlers can answer server-generated function-call IDs and the resumable mode can reconnect without exposing its session handle.
7. For REST POST, PUT, PATCH, or DELETE, Registry writes, and any gRPC method not classified as read-like, obtain explicit human approval for the project, URL, method, request messages, resources, and effect; then use gcp_api_mutate(force=true).
8. Secret-resource operations require the separate sensitive gate. IAM Credentials, STS/token exchange, service-account private-key creation, API-key export, and sign-in token endpoints are never exposed by the gateway.
9. Never pass OAuth tokens, API keys, signed URL parameters, cookies, or authorization headers.

MCP arguments

• method and url: exact documented Google API or Registry request.
• project: optional quota/billing project, sent as X-Goog-User-Project.
• headers: non-credential conditional or product headers.
• body: JSON-compatible request body.
• body_file: binary/media upload body under an operator-approved CLOUD_SKILLS_ALLOWED_FILE_ROOTS directory. Do not combine it with body; use resumable/chunk upload APIs above 64 MiB.
• response_file: new approved-root file for media downloads, exports, or other large responses. Use the official Range header above the configured per-call limit; existing files are never overwritten.
• auth_scheme="artifact-registry": exact <location>-docker.pkg.dev/v2/<project>/<repository>/<image>/... or gcr.io|us.gcr.io|eu.gcr.io|asia.gcr.io/v2/<project>/<image>/... OCI Distribution request. Version, manifest, blob, tags, referrers, cross-repository mount, and monolithic upload paths are method-checked before ADC resolution. A 202 single-POST upload fallback is completed internally with one full-body PUT to the exact same-origin provider Location; the Location capability never leaves the server. /v2/token, _catalog, caller Authorization, and chunked PATCH uploads are rejected.
• auth_scheme="firebase-sse": exact https://<database>.firebaseio.com/<path>.json, https://<database>.europe-west1.firebasedatabase.app/<path>.json, or https://<database>.asia-southeast1.firebasedatabase.app/<path>.json. body requires max_events=1..256 and timeout_seconds=1..300; include_keep_alive is optional. parameters may contain the documented orderBy, limitToFirst, limitToLast, startAt, endAt, and equalTo query filters. The server manually validates at most three required 307 redirects, preserves the exact path/query, and atomically publishes only sanitized put, patch, and optionally keep-alive NDJSON.
• auth_scheme="grpc" raw mode: direct HTTP/2 gRPC. method must be POST; url must be https://<service>.googleapis.com/<fully-qualified-Service>/<Method>; body_file contains one or more standard uncompressed gRPC records (0x00 plus a four-byte big-endian protobuf length plus the serialized protobuf message); and response_file receives the same validated raw framed-protobuf response. Do not set Content-Type, TE, or any grpc-* protocol header.
• auth_scheme="grpc", payload_mode="protobuf-json": schema-driven direct HTTP/2 gRPC. Set protobuf_descriptor_file to a binary google.protobuf.FileDescriptorSet under an approved root. It must contain the exact service/method named by the URL and all imported descriptors. Use one ProtoJSON object in body for unary/server-streaming RPCs or 1–256 objects for client/bidirectional streams; the gateway derives input/output message types from the method descriptor, rejects unknown request fields, emits deterministic protobuf frames, rejects unknown response wire fields at any nested level, and atomically writes official ProtoJSON NDJSON. A unary response must contain exactly one message. For every descriptor-declared server stream, set stream_max_messages (1–256) and stream_timeout_seconds (1–300); the message bound or a timeout while waiting between complete response frames ends the observation successfully, while a partial frame or any already-known nonzero grpc-status aborts publication. The descriptor remains local and is never sent to Google.
• auth_scheme="vertex-live-ws": exact official wss://aiplatform.googleapis.com global endpoint, <region>-aiplatform.googleapis.com regional endpoint, or aiplatform.us|eu.rep.googleapis.com multi-region endpoint with the v1beta1.LlmBidiService/BidiGenerateContent path. Set service="aiplatform", operation="BidiGenerateContent", project, region, method GET, a bounded body message plan, and response_file. The first message is the only setup and its fully qualified publisher model must match the project/location; later messages use exactly one of clientContent, realtimeInput, or a caller-prepared toolResponse. Set max_messages and timeout_seconds to 2–256 and 1–300 respectively.
• tool_handlers: optional list of 1–64 deterministic, credential-free response templates. Each entry has an official function name, a JSON-object response, and max_calls from 1–32. When the server sends toolCall.functionCalls[], the gateway matches the exact name, copies the provider-generated id into toolResponse.functionResponses[], and decrements the bound atomically. Unknown names, duplicate IDs, or an exhausted handler fail the session without publishing its output. This dispatcher returns pre-approved data; it does not execute arbitrary local commands or cloud mutations.
• resume_on_go_away=true plus max_reconnects=1..8: enables transparent recovery after goAway or an unexpected transport close. The gateway injects sessionResumption.transparent=true, retains newHandle only in memory, prunes acknowledged buffered messages using lastConsumedClientMessageIndex, reacquires ADC for each Upgrade, and replays only the unacknowledged suffix. Caller-supplied handles are forbidden and newHandle is removed from the NDJSON transcript.
• stream_interval_ms: optional delay between complete gRPC request messages or between post-setup Vertex Live JSON messages. Framed messages must not be split, so stream_chunk_bytes is forbidden. stream_max_messages and stream_timeout_seconds are accepted only by descriptor-driven server streams and are never silently applied to another transport. Observe product limits in the official reference; Speech-to-Text v2 limits each streaming audio request message to 15 KB.

Example read: gcp_api_read(method="GET", url="https://compute.googleapis.com/compute/v1/projects/<project>/aggregated/instances", project="<project>").

Example Artifact Registry read: gcp_api_read(auth_scheme="artifact-registry", service="artifact-registry", operation="ListTags", method="GET", url="https://us-west1-docker.pkg.dev/v2/<project>/<repository>/<image>/tags/list", parameters={"n":20}, project="<quota-project>").

Example bounded Firebase listener: gcp_api_read(auth_scheme="firebase-sse", service="firebase-database", operation="Listen", method="GET", url="https://<database>.europe-west1.firebasedatabase.app/messages.json", parameters={"orderBy":"\"createdAt\"","limitToLast":10}, body={"max_events":32,"timeout_seconds":30}, response_file="<approved-root>/firebase-events.ndjson").

Example finite Speech-to-Text v2 stream: gcp_api_read(auth_scheme="grpc", service="speech", operation="StreamingRecognize", method="POST", url="https://speech.googleapis.com/google.cloud.speech.v2.Speech/StreamingRecognize", project="<project>", headers={"x-goog-request-params":"recognizer=projects/<project>/locations/global/recognizers/_"}, body_file="/approved/grpc/speech-request.grpc", response_file="/approved/grpc/speech-response.grpc", stream_interval_ms=100).

The first Speech v2 message contains the recognizer/configuration required by the RPC contract and later messages contain audio only. The gateway validates framing, authenticates the HTTP/2 request, checks response framing and grpc-status, and atomically publishes the response file; protobuf construction and decoding remain driven by the official service schema rather than guessed JSON transcoding.

Schema-driven equivalent: gcp_api_read(auth_scheme="grpc", payload_mode="protobuf-json", service="speech", operation="StreamingRecognize", method="POST", url="https://speech.googleapis.com/google.cloud.speech.v2.Speech/StreamingRecognize", project="<project>", headers={"x-goog-request-params":"recognizer=projects/<project>/locations/global/recognizers/_"}, protobuf_descriptor_file="/approved/schemas/speech-v2.protoset", body=[{"recognizer":"projects/<project>/locations/global/recognizers/_","streamingConfig":{"config":{"autoDecodingConfig":{},"languageCodes":["en-US"]}}},{"audio":"<base64-audio-chunk>"}], response_file="/approved/grpc/speech-response.ndjson", stream_interval_ms=100, stream_max_messages=64, stream_timeout_seconds=60). Supply the descriptor set as an operator-approved build artifact sourced from the official protobuf definitions; the MCP server itself does not run a compiler or CLI. ProtoJSON encodes 64-bit integers as decimal strings and bytes as Base64 according to the official mapping.

Firestore Listen and Cloud Logging TailLogEntries are long-lived read observations and use the same required bounds. Pub/Sub StreamingPull remains mutation-gated because later request messages can acknowledge delivery or modify ack deadlines.

Example bounded, resumable tool-call session: gcp_api_mutate(auth_scheme="vertex-live-ws", service="aiplatform", operation="BidiGenerateContent", project="<project>", region="global", method="GET", url="wss://aiplatform.googleapis.com/ws/google.cloud.aiplatform.v1beta1.LlmBidiService/BidiGenerateContent", body={"messages":[{"setup":{"model":"projects/<project>/locations/global/publishers/google/models/<live-model>","generationConfig":{"responseModalities":["TEXT"]},"tools":[{"functionDeclarations":[{"name":"lookup_weather","description":"Look up approved weather data","parameters":{"type":"OBJECT","properties":{"city":{"type":"STRING"}}}}]}]}},{"clientContent":{"turns":[{"role":"user","parts":[{"text":"Weather in Singapore?"}]}],"turnComplete":true}}],"tool_handlers":[{"name":"lookup_weather","response":{"temperature":31,"unit":"celsius"},"max_calls":1}],"resume_on_go_away":true,"max_reconnects":2,"max_messages":32,"timeout_seconds":30}, response_file="<approved-root>/vertex-live.ndjson", force=true). The gateway obtains ADC before every Upgrade, keeps the Bearer token and resumption handle internal, waits for setupComplete, validates every server JSON message, and atomically publishes only a bounded sanitized transcript. It never accepts a caller token, API key, header, query, custom host, session handle, or unbounded workflow.

Credentials

Use Application Default Credentials, workload identity, service-account impersonation, or an attached service account. If a credential file is required, set GOOGLE_APPLICATION_CREDENTIALS only in the MCP server environment; never pass its contents through MCP.

Read references/official-docs.md for ADC, REST authentication, gRPC-over-HTTP/2, FileDescriptorSet/ProtoJSON, Vertex Live WSS, discovery, and asset inventory.