# Google Cloud > Operate or inspect Google Cloud resources through cloud-skills-mcp and authenticated googleapis.com REST, Artifact Registry or gcr.io OCI HTTP, raw gRPC over HTTP/2, bounded Vertex Live WebSockets, or Firebase Realtime Database SSE. Use for GCP, Artifact Registry, gcr.io, Firebase Database, Compute Engine, Cloud Storage, IAM, GKE, Cloud SQL, BigQuery, Cloud Run, Speech streaming, Vertex or Gemini Live, or any documented Google Cloud API. - Skill: `tttboy123/google-cloud` (Agent Skill, multi-file: 4 files) - Install (CLI): `npx skillmds@latest add tttboy123/google-cloud` - Raw SKILL.md: https://api.skillmd.com/api/skills/tttboy123/google-cloud/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tttboy123 (https://skillmd.com/u/tttboy123) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tttboy123/google-cloud --- # Google Cloud Use the unified MCP server for authenticated Google Cloud REST APIs, Artifact Registry and `gcr.io` OCI Distribution HTTP, finite gRPC request streams carried directly over HTTP/2, bounded Vertex/Gemini Live WSS sessions, and finite Firebase Realtime Database SSE observations. gRPC supports both raw framed protobuf and descriptor-driven ProtoJSON conversion. The gateway accepts only exact official Google API, Registry, or Firebase Database endpoints and gets access tokens from the official Google Auth ADC chain. It never executes gcloud, Docker, a credential helper, grpcurl, protoc, or any other CLI at runtime. ## Workflow 1. Call `cloud_provider_status` with `provider="gcp"`; treat `available` as adapter readiness and `credential_status=unverified` as pending live authentication. 2. Use `gcp_api_discover(service=, operation=)` to read the public Google Discovery document when REST transcoding is available; for gRPC-only methods use the official RPC reference and protobuf definitions. 3. Use `gcp_api_read` for REST `GET`, `HEAD`, or `OPTIONS`. With `auth_scheme="grpc"`, read-like RPC names such as `Get`, `List`, `Recognize`, and `StreamingRecognize` are conservatively accepted even though gRPC itself uses HTTP `POST`. Exact official Firestore `Listen` and Cloud Logging `TailLogEntries` paths are also read-only; lookalike `Listen` methods are not. 4. Artifact Registry and Artifact Registry-backed `gcr.io` repositories use `gcp_api_read(auth_scheme="artifact-registry", service="artifact-registry", ...)` for OCI Distribution reads. The server applies ADC Bearer only to an exact `-docker.pkg.dev` or supported `gcr.io` host. Writes use the mutation gate; upload bodies must be monolithic because Google does not support Docker chunked `PATCH` uploads. 5. Firebase Realtime Database listeners use `gcp_api_read(auth_scheme="firebase-sse", service="firebase-database", operation="Listen", method="GET")`, an exact official `.json` URL, a bounded plan, and `response_file`. The server requests the two documented Firebase OAuth scopes internally and never accepts `auth`, `access_token`, or headers from the caller. 6. Vertex/Gemini Live uses `auth_scheme="vertex-live-ws"` and always requires `gcp_api_mutate(force=true)` because it starts a paid stateful session. In addition to caller-prepared official client messages, bounded `tool_handlers` can answer server-generated function-call IDs and the resumable mode can reconnect without exposing its session handle. 7. For REST `POST`, `PUT`, `PATCH`, or `DELETE`, Registry writes, and any gRPC method not classified as read-like, obtain explicit human approval for the project, URL, method, request messages, resources, and effect; then use `gcp_api_mutate(force=true)`. 8. Secret-resource operations require the separate sensitive gate. IAM Credentials, STS/token exchange, service-account private-key creation, API-key export, and sign-in token endpoints are never exposed by the gateway. 9. Never pass OAuth tokens, API keys, signed URL parameters, cookies, or authorization headers. ## MCP arguments - `method` and `url`: exact documented Google API or Registry request. - `project`: optional quota/billing project, sent as `X-Goog-User-Project`. - `headers`: non-credential conditional or product headers. - `body`: JSON-compatible request body. - `body_file`: binary/media upload body under an operator-approved `CLOUD_SKILLS_ALLOWED_FILE_ROOTS` directory. Do not combine it with `body`; use resumable/chunk upload APIs above 64 MiB. - `response_file`: new approved-root file for media downloads, exports, or other large responses. Use the official `Range` header above the configured per-call limit; existing files are never overwritten. - `auth_scheme="artifact-registry"`: exact `-docker.pkg.dev/v2////...` or `gcr.io|us.gcr.io|eu.gcr.io|asia.gcr.io/v2///...` OCI Distribution request. Version, manifest, blob, tags, referrers, cross-repository mount, and monolithic upload paths are method-checked before ADC resolution. A `202` single-POST upload fallback is completed internally with one full-body PUT to the exact same-origin provider Location; the Location capability never leaves the server. `/v2/token`, `_catalog`, caller Authorization, and chunked `PATCH` uploads are rejected. - `auth_scheme="firebase-sse"`: exact `https://.firebaseio.com/.json`, `https://.europe-west1.firebasedatabase.app/.json`, or `https://.asia-southeast1.firebasedatabase.app/.json`. `body` requires `max_events=1..256` and `timeout_seconds=1..300`; `include_keep_alive` is optional. `parameters` may contain the documented `orderBy`, `limitToFirst`, `limitToLast`, `startAt`, `endAt`, and `equalTo` query filters. The server manually validates at most three required 307 redirects, preserves the exact path/query, and atomically publishes only sanitized `put`, `patch`, and optionally `keep-alive` NDJSON. - `auth_scheme="grpc"` raw mode: direct HTTP/2 gRPC. `method` must be `POST`; `url` must be `https://.googleapis.com//`; `body_file` contains one or more standard uncompressed gRPC records (`0x00` plus a four-byte big-endian protobuf length plus the serialized protobuf message); and `response_file` receives the same validated raw framed-protobuf response. Do not set `Content-Type`, `TE`, or any `grpc-*` protocol header. - `auth_scheme="grpc", payload_mode="protobuf-json"`: schema-driven direct HTTP/2 gRPC. Set `protobuf_descriptor_file` to a binary `google.protobuf.FileDescriptorSet` under an approved root. It must contain the exact service/method named by the URL and all imported descriptors. Use one ProtoJSON object in `body` for unary/server-streaming RPCs or 1–256 objects for client/bidirectional streams; the gateway derives input/output message types from the method descriptor, rejects unknown request fields, emits deterministic protobuf frames, rejects unknown response wire fields at any nested level, and atomically writes official ProtoJSON NDJSON. A unary response must contain exactly one message. For every descriptor-declared server stream, set `stream_max_messages` (1–256) and `stream_timeout_seconds` (1–300); the message bound or a timeout while waiting between complete response frames ends the observation successfully, while a partial frame or any already-known nonzero `grpc-status` aborts publication. The descriptor remains local and is never sent to Google. - `auth_scheme="vertex-live-ws"`: exact official `wss://aiplatform.googleapis.com` global endpoint, `-aiplatform.googleapis.com` regional endpoint, or `aiplatform.us|eu.rep.googleapis.com` multi-region endpoint with the `v1beta1.LlmBidiService/BidiGenerateContent` path. Set `service="aiplatform"`, `operation="BidiGenerateContent"`, `project`, `region`, method `GET`, a bounded `body` message plan, and `response_file`. The first message is the only `setup` and its fully qualified publisher model must match the project/location; later messages use exactly one of `clientContent`, `realtimeInput`, or a caller-prepared `toolResponse`. Set `max_messages` and `timeout_seconds` to 2–256 and 1–300 respectively. - `tool_handlers`: optional list of 1–64 deterministic, credential-free response templates. Each entry has an official function `name`, a JSON-object `response`, and `max_calls` from 1–32. When the server sends `toolCall.functionCalls[]`, the gateway matches the exact name, copies the provider-generated `id` into `toolResponse.functionResponses[]`, and decrements the bound atomically. Unknown names, duplicate IDs, or an exhausted handler fail the session without publishing its output. This dispatcher returns pre-approved data; it does not execute arbitrary local commands or cloud mutations. - `resume_on_go_away=true` plus `max_reconnects=1..8`: enables transparent recovery after `goAway` or an unexpected transport close. The gateway injects `sessionResumption.transparent=true`, retains `newHandle` only in memory, prunes acknowledged buffered messages using `lastConsumedClientMessageIndex`, reacquires ADC for each Upgrade, and replays only the unacknowledged suffix. Caller-supplied handles are forbidden and `newHandle` is removed from the NDJSON transcript. - `stream_interval_ms`: optional delay between complete gRPC request messages or between post-setup Vertex Live JSON messages. Framed messages must not be split, so `stream_chunk_bytes` is forbidden. `stream_max_messages` and `stream_timeout_seconds` are accepted only by descriptor-driven server streams and are never silently applied to another transport. Observe product limits in the official reference; Speech-to-Text v2 limits each streaming audio request message to 15 KB. Example read: `gcp_api_read(method="GET", url="https://compute.googleapis.com/compute/v1/projects//aggregated/instances", project="")`. Example Artifact Registry read: `gcp_api_read(auth_scheme="artifact-registry", service="artifact-registry", operation="ListTags", method="GET", url="https://us-west1-docker.pkg.dev/v2////tags/list", parameters={"n":20}, project="")`. Example bounded Firebase listener: `gcp_api_read(auth_scheme="firebase-sse", service="firebase-database", operation="Listen", method="GET", url="https://.europe-west1.firebasedatabase.app/messages.json", parameters={"orderBy":"\"createdAt\"","limitToLast":10}, body={"max_events":32,"timeout_seconds":30}, response_file="/firebase-events.ndjson")`. Example finite Speech-to-Text v2 stream: `gcp_api_read(auth_scheme="grpc", service="speech", operation="StreamingRecognize", method="POST", url="https://speech.googleapis.com/google.cloud.speech.v2.Speech/StreamingRecognize", project="", headers={"x-goog-request-params":"recognizer=projects//locations/global/recognizers/_"}, body_file="/approved/grpc/speech-request.grpc", response_file="/approved/grpc/speech-response.grpc", stream_interval_ms=100)`. The first Speech v2 message contains the recognizer/configuration required by the RPC contract and later messages contain audio only. The gateway validates framing, authenticates the HTTP/2 request, checks response framing and `grpc-status`, and atomically publishes the response file; protobuf construction and decoding remain driven by the official service schema rather than guessed JSON transcoding. Schema-driven equivalent: `gcp_api_read(auth_scheme="grpc", payload_mode="protobuf-json", service="speech", operation="StreamingRecognize", method="POST", url="https://speech.googleapis.com/google.cloud.speech.v2.Speech/StreamingRecognize", project="", headers={"x-goog-request-params":"recognizer=projects//locations/global/recognizers/_"}, protobuf_descriptor_file="/approved/schemas/speech-v2.protoset", body=[{"recognizer":"projects//locations/global/recognizers/_","streamingConfig":{"config":{"autoDecodingConfig":{},"languageCodes":["en-US"]}}},{"audio":""}], response_file="/approved/grpc/speech-response.ndjson", stream_interval_ms=100, stream_max_messages=64, stream_timeout_seconds=60)`. Supply the descriptor set as an operator-approved build artifact sourced from the official protobuf definitions; the MCP server itself does not run a compiler or CLI. ProtoJSON encodes 64-bit integers as decimal strings and bytes as Base64 according to the official mapping. Firestore `Listen` and Cloud Logging `TailLogEntries` are long-lived read observations and use the same required bounds. Pub/Sub `StreamingPull` remains mutation-gated because later request messages can acknowledge delivery or modify ack deadlines. Example bounded, resumable tool-call session: `gcp_api_mutate(auth_scheme="vertex-live-ws", service="aiplatform", operation="BidiGenerateContent", project="", region="global", method="GET", url="wss://aiplatform.googleapis.com/ws/google.cloud.aiplatform.v1beta1.LlmBidiService/BidiGenerateContent", body={"messages":[{"setup":{"model":"projects//locations/global/publishers/google/models/","generationConfig":{"responseModalities":["TEXT"]},"tools":[{"functionDeclarations":[{"name":"lookup_weather","description":"Look up approved weather data","parameters":{"type":"OBJECT","properties":{"city":{"type":"STRING"}}}}]}]}},{"clientContent":{"turns":[{"role":"user","parts":[{"text":"Weather in Singapore?"}]}],"turnComplete":true}}],"tool_handlers":[{"name":"lookup_weather","response":{"temperature":31,"unit":"celsius"},"max_calls":1}],"resume_on_go_away":true,"max_reconnects":2,"max_messages":32,"timeout_seconds":30}, response_file="/vertex-live.ndjson", force=true)`. The gateway obtains ADC before every Upgrade, keeps the Bearer token and resumption handle internal, waits for `setupComplete`, validates every server JSON message, and atomically publishes only a bounded sanitized transcript. It never accepts a caller token, API key, header, query, custom host, session handle, or unbounded workflow. ## Credentials Use Application Default Credentials, workload identity, service-account impersonation, or an attached service account. If a credential file is required, set `GOOGLE_APPLICATION_CREDENTIALS` only in the MCP server environment; never pass its contents through MCP. Read [references/official-docs.md](references/official-docs.md) for ADC, REST authentication, gRPC-over-HTTP/2, FileDescriptorSet/ProtoJSON, Vertex Live WSS, discovery, and asset inventory.