> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/mcp-server/gcp.md).

# GCP

Install the predefined GCP MCP servers behind the P0 AI Gateway, giving agents policy-scoped, credential-free access to Google Cloud APIs.

The **GCP** MCP servers are predefined servers that expose Google Cloud APIs to P0-managed agents behind the AI gateway, part of [P0 Runtime Access for AI](/readme/agentic-control-plane.md). Each server is wired up with P0's access controls. P0 ships one server per Google Cloud service, so you install only the services your agents need.

Agents call these services without ever holding Google Cloud credentials: the gateway obtains a short-lived, policy-scoped token for each session using Workload Identity Federation, backed by a [GCP Workload Identity Federation](/agentic-access/credential-sources/gcp-wif.md) provider. Access is granted per session and governed by your P0 policy; no long-lived Google Cloud credentials are issued.

## Available servers

| Server                                                                           | Exposes                                                               |
| -------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| [Compute Engine](/agentic-access/agentic-gateway/mcp-server/gcp/compute.md)      | Compute Engine resources such as VM instances, disks, and networks.   |
| [Cloud Storage](/agentic-access/agentic-gateway/mcp-server/gcp/storage.md)       | Cloud Storage buckets and objects.                                    |
| [BigQuery](/agentic-access/agentic-gateway/mcp-server/gcp/bigquery.md)           | BigQuery datasets, tables, and jobs.                                  |
| [Cloud Monitoring](/agentic-access/agentic-gateway/mcp-server/gcp/monitoring.md) | Cloud Monitoring metrics, alerting policies, and dashboards.          |
| [IAM](/agentic-access/agentic-gateway/mcp-server/gcp/iam.md)                     | Identity and Access Management service accounts, roles, and policies. |

## Prerequisites

Every GCP MCP server shares the same prerequisites:

* A registered [Gateway](/agentic-access/agentic-gateway/gateway.md) component, with the gateway deployed in your environment.
* A [GCP Workload Identity Federation](/agentic-access/credential-sources/gcp-wif.md) provider installed on the Google Cloud project you want agents to reach. This provides the federated identity each GCP MCP server uses as its credential provider. It requires the base [Google Cloud](/integrations/resource-integrations/google-cloud.md) with IAM management installed on the same project.

## Configure a GCP MCP server

Every GCP MCP server follows the shared [MCP server](/agentic-access/agentic-gateway/mcp-server.md#add-an-mcp-server) flow. On the configuration screen you choose **GCP WIF federation** as the credential source and select the predefined definition for the service you want.

{% hint style="info" %}
A Federation provider maps one-to-one to a single Google Cloud project. To give agents access to more than one project, configure a separate MCP server for each project, using that project's GCP Workload Identity Federation provider as its Federation provider.
{% endhint %}

The service-specific configuration and the roles agents can request differ by server. Continue to the page for the server you are installing:

* [Compute Engine](/agentic-access/agentic-gateway/mcp-server/gcp/compute.md)
* [Cloud Storage](/agentic-access/agentic-gateway/mcp-server/gcp/storage.md)
* [BigQuery](/agentic-access/agentic-gateway/mcp-server/gcp/bigquery.md)
* [Cloud Monitoring](/agentic-access/agentic-gateway/mcp-server/gcp/monitoring.md)
* [IAM](/agentic-access/agentic-gateway/mcp-server/gcp/iam.md)

## Next steps

* Define the [Agentic access policies](/policy-studio/policy-studio/agentic-access-policies.md) that determine which agents and users may call each GCP MCP server, and what they may do in Google Cloud.