> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/mcp-server/gcp/monitoring.md).

# Cloud Monitoring

Install the predefined Cloud Monitoring MCP server behind the P0 AI Gateway, giving agents policy-scoped, credential-free access to the Google Cloud Monitoring API.

The **Cloud Monitoring** MCP server is a predefined [GCP](/agentic-access/agentic-gateway/mcp-server/gcp.md) that exposes the Google Cloud Monitoring API to agents, so they can query metrics and time series and inspect alerting policies and dashboards. It runs P0's Google Cloud MCP image behind the AI gateway, part of [P0 Runtime Access for AI](/readme/agentic-control-plane.md), and bridges to Google's hosted Cloud Monitoring MCP endpoint.

Agents request access by Cloud Monitoring IAM role (for example, `monitoring.viewer`), scoped to a project and a business justification. They never hold Google Cloud credentials: the gateway obtains a short-lived, policy-scoped token for each session using Workload Identity Federation.

Before you start, complete the [GCP](/agentic-access/agentic-gateway/mcp-server/gcp.md#prerequisites).

## Configure the Cloud Monitoring MCP server

1. Follow the shared steps in [MCP server](/agentic-access/agentic-gateway/mcp-server.md#add-an-mcp-server) to name the server and choose its gateway. On the configuration screen, set the following fields, then click **Finish**:
   * **Credential source**: choose **GCP WIF federation**, then select the **Federation provider**: the GCP Workload Identity Federation identity you installed. The gateway uses this identity's audience when it federates to Google Cloud, and the provider's trust configuration authorizes it.
   * **Definition**: choose **P0**, then select **Google Cloud Monitoring** as the predefined server identifier.
2. The server now appears with the state **Installed**.

Once saved, P0 pushes the server definition to the gateway on its next sync, and the Cloud Monitoring MCP server becomes available to agents through the gateway URL. Access is granted per session and governed by your P0 policy; no long-lived Google Cloud credentials are issued.

## Next steps

* Define the [Agentic access policies](/policy-studio/policy-studio/agentic-access-policies.md) that determine which agents and users may call the Cloud Monitoring MCP server, and what they may do in Cloud Monitoring.