GCP MCP server
Install the predefined GCP MCP servers behind the P0 AI Gateway, giving agents policy-scoped, credential-free access to Google Cloud APIs.
The GCP MCP servers are predefined servers that expose Google Cloud APIs to P0-managed agents behind the P0 AI Gateway, each wired up with P0's access controls. P0 ships one server per Google Cloud service, so you install only the services your agents need.
Agents call these services without ever holding Google Cloud credentials: the gateway obtains a short-lived, policy-scoped token for each session using Workload Identity Federation, backed by a GCP Workload Identity Federation provider. Access is granted per session and governed by your P0 policy; no long-lived Google Cloud credentials are issued.
The GCP MCP servers are a preview feature. Contact P0 to enable them for your organization.
Available servers
Compute Engine resources such as VM instances, disks, and networks.
Cloud Storage buckets and objects.
BigQuery datasets, tables, and jobs.
Cloud Monitoring metrics, alerting policies, and dashboards.
Identity and Access Management service accounts, roles, and policies.
Prerequisites
Every GCP MCP server shares the same prerequisites:
A registered Gateway component, with the gateway deployed in your environment.
A GCP Workload Identity Federation provider installed on the Google Cloud project you want agents to reach. This provides the federated identity each GCP MCP server uses as its credential provider. It requires the base Google Cloud integration with IAM management installed on the same project.
Configure a GCP MCP server
Every GCP MCP server follows the shared Add an MCP server flow. On the configuration screen you choose GCP WIF federation as the credential source and select the predefined definition for the service you want.
A Federation provider maps one-to-one to a single Google Cloud project. To give agents access to more than one project, configure a separate MCP server for each project, using that project's GCP Workload Identity Federation provider as its Federation provider.
The service-specific configuration and the roles agents can request differ by server. Continue to the page for the server you are installing:
Next steps
Define the MCP roles and policies that determine which agents and users may call each GCP MCP server, and what they may do in Google Cloud.
Last updated