> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/agentic-gateway/mcp-server/gcp/compute.md).

# Compute Engine MCP server

The **Compute Engine** MCP server is a predefined [GCP MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server/gcp.md) that exposes the Google Cloud Compute Engine API to agents, so they can inspect and manage Compute Engine resources such as VM instances, disks, and networks. It runs P0's Google Cloud MCP image behind the [P0 AI Gateway](/readme/agentic-control-plane.md) and bridges to Google's hosted Compute Engine MCP endpoint.

Agents can request Compute Engine access two ways, and they never hold Google Cloud credentials: the gateway obtains a short-lived, policy-scoped token for each session using Workload Identity Federation.

* **Resource-scoped** access to a single VM instance, with a role such as `compute.instanceAdmin.v1`. This is preferred, since it grants the least access.
* **Project-wide** access across every resource in the project, with a role such as `compute.viewer`. Use this only when the calling tools must span multiple resources.

{% hint style="info" %}
The Compute Engine MCP server is a preview feature. Contact P0 to enable it for your organization.
{% endhint %}

Before you start, complete the [GCP MCP server prerequisites](/integrations/resource-integrations/agentic-gateway/mcp-server/gcp.md#prerequisites).

## Configure the Compute Engine MCP server

1. Follow the shared steps in [Add an MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server.md#add-an-mcp-server) to name the server and choose its gateway. On the configuration screen, set the following fields, then click **Finish**:
   * **Credential source**: choose **GCP WIF federation**, then select the **Federation provider**: the GCP Workload Identity Federation identity you installed. The gateway uses this identity's audience when it federates to Google Cloud, and the provider's trust configuration authorizes it.
   * **Definition**: choose **P0**, then select **Google Cloud Compute** as the predefined server identifier.
2. The server now appears with the state **Installed**.

Once saved, P0 pushes the server definition to the gateway on its next sync, and the Compute Engine MCP server becomes available to agents through the gateway URL. Access is granted per session and governed by your P0 policy; no long-lived Google Cloud credentials are issued.

## Next steps

* Define the MCP roles and policies that determine which agents and users may call the Compute Engine MCP server, and what they may do in Compute Engine.