> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/agentic-gateway/mcp-server/gcp/iam.md).

# IAM MCP server

The **IAM** MCP server is a predefined [GCP MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server/gcp.md) that exposes the Google Cloud Identity and Access Management (IAM) API to agents. Its tools both read and change IAM: agents can inspect service accounts, keys, and roles, and can also create, modify, and delete them. Because Google does not host an MCP server for IAM, this is a P0-built server that implements its tools directly against the IAM API behind the [P0 AI Gateway](/readme/agentic-control-plane.md).

Agents request access by IAM role (for example, `iam.serviceAccountViewer`), scoped to a project and a business justification. They never hold Google Cloud credentials: the gateway obtains a short-lived, policy-scoped token for each session using Workload Identity Federation.

{% hint style="info" %}
The IAM MCP server is a preview feature. Contact P0 to enable it for your organization.
{% endhint %}

Before you start, complete the [GCP MCP server prerequisites](/integrations/resource-integrations/agentic-gateway/mcp-server/gcp.md#prerequisites).

## What the tools can change

Many of this server's tools change IAM, not just read it:

* **Service accounts.** Create, update, delete, undelete, disable, and enable them.
* **Service account keys.** Upload, delete, disable, and enable them.
* **Custom roles.** Create, update, delete, and undelete them.
* **Service account IAM policy.** Set the policy that controls who may impersonate an account.

Two of these deserve particular care. Uploading a service account key creates a long-lived credential, and setting a service account's IAM policy changes who is allowed to act as that account.

What an agent can actually do is bounded by the IAM role it holds for the session, not by the list of tools. Every agent sees the same tools. Against a read-only role such as `iam.serviceAccountViewer`, the tools that change IAM are still listed, but each call fails. Against a role such as `iam.serviceAccountAdmin`, they succeed. So the role you approve in your [agentic access policies](/access-management/just-in-time-access/access-policies/agentic-access-policies.md) is what limits an agent, and a policy written on the assumption that this server is read-only will grant more than it appears to.

## Configure the IAM MCP server

1. Follow the shared steps in [Add an MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server.md#add-an-mcp-server) to name the server and choose its gateway. On the configuration screen, set the following fields, then click **Finish**:
   * **Credential source**: choose **GCP WIF federation**, then select the **Federation provider**: the GCP Workload Identity Federation identity you installed. The gateway uses this identity's audience when it federates to Google Cloud, and the provider's trust configuration authorizes it.
   * **Definition**: choose **P0**, then select **Google Cloud IAM** as the predefined server identifier.
2. The server now appears with the state **Installed**.

Once saved, P0 pushes the server definition to the gateway on its next sync, and the IAM MCP server becomes available to agents through the gateway URL. Access is granted per session and governed by your P0 policy; no long-lived Google Cloud credentials are issued.

## Next steps

* Define the MCP roles and policies that determine which agents and users may call the IAM MCP server, and what they may do in Google Cloud IAM.