Cloud Storage MCP server

Install the predefined Cloud Storage MCP server behind the P0 AI Gateway, giving agents policy-scoped, credential-free access to the Google Cloud Storage API.

The Cloud Storage MCP server is a predefined GCP MCP server that exposes the Google Cloud Storage API to agents, so they can work with buckets and objects. It runs P0's Google Cloud MCP image behind the P0 AI Gateway and bridges to Google's hosted Cloud Storage MCP endpoint.

Agents can request Cloud Storage access two ways, and they never hold Google Cloud credentials: the gateway obtains a short-lived, policy-scoped token for each session using Workload Identity Federation.

• Resource-scoped access to a single bucket, with a role such as storage.objectViewer for read-only access or storage.objectUser for read/write access. Prefer this, since it grants the least access.

• Project-wide access across every resource in the project, with a role such as storage.objectViewer. Use this only when the calling tools must span multiple resources.

The Cloud Storage MCP server is a preview feature. Contact P0 to enable it for your organization.

Before you start, complete the GCP MCP server prerequisites.

Configure the Cloud Storage MCP server

1. Follow the shared steps in Add an MCP server to name the server, choose its gateway, and set its path. On the configuration screen, set the following fields, then click Finish:

   • Credential source: choose GCP WIF federation, then select the Federation provider: the GCP Workload Identity Federation identity you installed. The gateway uses this identity's audience when it federates to Google Cloud, and the provider's trust configuration authorizes it.

   • Definition: choose P0, then select Google Cloud Storage as the predefined server identifier.

2. The server now appears with the state Installed.

Once saved, P0 pushes the server definition to the gateway on its next sync, and the Cloud Storage MCP server becomes available to agents through the gateway URL. Access is granted per session and governed by your P0 policy; no long-lived Google Cloud credentials are issued.

Next steps

• Define the MCP roles and policies that determine which agents and users may call the Cloud Storage MCP server, and what they may do in Cloud Storage.