Set up App Topology

Since App Topology correlates data across multiple Google Cloud services, the App Topology and the services that provide data to App Topology must be enabled.

1. Identify the Google Cloud project where you want to set up App Topology.

   • Security and compliance data provided by Security Command Center is only available for projects and applications in a Google Cloud organization. If you want to migrate a project to an organization, see the migration instructions
   • If you set up an app-enabled folder for App Hub applications, enable APIs and grant permissions described in these instructions on the folder's management project.

2. Set up the services that provide the resource data that you want to query:

   • To view software supply chain data such as build provenance, configure Developer Connect insights.

   • To view security and compliance data, set up Security Command Center for security and compliance data. Activate Security Command Center at the organization level and configure the features that you want to use. Querying data from Security Command Center is only available for Premium and Enterprise tiers.

3. To view data for agent resources, register your agent resources and instrument your AI applications.

   • Set up Agent Registry and register your agents, endpoints, MCP servers, and AI applications.
   • instrument your AI applications.

4. Enable the App Topology, Cloud Asset Inventory, and Observability APIs, if any are not already enabled:

   Roles required to enable APIs

   To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

   gcloud services enable cloudasset.googleapis.com  apptopology.googleapis.com observability.googleapis.com 

5. Verify that billing is enabled for your Google Cloud project.

6. If you are protecting services in a VPC Service Controls perimeter, update the perimeter to include App Topology and services that provide underlying data. Learn more.

What's next

• Use the App Topology MCP server.