MCP Tools Reference: auditmanager.googleapis.com

Tool: enroll_resource

Enrolls a project in Audit Manager. This enables auditing capabilities and allows specifying eligible Cloud Storage buckets (eg. gs://...) where generated reports can be uploaded. Format: 'projects/{project}/locations/{location}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen Regional Endpoint (REP) region (e.g., us-central1).

The following code sample shows how to use curl to call the enroll_resource MCP tool.

Curl Request 
curl --location 'https://auditmanager.us-central1.rep.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "enroll_resource",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for EnrollResource.

EnrollResourceRequest

JSON representation 
{
  "scope": string,
  "destinations": [
    {
      object (EligibleDestination)
    }
  ]
}
Fields
scope

string

Required. Organization, folder, or project to enroll in Audit Manager, in one of the following formats:

  • projects/{project}/locations/{location}
  • folders/{folder}/locations/{location}
  • organizations/{organization}/locations/{location}
destinations[]

object (EligibleDestination)

Required. Cloud Storage buckets that you can upload your audit reports to during the audit process.

When you enroll an organization or folder, you can choose a Cloud Storage bucket from any project in the organization or folder. If you run an audit at the project level using the service agent at the organization or folder level, all the buckets that are associated with the service agent are available.

EligibleDestination

JSON representation 
{

  // Union field eligible_destinations can be only one of the following:
  "eligibleGcsBucket": string
  // End of list of possible types for union field eligible_destinations.
}
Fields
Union field eligible_destinations. Available Cloud Storage buckets. eligible_destinations can be only one of the following:
eligibleGcsBucket

string

The location of the Cloud Storage bucket where you want to upload the audit report and evidence during the GenerateAuditReport API call.

Output Schema

Organization, folder, or project to enroll for audit reports.

Enrollment

JSON representation 
{
  "name": string,
  "destinationDetails": [
    {
      object (DestinationDetails)
    }
  ]
}
Fields
name

string

Identifier. Name of the enrollment, in one of the following formats:

  • projects/{project}/locations/{location}/enrollments/{enrollment}
  • folders/{folder}/locations/{location}/enrollments/{enrollment}
  • organizations/{organization}/locations/{location}/enrollments/{enrollment}
destinationDetails[]

object (DestinationDetails)

Output only. Cloud Storage buckets where you want to upload the audit reports.

DestinationDetails

JSON representation 
{

  // Union field destination can be only one of the following:
  "gcsBucketUri": string
  // End of list of possible types for union field destination.
}
Fields
Union field destination. The specific destination where the audit report and evidence are stored. destination can be only one of the following:
gcsBucketUri

string

URI for the Cloud Storage bucket, in the format gs://{bucket_name}.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ❌ | Open World Hint: ❌