Google Cloud MCP servers roles and permissions

This page lists the IAM roles and permissions for Google Cloud MCP servers. To search through all roles and permissions, see the role and permission index.

Google Cloud MCP servers roles

Role	Permissions
MCP Admin (roles/mcp.admin) Full access for interacting with Google-managed MCP servers.	mcp.tools.call resourcemanager.projects.get resourcemanager.projects.list
MCP Tool User (roles/mcp.toolUser) Gives permission to call tools on any MCP server enabled by the parent project.	mcp.tools.call resourcemanager.projects.get resourcemanager.projects.list

Google Cloud MCP servers permissions

Permission

Included in roles

mcp.tools.call

Owner (roles/owner) Editor (roles/editor) Gemini Cloud Assist Admin (roles/geminicloudassist.admin) Gemini Cloud Assist Editor (roles/geminicloudassist.editor) Gemini Cloud Assist User (roles/geminicloudassist.user) MCP Admin (roles/mcp.admin) MCP Tool User (roles/mcp.toolUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Chronicle Service Agent (roles/chronicle.serviceAgent)