Google and Google Cloud services can be used in your AI applications with enterprise-ready governance, security, and access control through our remote Model Context Protocol (MCP) servers.
MCP is an open source protocol developed by Anthropic that standardizes how AI applications connect to data sources. Our MCP servers support version 2026-07-28 of MCP.
In addition to offering remote MCP servers, Google Cloud offers several solutions for publishing your own MCP servers. Users connect to published MCP servers over HTTP and can authenticate and interact with them according to the MCP specification. For more information, see MCP server publishing.
How MCP works
MCP lets an AI application communicate with external services through a standardized set of components:
- MCP server
- A program that exposes capabilities of a service, like an API or database, to AI applications through standardized MCP interfaces.
- MCP host
- The main AI application that you're using or building—for example, Claude, VS Code, Gemini CLI, or Cursor IDE.
- MCP client
- A software component within the MCP host that handles communication between your AI application and the MCP server.
Local versus remote MCP servers
Local MCP servers typically run on your local machine and use the standard input and output streams (stdio) for communication between services on the same device.
Remote MCP servers run on the service's infrastructure and offer an HTTP endpoint to AI applications for communication between the AI MCP client and the MCP server.
For more information, see MCP architecture.
Stateless core
With
MCP version 2026-07-28,
MCP changes from a bidirectional, stateful protocol to a stateless protocol.
Each MCP request is self-describing and can be routed using headers. There isn't
a need for the initialize/initialized handshake or Mcp-Session-Id because
each request includes all the information needed in HTTP headers or the _meta
parameter. MCP servers can request additional information required by a tool
through multi-round-trip requests (MRTR).
To help route and process requests without parsing the request body, some MCP headers are required, including the following:
- Headers that are required by the MCP specification such as the protocol version header and standard request headers.
- Custom headers that are defined by the MCP server. These
headers are mirrored into HTTP headers from the tool's input schema using
the
x-mcp-headerproperty. For example, an MCP server might define a custom header to specify the Google Cloud region or project ID.
For more information about MCP architecture, see the MCP version 2026-07-28 specification and key changes.
Google and Google Cloud remote MCP servers
Google and Google Cloud remote MCP servers have the following features and benefits:
- MCP discovery: Once a server is configured for use in your project, AI
applications can discover the server's capabilities, like tools, prompts,
and resources, by using MCP discovery methods like
tools/list,prompts/list, andresources/list. You can manage MCP servers in Agent Registry. - Toolsets: Select a specific toolset from an MCP server to prevent overloading your agent's context with too many tools.
- Administrative controls: Control MCP use with Identity and Access Management (IAM) policies.
- Authentication and Authorization: Google and Google Cloud remote MCP servers are compliant with the MCP authorization specification. Only agents, MCP clients, and end-users with established identities can authenticate and use MCP tools, prompts, and resources.
- Fine-grained authorization policies: Use IAM to control who can do what on which Google Cloud resources with MCP tools, prompts, and resources.
- Model Armor: Scan MCP calls and responses to help protect against security risks and enforce your AI security policies.
For a list of Google and Google Cloud remote MCP servers, see Supported products.
MCP server features
MCP servers support the following features:
- Tools: Let AI take actions like calling APIs.
- Prompts: Predefined inputs provided by MCP servers that can help users interact with tools more effectively—you can use prompts provided by a server, but you can't define your own.
- Resources: Allow servers to share data that provides context to language models, such as files, database schemas, or application-specific information.
- Elicitation: When supported by the MCP client, MCP servers can request additional information from the user to help fulfill a request.
For more information, see Manage MCP servers.
Extensions
Beyond the core MCP specifications, individual Google and Google Cloud MCP servers might support the following extensions:
- MCP Apps: Sandboxed interactive UI elements that render inside a conversation. For more information, see MCP Apps.
Authentication
To authenticate to Google and Google Cloud MCP servers that require authentication, use your Google credentials or create an identity for your AI application. For more information, see Authenticate to MCP servers.
Control access with Identity and Access Management
Identity and Access Management (IAM) deny policies help you secure Google Cloud MCP servers. For more information, see Control MCP use with IAM.
Toolsets
Agents can become slow, confused, and expensive to run when you load too many tools into context. To help you limit the tools available to your agent, some Google and Google Cloud MCP servers offer logical groups of MCP tools called toolsets. Each toolset has its own HTTP endpoint and functions as a virtual MCP server. You can configure a toolset the same way that you configure an MCP server. For more information about configuring MCP servers, see Configure MCP in an AI application.
To determine if an MCP server offers toolsets, review the server's MCP reference documentation linked from our Supported products page.
MCP apps
MCP apps let you visually interact with data using charts, forms, dashboards, or other interactive elements. MCP app content is published by MCP servers as an MCP resource and is rendered in a sandboxed iframe within your existing agent conversation.
Different MCP servers might offer different MCP app behaviors, but the following benefits apply to all MCP apps:
- MCP apps can call any MCP tool within the MCP server, and can dynamically update with fresh information sent from the MCP server.
- MCP apps can ask to use capabilities and tools that you've configured in addition to MCP tools offered by the MCP server.
- MCP apps run in a sandboxed iframe controlled by your host application, which is designed to restrict access to the parent window, local storage, and cookies. Your host application also controls which tools an MCP app can use.
Model Armor considerations for MCP apps
Because Model Armor doesn't scan MCP resource/read calls that are
made to render an MCP app, the content of the MCP app resource isn't scanned.
However, any tool calls made through the MCP app are still scanned by
Model Armor if it's enabled. You can consider the content of an MCP app
to be trusted because it's published by a Google or Google Cloud MCP server that
you've configured.
For more information about MCP apps, see the MCP specification for MCP apps.
Model Armor protection
Model Armor helps secure your agentic AI applications by sanitizing MCP requests and responses. This process helps mitigate risks such as prompt injection, sensitive data disclosure, and tool poisoning.
To view a list of MCP servers that support Model Armor, see Model Armor supported products. To enable Model Armor for MCP endpoints, see Configure Model Armor protection for Google Cloud MCP servers.
MCP Publishing
If you want to create and publish your own MCP server for other people to use, then you can use the following MCP publishing options, depending on your needs:
- Apigee users with an existing API can publish their API as an MCP server.
- Developers who want to create their own MCP server can host it on Cloud Run.