// SCAN REPORT

GCP MCP Server

295 tools. 150 can modify or destroy data without limits.

51 destructive tools with no built-in limits. Policy required.

Last updated: 29 Jun 2026

150 can modify or destroy data

145 read-only

295 tools total

Community server · catalogue entry checked 29/06/2026

How to control GCP MCP Server ↓

TOOL MAP

What GCP MCP Server exposes to your agents

Read (145) Write / Execute (99) Destructive / Financial (51)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous GCP MCP Server tools

Financial · Critical gcp_billing_update_project_billing_info Linking or unlinking a billing account to a GCP project directly controls financial obligations and payment routing. Destructive · High gcp_logging_delete_log This tool permanently deletes log entries without the possibility of recovery. Destructive · High gcp_agent_delete_app This tool performs an irreversible deletion operation on a GCP application. Destructive · High gcp_agent_delete_data_store This tool permanently removes a data store, destroying all stored data within it.

150 of GCP MCP Server's 295 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control GCP MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and GCP MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "gcp_billing_update_project_billing_info": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "gcp_agent_delete_app": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "gcp_agent_create_app": {
    "limits": [
      {
        "counter": "gcp_agent_create_app_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "gcp_agent_get_app": {
    "limits": [
      {
        "counter": "gcp_agent_get_app_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register GCP MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON GCP →

Instant setup, no code required.

FULL CATALOGUE

All 295 GCP MCP Server tools

FINANCIAL 1 tools

Financial gcp_billing_update_project_billing_info Link/unlink a project to a billing account

DESTRUCTIVE 50 tools

Destructive gcp_agent_delete_app Delete an Agent Builder application Destructive gcp_agent_delete_data_store Delete a data store Destructive gcp_agent_delete_endpoint Delete a Vertex AI endpoint Destructive gcp_agent_delete_model Delete a Vertex AI model Destructive gcp_agent_delete_reasoning_engine Delete a Reasoning Engine Destructive gcp_appengine_delete_service Delete an App Engine service Destructive gcp_appengine_delete_version Delete an App Engine version Destructive gcp_ar_delete_package Delete a package from a repository Destructive gcp_ar_delete_repository Delete an Artifact Registry repository Destructive gcp_ar_delete_version Delete a package version Destructive gcp_bq_delete_dataset Delete a BigQuery dataset Destructive gcp_bq_delete_table Delete a BigQuery table Destructive gcp_compute_delete_disk Delete a persistent disk Destructive gcp_compute_delete_instance Delete a VM instance Destructive gcp_compute_delete_snapshot Delete a disk snapshot Destructive gcp_compute_detach_disk Detach a disk from a VM instance Destructive gcp_dns_delete_managed_zone Delete a managed zone Destructive gcp_dns_delete_record_set Delete a DNS record set via a change Destructive gcp_firestore_delete_document Delete a Firestore document Destructive gcp_functions_delete Delete a Cloud Function Destructive gcp_gke_delete_cluster Delete a GKE cluster Destructive gcp_gke_delete_node_pool Delete a node pool from a GKE cluster Destructive gcp_iam_delete_custom_role Delete a custom IAM role Destructive gcp_iam_delete_service_account Delete a service account Destructive gcp_iam_delete_service_account_key Delete a service account key Destructive gcp_iam_remove_iam_binding Remove an IAM binding from the project policy Destructive gcp_lb_delete_backend_service Delete a backend service Destructive gcp_lb_delete_forwarding_rule Delete a forwarding rule Destructive gcp_lb_delete_target_pool Delete a target pool Destructive gcp_logging_delete_log Delete all entries for a log name Destructive gcp_logging_delete_sink Delete a logging sink Destructive gcp_monitoring_delete_alert_policy Delete an alert policy Destructive gcp_monitoring_delete_uptime_check Delete an uptime check Destructive gcp_pubsub_delete_subscription Delete a Pub/Sub subscription Destructive gcp_pubsub_delete_topic Delete a Pub/Sub topic Destructive gcp_rm_delete_project Delete (schedule for deletion) a GCP project Destructive gcp_run_delete_revision Delete a Cloud Run revision Destructive gcp_run_delete_service Delete a Cloud Run service Destructive gcp_secrets_delete Delete a secret Destructive gcp_services_disable Disable a GCP API service for the project Destructive gcp_sql_delete_database Delete a database from a Cloud SQL instance Destructive gcp_sql_delete_instance Delete a Cloud SQL instance Destructive gcp_sql_delete_user Delete a user from a Cloud SQL instance Destructive gcp_storage_delete_bucket Delete a Cloud Storage bucket Destructive gcp_storage_delete_object Delete an object from a bucket Destructive gcp_vpc_delete_firewall Delete a firewall rule Destructive gcp_vpc_delete_network Delete a VPC network Destructive gcp_vpc_delete_route Delete a route Destructive gcp_vpc_delete_subnetwork Delete a subnetwork Destructive gcp_vpc_release_address Release a static IP address

EXECUTE 18 tools

Execute gcp_agent_deploy_model Deploy a model to a Vertex AI endpoint Execute gcp_bq_cancel_job Cancel a running BigQuery job Execute gcp_bq_run_query Run a BigQuery SQL query Execute gcp_build_cancel_build Cancel a running Cloud Build build Execute gcp_build_create_build Create and start a new Cloud Build build Execute gcp_build_run_trigger Run a Cloud Build trigger manually Execute gcp_compute_reset_instance Reset (hard reboot) a VM instance Execute gcp_compute_start_instance Start a stopped VM instance Execute gcp_compute_stop_instance Stop a running VM instance Execute gcp_firestore_run_query Run a structured query on Firestore Execute gcp_functions_call Call/invoke a Cloud Function directly Execute gcp_gke_set_network_policy Enable/disable network policy for a cluster Execute gcp_kms_encrypt Encrypt data using a Cloud KMS key Execute gcp_run_execute_job Execute a Cloud Run job Execute gcp_services_batch_enable Enable multiple API services at once Execute gcp_sql_restart_instance Restart a Cloud SQL instance Execute gcp_sql_start_replica Start replication on a read replica Execute gcp_sql_stop_replica Stop replication on a read replica

WRITE 81 tools

Write gcp_agent_create_app Create an Agent Builder application Write gcp_agent_create_data_store Create a data store for Agent Builder Write gcp_agent_create_endpoint Create a Vertex AI endpoint Write gcp_agent_create_reasoning_engine Create a Vertex AI Reasoning Engine Write gcp_agent_import_documents Import documents into a data store Write gcp_appengine_create_app Create an App Engine application Write gcp_ar_create_repository Create a new Artifact Registry repository Write gcp_billing_create_budget Create a budget for a billing account Write gcp_bq_create_dataset Create a new BigQuery dataset Write gcp_bq_create_table Create a new BigQuery table Write gcp_bq_insert_rows Insert rows into a BigQuery table (streaming) Write gcp_bq_update_table Update a BigQuery table schema or metadata Write gcp_build_create_trigger Create a Cloud Build trigger Write gcp_compute_attach_disk Attach a disk to a VM instance Write gcp_compute_create_disk Create a new persistent disk Write gcp_compute_create_instance Create a new Compute Engine VM instance Write gcp_compute_create_snapshot Create a disk snapshot Write gcp_compute_resize_disk Resize a persistent disk (increase only) Write gcp_compute_set_labels Set labels on a VM instance Write gcp_compute_set_machine_type Change machine type of a stopped VM Write gcp_dns_create_managed_zone Create a new DNS managed zone Write gcp_dns_create_record_set Create a DNS record set via a change Write gcp_firestore_create_document Create a new Firestore document Write gcp_firestore_create_index Create a Firestore composite index Write gcp_firestore_export_documents Export Firestore documents to GCS Write gcp_firestore_import_documents Import Firestore documents from GCS Write gcp_firestore_update_document Update a Firestore document Write gcp_functions_create Create a new Cloud Function (2nd gen) Write gcp_functions_set_iam_policy Set IAM policy on a Cloud Function Write gcp_gke_create_cluster Create a new GKE cluster Write gcp_gke_create_node_pool Create a node pool in a GKE cluster Write gcp_gke_set_maintenance_policy Set maintenance policy for a cluster Write gcp_gke_set_node_pool_autoscaling Enable/configure autoscaling for a node pool Write gcp_gke_set_node_pool_size Set the size of a node pool Write gcp_gke_update_cluster Update a GKE cluster (e.g. enable addons) Write gcp_iam_add_iam_binding Add an IAM binding to the project policy Write gcp_iam_create_custom_role Create a custom IAM role in the project Write gcp_iam_create_service_account Create a new service account Write gcp_iam_create_service_account_key Create a new key for a service account Write gcp_iam_disable_service_account Disable a service account Write gcp_iam_enable_service_account Enable a disabled service account Write gcp_iam_set_project_iam_policy Set the IAM policy for the project Write gcp_kms_create_crypto_key Create a new crypto key in a key ring Write gcp_kms_create_key_ring Create a new key ring Write gcp_kms_update_primary_version Update the primary version of a crypto key Write gcp_lb_create_backend_service Create a backend service Write gcp_lb_create_forwarding_rule Create a forwarding rule Write gcp_lb_create_health_check Create a health check Write gcp_lb_create_target_pool Create a target pool Write gcp_logging_create_sink Create a logging sink (export) Write gcp_logging_write_log_entry Write a log entry Write gcp_monitoring_create_alert_policy Create a new alert policy Write gcp_monitoring_create_uptime_check Create an uptime check configuration Write gcp_pubsub_create_subscription Create a new Pub/Sub subscription Write gcp_pubsub_create_topic Create a new Pub/Sub topic Write gcp_pubsub_publish_message Publish a message to a Pub/Sub topic Write gcp_rm_create_project Create a new GCP project Write gcp_rm_set_project_iam_policy Set IAM policy for a project Write gcp_rm_update_project Update project metadata Write gcp_run_create_service Create a new Cloud Run service Write gcp_run_set_iam_policy Set IAM policy for a Cloud Run service Write gcp_run_update_service Update a Cloud Run service Write gcp_secrets_add_version Add a new version to a secret with payload data Write gcp_secrets_create Create a new secret Write gcp_secrets_disable_version Disable a secret version Write gcp_secrets_enable_version Enable a disabled secret version Write gcp_services_enable Enable a GCP API service for the project Write gcp_sql_create_database Create a database in a Cloud SQL instance Write gcp_sql_create_instance Create a new Cloud SQL instance Write gcp_sql_create_user Create a user in a Cloud SQL instance Write gcp_storage_compose_objects Compose multiple objects into one Write gcp_storage_copy_object Copy an object to another location Write gcp_storage_create_bucket Create a new Cloud Storage bucket Write gcp_storage_set_bucket_iam_policy Set IAM policy for a bucket Write gcp_storage_update_bucket Update bucket metadata (labels, lifecycle, etc.) Write gcp_vpc_create_firewall Create a new firewall rule Write gcp_vpc_create_network Create a new VPC network Write gcp_vpc_create_route Create a new route Write gcp_vpc_create_subnetwork Create a new subnetwork Write gcp_vpc_reserve_address Reserve a static IP address Write gcp_vpc_update_firewall Update a firewall rule

READ 145 tools

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about GCP MCP Server

Can an AI agent move money through the GCP MCP Server MCP server? +

Yes. The GCP MCP Server server exposes 1 financial tools including gcp_billing_update_project_billing_info. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the GCP MCP Server MCP server? +

Yes. The GCP MCP Server server exposes 50 destructive tools including gcp_agent_delete_app, gcp_agent_delete_data_store, gcp_agent_delete_endpoint. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through GCP MCP Server? +

The GCP MCP Server server has 81 write tools including gcp_agent_create_app, gcp_agent_create_data_store, gcp_agent_create_endpoint. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach GCP MCP Server.

How many tools does the GCP MCP Server MCP server expose? +

295 tools across 4 categories: Destructive, Execute, Read, Write. 145 are read-only. 150 can modify, create, or delete data.

How do I enforce a policy on GCP MCP Server? +

Register the GCP MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every GCP MCP Server tool call.

Deterministic rules across all 295 GCP MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GCP →

Instant setup, no code required.

295 GCP MCP Server tools catalogued and risk-classified — across an index of 46,500+ MCP servers.