// SCAN REPORT

Gcloud

17 tools. 3 can modify or destroy data without limits.

3 write tools that can modify data. Rate limits recommended.

Last updated: 3 Jul 2026

3 can modify or destroy data

14 read-only

17 tools total

Community server · catalogue entry verified 03/07/2026

How to control Gcloud ↓

TOOL MAP

What Gcloud exposes to your agents

Read (14) Write / Execute (3) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Gcloud tools

Execute · High gcloud_deploy_service Deploying a service revision is an Execute action because it triggers external operations (Cloud Run deployment) whose effects depend on the arguments (which image, which service, etc.). Execute · High gcloud_run_trigger This tool executes a build process in Google Cloud, which runs code and triggers external operations. Execute · High gcloud_set_traffic This tool modifies live production traffic routing between Cloud Run revisions, which is an operational action with immediate real-world impact.

3 of Gcloud's 17 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Gcloud

PolicyLayer is an MCP gateway — it sits between your AI agents and Gcloud, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "gcloud_get_build": {
    "limits": [
      {
        "counter": "gcloud_get_build_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Gcloud — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON GCLOUD →

Instant setup, no code required.

FULL CATALOGUE

All 17 Gcloud tools

EXECUTE 3 tools

Execute gcloud_deploy_service Deploy a new revision to a Cloud Run service by updating the container image. WARNING: This modifies a live se Execute gcloud_run_trigger Manually trigger a Cloud Build. Returns the build ID of the triggered build. WARNING: This creates a new build Execute gcloud_set_traffic Set traffic splitting between Cloud Run revisions. Useful for canary deployments and rollbacks. WARNING: This

READ 14 tools

Read gcloud_get_build Get full Cloud Build details including steps, substitutions, images, and per-step timing breakdown. Read gcloud_get_build_logs Fetch Cloud Build logs from Cloud Logging. Supports step filtering and line limits. Read gcloud_get_job_execution Get Cloud Run Job execution details including task counts, status, timing, and log URI. Read gcloud_get_service Get full Cloud Run service details including URL, env vars, resource limits, scaling config, traffic splits, a Read gcloud_get_service_logs Retrieve recent log entries for a Cloud Run service from Cloud Logging. Supports severity, time range, revisio Read gcloud_get_trigger Get full Cloud Build trigger configuration including repo, branch filter, build config, and substitutions. Read gcloud_list_artifacts List Docker images in an Artifact Registry or GCR repository. Shows image tags, upload time, and size. Read gcloud_list_builds List Cloud Build builds with optional filters for status, trigger, and branch. Returns status, duration, sourc Read gcloud_list_jobs List Cloud Run Jobs in a region. Shows job name, last execution status, execution count, and creation time. Read gcloud_list_revisions List Cloud Run revisions for a service. Shows deployment history with image tags, creation times, and scaling Read gcloud_list_secrets List Secret Manager secret names (NOT values) in a project. Shows secret name, creation time, and replication Read gcloud_list_services List Cloud Run services in a given region. Returns URL, latest revision, status, and last deployed timestamp f Read gcloud_list_triggers List Cloud Build triggers in a project. Shows trigger name, repo, branch filter, and status. Read gcloud_whoami Returns current GCP project, authenticated identity, and available permissions. Use this to verify auth setup

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Gcloud

Is the Gcloud MCP server safe to use without restrictions? +

The Gcloud server is primarily read-only with 14 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the Gcloud MCP server expose? +

17 tools across 3 categories: Execute, Read, Write. 14 are read-only. 3 can modify, create, or delete data.

How do I enforce a policy on Gcloud? +

Register the Gcloud MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Gcloud tool call.

Deterministic rules across all 17 Gcloud tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GCLOUD →

Instant setup, no code required.

17 Gcloud tools catalogued and risk-classified — across an index of 43,000+ MCP servers.