gcp_logging_create_sink

What gcp_logging_create_sink does on GCP MCP Server

AI agents use gcp_logging_create_sink to create or update resources in GCP MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your GCP MCP Server environment.

Why gcp_logging_create_sink is rated Medium

This tool creates a new logging sink resource that establishes ongoing log export behavior. While reversible (the sink can be deleted), it modifies GCP infrastructure configuration and could redirect sensitive logs to unintended destinations if misconfigured by an agent. This is a Write action (creates/modifies data reversibly), not Read (no data retrieval) or Destructive (sink can be removed).

From the tool's definition Tool name includes 'create' and description states 'Create a logging sink (export)'. A logging sink in GCP configures continuous export of logs to external destinations (Cloud Storage, BigQuery, Pub/Sub, etc.), which creates a new persistent configuration.

The rule that runs gcp_logging_create_sink safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GCP MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gcp_logging_create_sink, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gcp_logging_create_sink": {
      "limits": [
        {
          "counter": "gcp_logging_create_sink_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about gcp_logging_create_sink