# list_gcp_planned_purchases

Evaluate current GCP commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns the laddering projections for the billing account, grouped by PS4C product line (service) and region. Each service group lists one entry per available gcp-purchases-projection document for that scope (compute scopes are global; cloud_sql scopes are per-region). With no filters, returns all existing projection documents in stable order: service groups ordered compute first, then cloud_sql; within each group, regions sorted with global first, then remaining regions alphabetically. Services with no projection documents are omitted (not returned as empty groups). When a filter matches no documents, the response is an empty items array (not 404). Partial projection documents return only the fields available in storage. gcp_service and region filters: omit both to return all available services and their regions; supply gcp_service alone to return all regions for that service; supply both to return a single service/region scope. region requires gcp_service — a request with region but no gcp_service returns 400 with code gcp_service_required. Invalid gcp_service or region values return 400 with code validation_failed. 404 is returned only when the billing account does not exist or the caller cannot access it. A billing account that is not onboarded for PS4C still returns 200 with an empty items array when no projection documents exist — use GET /ps4commitments/v1/gcp/billing-accounts (or get-by-id) for onboarding status. Pagination: results are paginated by service group (a whole group is never split across pages). Groups keep the stable service order above. Use maxResults to limit page size (default 50, max 500). When more groups remain, the response includes a non-null pageToken; pass it unchanged on the next request with the same query parameters (gcp_service, region, maxResults). rowCount is the number of service groups in this page. An invalid pageToken returns 400 with code pagination_token_invalid; an expired token returns 400 with code pagination_token_expired. This endpoint is paginated: a response with a non-empty pageToken has more results, returned when that value is passed as the pageToken parameter. A missing, null, or empty pageToken marks the last page.

Agent View of the PolicyLayer registry record for `list_gcp_planned_purchases`. HTML page: https://policylayer.com/tools/doit/list-gcp-planned-purchases

## Facts

- Tool: `list_gcp_planned_purchases`
- Server: Doit (`@doitintl/doit-mcp-server`) — https://policylayer.com/tools/doit.md
- Install: `npx -y @doitintl/doit-mcp-server`
- Homepage: https://www.npmjs.com/package/@doitintl/doit-mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 7 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `region` | string | no | GCP region scope in the DCI `lower_snake_case` wire form (for example `us_east1`), or the literal `global` for cross-region scopes. This is not the raw provider |
| `pageToken` | string | no |  |
| `maxResults` | number | no |  |
| `X-Tenant-Id` | string | no |  |
| `gcp_service` | string | no |  |
| `customerContext` | string | no | Scope the request to a specific customer by ID. Required for DoiT employees (whose token isn't tied to a single customer); omit for direct customer users. |
| `billingAccountId` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_gcp_planned_purchases",
    "arguments": {
      "billingAccountId": "<billingAccountId>"
    }
  }
}
```

## Why list_gcp_planned_purchases is rated Low

Even though list_gcp_planned_purchases only reads data, uncontrolled read access leaks sensitive information and racks up API costs: an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.

## Use case

AI agents call list_gcp_planned_purchases to retrieve information from Doit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Doit:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_gcp_planned_purchases": {}
  }
}
```

## Other tools on Doit (237)

- `cancel_async_operation` — Destructive — https://policylayer.com/tools/doit/cancel-async-operation.md
- `cancel_invite` — Destructive — https://policylayer.com/tools/doit/cancel-invite.md
- `confirm_action` — Destructive — https://policylayer.com/tools/doit/confirm-action.md
- `delete_account_role` — Destructive — https://policylayer.com/tools/doit/delete-account-role.md
- `delete_alert` — Destructive — https://policylayer.com/tools/doit/delete-alert.md
- `delete_allocation` — Destructive — https://policylayer.com/tools/doit/delete-allocation.md
- `delete_annotation` — Destructive — https://policylayer.com/tools/doit/delete-annotation.md
- `delete_ava_conversation` — Destructive — https://policylayer.com/tools/doit/delete-ava-conversation.md
- `delete_budget` — Destructive — https://policylayer.com/tools/doit/delete-budget.md
- `delete_cloudflow_connection` — Destructive — https://policylayer.com/tools/doit/delete-cloudflow-connection.md
- `delete_custom_theme` — Destructive — https://policylayer.com/tools/doit/delete-custom-theme.md
- `delete_customer_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-customer-geographic-access-scope.md
- `delete_customer_group` — Destructive — https://policylayer.com/tools/doit/delete-customer-group.md
- `delete_datahub_dataset` — Destructive — https://policylayer.com/tools/doit/delete-datahub-dataset.md
- `delete_datahub_datasets` — Destructive — https://policylayer.com/tools/doit/delete-datahub-datasets.md
- `delete_datahub_events_by_filter` — Destructive — https://policylayer.com/tools/doit/delete-datahub-events-by-filter.md
- `delete_folder` — Destructive — https://policylayer.com/tools/doit/delete-folder.md
- `delete_geographic_access_custom_region` — Destructive — https://policylayer.com/tools/doit/delete-geographic-access-custom-region.md
- `delete_insight_result` — Destructive — https://policylayer.com/tools/doit/delete-insight-result.md
- `delete_insight_results` — Destructive — https://policylayer.com/tools/doit/delete-insight-results.md
- `delete_label` — Destructive — https://policylayer.com/tools/doit/delete-label.md
- `delete_report` — Destructive — https://policylayer.com/tools/doit/delete-report.md
- `delete_role` — Destructive — https://policylayer.com/tools/doit/delete-role.md
- `delete_service_account` — Destructive — https://policylayer.com/tools/doit/delete-service-account.md
- `delete_service_account_token` — Destructive — https://policylayer.com/tools/doit/delete-service-account-token.md
- `delete_user` — Destructive — https://policylayer.com/tools/doit/delete-user.md
- `delete_user_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-user-geographic-access-scope.md
- `id_of_asset` — Destructive — https://policylayer.com/tools/doit/id-of-asset.md
- `remove_ticket_tags` — Destructive — https://policylayer.com/tools/doit/remove-ticket-tags.md
- `async_run_inline` — Execute — https://policylayer.com/tools/doit/async-run-inline.md
- …and 207 more: https://policylayer.com/tools/doit.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=doit · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/doit