// MCP TOOL REFERENCE
F Risk Grade Storage · worst category: Destructive

STORAGE TOOLS

61 tools from the Storage MCP Server, categorised by risk level.

View the Storage policy →
// ALL 61 STORAGE TOOLS
READ 37 tools
Read check_iam_permissions Tests IAM permissions for a bucket. Read download_object Downloads an object from GCS to a local file. Read find_protectable_resources Lists protectable resources in a project. This includes Cloud SQL instances, Compute VMs, and Compute Disks. Read get_backup Gets a backup. Read get_backup_plan Gets a backup plan. Read get_backup_plan_association Gets a backup plan association. Read get_backup_vault Gets a backup vault. Read get_backupdr_operation Gets the status of a BackupDR operation. Read get_bucket_location Gets the location and storage class of a bucket. Read get_bucket_metadata Gets detailed metadata for a specific bucket. Read get_csql_operation Gets the status of a Cloud SQL operation. Read get_datasource Gets a data source. Read get_metadata_table_schema Checks if GCS insights service is enabled and returns the BigQuery table schema for a given insights datase... Read get_trace Use this as the primary tool to retrieve a single distributed trace from Google Cloud Trace. Traces pro... Read list_alert_policies Use this as the primary tool to list the alerting policies in a Google Cloud project. Alerting policies... Read list_alerts Use this as the primary tool to list the alerts in a Google Cloud project. An alert is the representati... Read list_backup_plan_associations Lists all backup plan associations for a given backup plan. Read list_backup_plans Lists all backup plans in a given project and location. Read list_backup_vaults Lists all backup vaults in a given project and location. Read list_backups Lists all backups for a given data source in a backup vault. Read list_buckets Use this as the primary tool to list the log buckets in a Google Cloud project. Log buckets are contain... Read list_datasources Lists all data sources in a given backup vault. Read list_group_stats Use this tool ONLY to find and analyze recurring stack traces in your application. It aggregates simil... Read list_insights_configs Lists the names of all Storage Insights dataset configurations for a given project. Read list_log_entries Use this as the primary tool to search and retrieve log entries from Google Cloud Logging. It Read list_log_names Use this as the primary tool to list the log names in a Google Cloud project. This is useful for discov... Read list_log_scopes Use this as the primary tool to list the log scopes in a Google Cloud project. Log scopes allow you to ... Read list_metric_descriptors Use this as the primary tool to discover the types of metrics available in a Google Cloud project. This... Read list_objects Lists the names of objects in a Google Cloud Storage (GCS) bucket. Supports filtering by prefix, directory-... Read list_resource_backup_configs Lists all resource backup configs in a given project and location. Read list_sinks Use this as the primary tool to list the log sinks in a Google Cloud project. Log sinks control how Clo... Read list_time_series Use this as the primary tool to retrieve metric data over a specific time period. This is the core tool... Read list_traces Use this as the primary tool to retrieve and examine distributed traces from Google Cloud Trace. Traces... Read list_views Use this as the primary tool to list the log views in a given log bucket. Log views provide fine-graine... Read read_object_content Reads the content of a specific object. Read read_object_metadata Reads metadata for a specific object. Read view_iam_policy Views the IAM policy for a bucket.
WRITE 15 tools
Write copy_object Copies an object from one bucket to another or within the same bucket. Write copy_object_safe Copies an object to a new destination. Fails if an object already exists at the destination. Write create_backup_plan Creates a new backup plan. Write create_backup_plan_association Creates a new backup plan association. Write create_backup_vault Creates a new backup vault. Write create_bucket Creates a new bucket with specified configuration. Write csql_restore Restores a Cloud SQL backup to a Cloud SQL instance. Write restore_backup Restores a Backup resource to a target environment. Supports Compute Instances and Disks. Write update_backup_plan Updates a backup plan. Write update_bucket_labels Updates labels for a bucket. Write update_object_metadata Updates the metadata of an existing object. Write upload_object Uploads a file to a GCS bucket. Write upload_object_safe Uploads a file to a GCS bucket. Fails if the object already exists. Write write_object Writes a new object to the bucket. Write write_object_safe Writes a new object to the bucket. Fails if the object already exists.
DESTRUCTIVE 7 tools
Destructive delete_backup Deletes a backup. Destructive delete_backup_plan Deletes a backup plan. Destructive delete_backup_plan_association Deletes a backup plan association. Destructive delete_backup_vault Deletes a backup vault. Destructive delete_bucket Deletes a bucket. Destructive delete_object Deletes a specific object. Destructive move_object Moves an object from one bucket to another or renames it within the same bucket by copying and deleting the...
EXECUTE 2 tools
Execute execute_insights_query Executes a BigQuery SQL query against an insights dataset and returns the result. Execute trigger_backup Triggers a backup for a given backup plan association.
// RUNNING THIS SERVER

The managed route: connect Storage through the PolicyLayer gateway — every tool call above is checked against your policy before it runs, with a full audit log.

DIRECT INSTALL (UNMANAGED) npx -y @google-cloud/storage-mcp

Route Storage through PolicyLayer and every one of its 61 tools is checked against your policy before it runs.

CHECK YOUR STACK →

See every tool, the dangerous ones, and the token cost across your stack.

// FAQ
How many tools does the Storage MCP server have? +

The Storage MCP server exposes 61 tools across 4 categories: Read, Write, Destructive, Execute.

How do I enforce policies on Storage tools? +

Route the Storage server through the PolicyLayer gateway. Define allow, deny, or approval rules per tool in the dashboard; they are enforced on every call before it reaches the server.

What risk categories do Storage tools fall into? +

Storage tools are categorised as Read (37), Write (15), Destructive (7), Execute (2). Each category has a recommended default policy.

Enforce policy on every Storage tool call.

Start from Storage, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →

Instant setup, no code required.

43,000+ MCP servers and 220,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.