What is gcloud MCP Server?
The gcloud MCP server, from Google's googleapis organisation, gives an agent one tool, run_gcloud_command, which runs the gcloud CLI installed on your machine with an argument list the model supplies. Before each call it asks gcloud to parse the command, checks the command group against an access-control list, then starts the gcloud binary directly with no shell, so pipes, redirection and command chaining fail. The same repo also hosts separate observability, Cloud Storage and Backup and DR servers.
It has no credentials of its own. Every call runs as the active gcloud account, so it inherits whatever gcloud auth login or an activated service account key allows; the README recommends service account impersonation with a narrow IAM role. A default denylist of 10 entries, mostly SSH and tunnelling commands plus gcloud interactive and gcloud meta, always applies, and a JSON file passed with -c adds either an allowlist or a denylist, never both.
The repo is Apache-2.0 licensed with about 940 GitHub stars, and @google-cloud/gcloud-mcp was downloaded about 212,000 times in the month to 26 October 2026. Google labels it a preview that is not an officially supported product and not covered by the Google Cloud terms of service. The last gcloud-mcp release, 0.5.3, shipped on 5 January 2026; changes since have been dependency updates.
How to install gcloud MCP Server
npx -y @google-cloud/gcloud-mcpIs gcloud MCP Server worth it?
This server adds almost nothing between the model and gcloud, and that is both its appeal and its risk. With the default setup an agent running as a typical developer account can delete projects, Compute Engine instances and Cloud SQL databases, rewrite IAM policies or create service account keys, because the only built-in blocks are 10 command groups chosen to stop interactive sessions, not damage. The README frames the denylist that way: it removes commands that make no sense for an agent, not commands that are dangerous.
The gap that matters most is credentials. gcloud auth print-access-token and its application-default and identity-token variants are not on the default denylist, so an agent, or a prompt injected through a resource description it read, can print a live access token into the model's context. A pull request adding them to the denylist (#419) has been open since 6 May 2026. Until it lands, add those commands to your own deny file. Impersonation set through gcloud config is not a hard boundary either, since config commands are allowed and an agent can unset it; activating the service account itself, or denying the config group, closes that.
The allowlist is the feature to use. A file such as {"allow": ["compute instances list", "logging read"]} limits the agent to named groups or exact commands, and the rules are precise about release tracks: allowing beta storage does not allow GA storage, while denying a GA command also denies its alpha and beta forms. Command parsing goes through gcloud's own linter rather than string matching, which makes the check harder to dodge with reordered flags.
There is no BigQuery cost protection here, because there is no BigQuery query tool. The server runs only the gcloud binary, and its docs mention no dry-run or byte limit. On-demand BigQuery queries bill at $6.25 per TiB scanned after a free 1 TiB a month, and BigQuery's own project-level quotas and maximum bytes billed setting remain the controls to set. For SQL against BigQuery, AlloyDB or Cloud SQL, Google's MCP Toolbox for Databases is the better fit, with named, parameterised queries instead of an open command line; gcloud-mcp is for the control plane around those databases.
Where it earns its place
A platform engineer at a 20-person startup on Google Cloud
Ask why a Cloud Run service is returning 500s and what changed
Run gcloud-mcp with an allowlist of run services describe, run revisions list and logging read, under a service account holding only viewer roles. The agent reads revisions and logs with no write path. The server is free; Cloud Logging reads are billed as normal.
A FinOps analyst at a mid-sized retailer
Inventory idle Compute Engine disks and unattached IP addresses across several projects
List commands such as compute disks list and compute addresses list with --filter and --format projections return only the needed fields, keeping output small. With an allowlist of list commands the agent can report but not delete, which leaves the clean-up decision with a person.
A security engineer reviewing whether to permit agents in a regulated Google Cloud organisation
Decide what an agent on a developer laptop could do with the developer's gcloud login
Out of the box it can do everything that login can, including printing access tokens, and Google offers no support contract for it. An allowlist file distributed with the client config, plus impersonation of a read-only service account, is the minimum before approval.
Before you commit
- Setup
- Needs Node.js 20 or later and an authenticated gcloud CLI. npx @google-cloud/gcloud-mcp init --agent=gemini-cli installs it as a Gemini CLI extension; for Claude Desktop, Cursor, Cline or VS Code add npx -y @google-cloud/gcloud-mcp to the MCP config. The -c flag takes an absolute path to an allow or deny JSON file.
- Integrations
- One tool, run_gcloud_command, covering whatever gcloud covers, read and write alike. The same repo ships separate storage-mcp (read-only and create-only by default, deletes behind --enable-destructive-tools), observability-mcp (logs, metrics, traces via Application Default Credentials) and backupdr-mcp servers. Stdio only; no HTTP transport.
- Data and privacy
- Runs locally as the active gcloud account and returns command output to the model. Anything gcloud can print reaches the context, including access tokens unless you deny the auth print commands, and resource descriptions or log lines are untrusted text. No GitHub security advisories have been published.
- Cost at scale
- The server is free; every command bills to the project as usual. The expensive mistakes are writes, such as creating instances or GPUs, rather than call volume, and nothing in the server caps them; budgets, quotas and IAM have to.
- Limits
- Preview with breaking changes possible, outside Google Cloud support and terms. No dry-run, approval step or per-command confirmation of its own. The default denylist cannot be overridden, so SSH-based workflows are unavailable. 33 issues were open on 28 October 2026.
What's good
- One tool reaches almost every Google Cloud service gcloud covers
- Allowlist or denylist by command group, parsed by gcloud's own linter
- No shell, so pipes, chaining and substitution fail
- Uses existing gcloud credentials and IAM, nothing new to provision
What's not
- Default denylist blocks SSH and interactive commands, not deletes
- print-access-token commands are not denied by default
- Preview, not an officially supported Google product
- No gcloud-mcp release since January 2026
Best for
Google Cloud engineers who want an agent to inspect and operate resources through gcloud, and will pin it to an allowlist and a narrow service account.
gcloud MCP Server alternatives
gcloud MCP Server: common questions
- Is gcloud MCP Server worth it?
- A thin, honest wrapper around gcloud that is exactly as safe as the account behind it, which for most developers means far too powerful until you add an allowlist. We rate it 3.5 out of 5.
- How much does gcloud MCP Server cost?
- Free and Apache-2.0 licensed. Every command bills to your Google Cloud project as if you had typed it.
- What are the downsides of gcloud MCP Server?
- Default denylist blocks SSH and interactive commands, not deletes; print-access-token commands are not denied by default; preview, not an officially supported Google product; no gcloud-mcp release since January 2026.
- Who is gcloud MCP Server best for?
- Google Cloud engineers who want an agent to inspect and operate resources through gcloud, and will pin it to an allowlist and a narrow service account.
- How much does gcloud MCP Server cost for a team or in production?
- The server is free; every command bills to the project as usual. The expensive mistakes are writes, such as creating instances or GPUs, rather than call volume, and nothing in the server caps them; budgets, quotas and IAM have to.
- Is gcloud MCP Server safe for company data?
- Runs locally as the active gcloud account and returns command output to the model. Anything gcloud can print reaches the context, including access tokens unless you deny the auth print commands, and resource descriptions or log lines are untrusted text. No GitHub security advisories have been published.
- What are the best gcloud MCP Server alternatives?
- The closest alternatives we have reviewed are MCP Toolbox for Databases, AWS MCP Server, Azure MCP Server and Terraform MCP Server.
Answers checked Oct 28, 2026.