Hosting

Google-managed remote

Transport

Streamable HTTP

Endpoint

https://auditmanager.googleapis.com/mcp

Authentication

Google Cloud authentication: OAuth 2.0 using Application Default Credentials (ADC) in supported Google clients, or a client OAuth ID/secret or bearer token in compatible third-party clients. The principal needs mcp.tools.call plus the underlying product permissions; API key authentication is only available for services that explicitly support it.

Requirements

• A Google Cloud project and access to the target product/resource.
• Enable this MCP service and its underlying Google Cloud API as required by the product guide.
• An MCP client that supports Streamable HTTP.
• An identity with the MCP Tool User role (roles/mcp.toolUser) or equivalent mcp.tools.call permission, plus permissions for the underlying product operations.

Setup steps

1. Choose the correct global or regional endpoint for your data location; this catalog lists the documented endpoint.
2. In the Google Cloud project, enable the MCP service and the underlying product API if the product guide requires it.
3. Authenticate the client with Google Cloud ADC (simplest with Antigravity/Gemini CLI) or configure OAuth 2.0 credentials in a compatible client.
4. Grant the connecting identity roles/mcp.toolUser and only the product IAM roles needed for the intended operations.
5. Add auditmanager.googleapis.com to the client as a Streamable HTTP MCP server and complete sign-in.
6. Refresh the client tool list and check that the tools match the product reference; availability may depend on permissions and selected toolset.

Google Cloud documents seven tools for resource enrollment, audit report generation/retrieval, report listing, audit-scope reports and operation polling. Enrollment changes IAM policy/resource enrollment; report generation may write audit evidence to Cloud Storage. Requires Google IAM roles and cloud-auditmanager OAuth scope; no API keys.

• enroll_resource

  Enrolls a project in Audit Manager. This enables auditing capabilities and allows specifying eligible Cloud Storage buckets (for example, gs://... ) where generated reports can be uploaded. Format: 'projects/{project}/locations/{location}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1).

  01
• get_resource_enrollment_status

  Fetches the enrollment status for a project in Audit Manager. Format: 'projects/{project}/locations/{location}/resourceEnrollmentStatuses/-'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1).

  02
• generate_audit_report

  Registers a report generation request for a compliance framework. Returns a long-running operation ID. Scope format: 'projects/{project}/locations/{location}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1). Framework format: 'organizations/{org}/locations/{location}/frameworks/{id}' or 'projects/{project}/locations/{location}/frameworks/{id}'. Example IDs: 'builtin-aipp', 'builtin-security-essentials'. If 'complianceFramework' is unknown, prompt the user for it. Suggest they list frameworks using: 'gcloud compliance-manager frameworks list --project={project} --location=global' or 'gcloud compliance-manager frameworks list --organization={organization_id} --location=global'

  03
• get_audit_report

  Gets the full metadata of an audit report and its control level summary. Format: 'projects/{project}/locations/{location}/auditReports/{auditReportId}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1).

  04
• list_audit_reports

  Lists the audit reports for the specified parent scope. Format: 'projects/{project}/locations/{location}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1). Filter or review the returned list of audit reports as needed based on the user's request.

  05
• generate_audit_scope_report

  Generates an audit scope report for the given compliance framework. Based on assets present in the selected scope and predefined compliance checks for given compliance controls, this generates an audit task breakdown against required compliance controls. Scope format: 'projects/{project}/locations/{location}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1). Framework format: 'organizations/{org}/locations/{location}/frameworks/{id}' or 'projects/{project}/locations/{location}/frameworks/{id}'. Example IDs: 'builtin-aipp', 'builtin-security-essentials'. If 'complianceFramework' is unknown, prompt the user for it. Suggest they list frameworks using: 'gcloud compliance-manager frameworks list --project={project} --location=global' or 'gcloud compliance-manager frameworks list --organization={organization_id} --location=global'

  06
• get_operation

  Gets the latest state of a long-running operation (e.g., returned by 'generate_audit_report'). Use this to poll the operation returned by generate_audit_report . Format: 'projects/{project}/locations/{location}/operationIds/{operation_id}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen regional endpoint (REP) region (for example, us-central1). CRITICAL: The generate_audit_report tool returns operations with /operations/ in the response. Ensure to replace /operations/ with /operationIds/ before calling this tool.

  07

• official tool reference

  Product-specific Google MCP reference publishes 7 exact tool identifiers and descriptions in its tools reference.

• official server catalog

  Official Google Cloud catalog lists this product as an available remote MCP server.

• official setup guide

  Google Cloud describes remote MCP client setup, Streamable HTTP transport, supported authentication options, and ADC setup.

• official authentication guide

  Google documents supported identity types and authorization requirements for Google Cloud MCP calls.

• official setup and safety guide

  Current Google Cloud guide documents IAM roles, OAuth, regional endpoints, and tool workflows that enroll resources and generate audit reports.

• official tool schema

  Official tool reference documents enrollment scope and eligible Cloud Storage destinations.

Documentation checked 2026-10-28. Connection has not been runtime tested.