# Google Cloud CLI MCP
> Google Cloud managed MCP server for Google Cloud CLI. Exact tool names and accessible operations depend on the published server reference and configured Google Cloud permissions.
Canonical: https://www.mcpfolio.com/servers/google-cloud-cli
Last updated: 2026-10-28
## Catalog record

- Publisher: Google Cloud
- Categories: development, database, cloud-service, cloud-storage

## Website

https://docs.cloud.google.com/sdk/reference/mcp

## Transports

Streamable HTTP

## Authentication

Google Cloud authentication: OAuth 2.0 using Application Default Credentials (ADC) in supported Google clients, or a client OAuth ID/secret or bearer token in compatible third-party clients. The principal needs mcp.tools.call plus the underlying product permissions; API key authentication is only available for services that explicitly support it.

## Tools

- **run_gcloud_command**: Executes a single gcloud CLI command within the user's Google Cloud project. CRITICAL SAFETY WARNING (POTENTIALLY DESTRUCTIVE) : This tool can create, update, or delete Google Cloud resources (e.g., gcloud compute instances delete). It is NOT restricted to read-only commands. Use extreme caution. FORBIDDEN COMMANDS : An agent MUST NOT execute the following gcloud commands (including their alpha/beta variants): app deploy , app instances ssh , auth , billing , components , config , docker , feedback , info , init , meta , survey . STRICT EXECUTION RULES : You MUST provide the 'project' parameter (i.e. project="projects/PROJECT_ID") when using this tool (it is used for Cloud CLI Execution API enablement check, billing, quota, etc.). This is NOT the same as the --project flag in gcloud commands used to specify the project gcloud operates on. Flag Formatting: You MUST always use an '=' sign to separate flag keys from their values for all long options. Correct: --zone=us-central1-a or --project=my-project . Incorrect: --zone us-central1-a or --project my-project . Billing Project: You cannot assume any pre-configured project or billing settings in the execution environment. For non-project scoped commands (e.g., folder or organization level) or specific scenarios like Cloud Storage Requester Pays, you MUST pass the --billing-project=PROJECT flag. For project-scoped commands, you MAY additionally specify --billing-project=PROJECT to override the quota project, which will take effect for Google Cloud APIs that do not support resource-project-override. Project Scope: You SHOULD ALWAYS pass the --project=PROJECT_ID flag for project-scoped commands. Do not use it for organization or folder-level commands. If you do not provide a --project flag for a project-scoped command, the resource project will default to the project set in the --billing-project flag. If specifying --billing-project flag in the gcloud command, ensure that the value is a project ID or a project number. The value MUST NOT be a special value (ie LEGACY, CURRENT_PROJECT, CURRENT_PROJECT_WITH_FALLBACK). At least one of --project or --billing-project MUST be specified in the command string. Asynchronous Operations: For long-running synchronous operations (e.g., creating a VM or a database), you SHOULD ALWAYS pass the --async flag to prevent agent timeouts. Log Rate Limiting: When using gcloud logging read , you MUST ALWAYS include a --limit flag (e.g., --limit=100 ) to prevent credential and connection timeouts. Self-Correction: If a command returns an error, analyze the stderr, correct the syntax or flags, and retry in the next iteration. input_files: (Optional) A list of files to be created in the environment before running the command. Each file must have a 'path' (relative to the current directory) and 'contents'. The 'contents' must be plain text representing the file's content. This is useful for commands that read from files (e.g. gcloud builds submit --config=cloudbuild.yaml --async --project=PROJECT_ID ). Example gcloud commands/patterns: Read Compute Engine instance logs with severity>=ERROR: gcloud logging read "severity>=ERROR AND resource.type='gce_instance'" --limit=10 --order=DESC --project=PROJECT_ID Note the use of quotes for the filter expression. List all PSC endpoints: gcloud compute forwarding-rules list --project=PROJECT_ID Describe a PSC endpoint: gcloud compute forwarding-rules describe FORWARDING_RULE_NAME --region=REGION --project=PROJECT_ID Note the use of '=' for the --region flag. List all clusters: gcloud container clusters list --project=PROJECT_ID Describe a cluster: gcloud container clusters describe CLUSTER_NAME --region=REGION --project=PROJECT_ID List compute instances: gcloud compute instances list --project=PROJECT_ID Get IAM policy for a project: gcloud projects get-iam-policy PROJECT_ID --project=PROJECT_ID Response strings are formatted for terminal output by default (stdout or stderr). Use --format flag to change the format.
- **run_bq_command**: Runs a single BigQuery CLI (bq) command . This tool allows you to run any bq command in the user's project, including commands that create, update, or delete Google Cloud resources (i.e., mutations). CRITICAL SAFETY WARNING (POTENTIALLY DESTRUCTIVE) : This tool can create, update, or delete BigQuery resources (e.g., bq rm , bq cancel , bq query ). It is NOT restricted to read-only commands. Use extreme caution. FORBIDDEN COMMANDS : An agent MUST NOT execute the following bq commands: bq init , bq pyshell , bq shell . STRICT EXECUTION RULES : At least one of --project_id or --quota_project_id MUST be specified in the command string. Project ID vs Quota Project: The --project_id flag specifies the resource project the command operates on (mirrors gcloud's --project flag). The --quota_project_id flag specifies the project charged for billing/quota of the downstream BigQuery API call (mirrors gcloud's --billing-project flag). If --project_id is specified in the command, it will be used as the billing/quota project. If --project_id is not specified OR --quota_project_id is additionally specified, the billing/quota project will be the project set in the --quota_project_id flag. Flag Formatting: You MUST always use an '=' sign to separate flag keys from their values for all long options. Correct: '--project_id=my-project' or '--location=us' . Incorrect: '--project_id my-project' or '--location us' . Do not use spaces between flags and their values. No Configuration Defaults: The bq command is executed in a stateless manner; it does not load local configuration files like .bigqueryrc. Therefore, for all regional operations (e.g., creating a dataset or querying a regional dataset), you MUST explicitly specify the --location flag (e.g., --location=us or --location=EU ). Asynchronous Operations: Some commands initiate synchronous long-running operations (e.g., running query jobs). You SHOULD ALWAYS pass the --nosync flag for these commands to prevent agent timeouts. Command Restrictions: You MUST NOT use the following bq commands: bq init , bq pyshell , bq shell . Command piping or chaining is NOT supported. Self-Correction: If a command returns an error, analyze the stderr, correct the syntax or flags, and retry in the next iteration. Examples of mutating bq commands include: bq mk , bq rm , bq update , bq insert , bq query (without --dry_run ), etc. Usage: RunBq(command="bq query --project_id=PROJECT_ID 'SELECT 1'", project="projects/PROJECT_ID", input_files=[{"path": "PATH", "contents": "CONTENTS"}]) You MUST provide the full bq command as a single string in the 'command' parameter. You MUST provide the 'project' parameter (format: projects/PROJECT_ID) as the API execution project for billing, API enablement, and quota consumption checks. Example bq commands/patterns: Run a query: bq query --use_legacy_sql=false --project_id=PROJECT_ID 'SELECT * FROM project.dataset.table LIMIT 10' Create a dataset: bq mk --dataset --location=us --project_id=PROJECT_ID myDataset Create a table: bq mk --table --project_id=PROJECT_ID myDataset.myTable name:string,value:integer Remove a dataset: bq rm -f --dataset --project_id=PROJECT_ID myDataset Remove a table: bq rm -f -t --project_id=PROJECT_ID myDataset.myTable Update table description: bq update --description="New description" --project_id=PROJECT_ID myDataset.myTable List datasets in a project: bq ls --datasets=true --project_id=PROJECT_ID

## Sources

- [official_server_catalog](https://docs.cloud.google.com/mcp/supported-products)
- [official_setup_guide](https://docs.cloud.google.com/mcp/configure-mcp-ai-application)
- [official_authentication_guide](https://docs.cloud.google.com/mcp/authenticate-mcp)
- [official_source](https://docs.cloud.google.com/sdk/reference/mcp)
- [official_source](https://docs.cloud.google.com/sdk/use-gcloud-mcp)

## Setup

Use the interactive setup panel on [the detail page](https://www.mcpfolio.com/servers/google-cloud-cli) to view instructions for each supported client.