Hosting

Google-managed remote

Transport

Streamable HTTP

Endpoint

https://cloudasset.googleapis.com/mcp

Authentication

Google Cloud authentication: OAuth 2.0 using Application Default Credentials (ADC) in supported Google clients, or a client OAuth ID/secret or bearer token in compatible third-party clients. The principal needs mcp.tools.call plus the underlying product permissions; API key authentication is only available for services that explicitly support it.

Requirements

• A Google Cloud project and access to the target product/resource.
• Enable this MCP service and its underlying Google Cloud API as required by the product guide.
• An MCP client that supports Streamable HTTP.
• An identity with the MCP Tool User role (roles/mcp.toolUser) or equivalent mcp.tools.call permission, plus permissions for the underlying product operations.

Setup steps

1. Choose the correct global or regional endpoint for your data location; this catalog lists the documented endpoint.
2. In the Google Cloud project, enable the MCP service and the underlying product API if the product guide requires it.
3. Authenticate the client with Google Cloud ADC (simplest with Antigravity/Gemini CLI) or configure OAuth 2.0 credentials in a compatible client.
4. Grant the connecting identity roles/mcp.toolUser and only the product IAM roles needed for the intended operations.
5. Add cloudasset.googleapis.com to the client as a Streamable HTTP MCP server and complete sign-in.
6. Refresh the client tool list and check that the tools match the product reference; availability may depend on permissions and selected toolset.

Google Cloud reference lists four tools for asset listing, IAM analysis, export and operation status. Asset snapshots can include sensitive inventory and IAM relationships; IAM analysis results may be exported. Read-only discovery is separate from export operations; Google IAM applies.

• list_assets

  List assets from Cloud Asset Inventory

  01
• analyze_iam_policy

  Analyzes Google Cloud IAM allow policies to determine who can do what on which resources. It can perform policy analysis such as finding resources accessible to a principal, finding principals with access to a resource, or checking access paths. This tool requires the analysis_query parameter, which specifies the root container where policies are analyzed ( scope ) and offers optional selectors for resource names, principal identifiers, and applicable roles and permissions. Folder and Organization scopes are not supported. scope must be a project scope ( projects/PROJECT_ID ). When analyzing policies in a specific project (for example, 'in PROJECT_ID '), set scope to projects/PROJECT_ID and do not set resource_selector . Only set resource_selector.full_resource_name (for example, //storage.googleapis.com/BUCKET_NAME ) if the user specifically asks for access to a particular resource within that scope. If a project scope is not specified in the request, confirm the scope before calling this tool. If execution_timeout is not specified in the request, set execution_timeout to 60s as a string with suffix 's'. You can also provide options to expand_groups , expand_roles , expand_resources (default false ), and analyze_service_account_impersonation (default false ). For supported policy types, see https://docs.cloud.google.com/policy-intelligence/docs/policy-analyzer-overview#supported-policy-types . For BYOID support, see https://docs.cloud.google.com/iam/docs/federated-identity-supported-services#policy-intelligence .

  02
• export_iam_analysis_results

  Analyzes Google Cloud IAM policies asynchronously and exports the results to a BigQuery dataset or Google Cloud Storage bucket. Use this for large-scale analysis (for example, expanding resources or impersonation). This tool requires the analysis_query parameter, which specifies the root container where policies are analyzed ( scope ) and offers optional selectors for resource names, principal identifiers, and applicable roles and permissions. Folder and Organization scopes are not supported; scope must be a project scope (for example, projects/PROJECT_ID ). When analyzing policies in a specific project (for example, 'in PROJECT_ID '), set scope to projects/PROJECT_ID and do not set resource_selector . Only set resource_selector.full_resource_name (for example, //storage.googleapis.com/BUCKET_NAME ) when a request is made specifically for access to a particular resource within that scope. This tool returns a long-running operation object containing an operation name . You must subsequently use the get_iam_policy_analysis_status tool with this name to poll the status until the done field is true .

  03
• get_iam_policy_analysis_status

  Polls the status of a long-running IAM Policy Analyzer operation. Use this only to pass the operation name returned by the export_iam_analysis_results tool. If the operation is finished, the done field will be true .

  04

• Google marks this service Preview in its supported-products catalog.

• official server catalog

  Official Google Cloud catalog lists this product as an available remote MCP server.

• official setup guide

  Google Cloud describes remote MCP client setup, Streamable HTTP transport, supported authentication options, and ADC setup.

• official authentication guide

  Google documents supported identity types and authorization requirements for Google Cloud MCP calls.

• official tool reference

  Google Cloud product MCP reference for Cloud Asset Inventory tool surface and endpoint.

• official tool schema

  Official list_assets schema documents project-only parent and asset content/relationship options.

Documentation checked 2026-10-28. Connection has not been runtime tested.