# Cloud Asset Inventory MCP
> Google Cloud managed MCP server for Cloud Asset Inventory. Exact tool names and accessible operations depend on the published server reference and configured Google Cloud permissions.
Canonical: https://www.mcpfolio.com/servers/google-cloud-cloud-asset-inventory
Last updated: 2026-10-28
## Catalog record

- Publisher: Google Cloud
- Categories: database, cloud-service, cloud-storage

## Website

https://docs.cloud.google.com/asset-inventory/docs/reference/mcp

## Transports

Streamable HTTP

## Authentication

Google Cloud authentication: OAuth 2.0 using Application Default Credentials (ADC) in supported Google clients, or a client OAuth ID/secret or bearer token in compatible third-party clients. The principal needs mcp.tools.call plus the underlying product permissions; API key authentication is only available for services that explicitly support it.

## Tools

- **list_assets**: List assets from Cloud Asset Inventory
- **analyze_iam_policy**: Analyzes Google Cloud IAM allow policies to determine who can do what on which resources. It can perform policy analysis such as finding resources accessible to a principal, finding principals with access to a resource, or checking access paths. This tool requires the analysis_query parameter, which specifies the root container where policies are analyzed ( scope ) and offers optional selectors for resource names, principal identifiers, and applicable roles and permissions. Folder and Organization scopes are not supported. scope must be a project scope ( projects/PROJECT_ID ). When analyzing policies in a specific project (for example, 'in PROJECT_ID '), set scope to projects/PROJECT_ID and do not set resource_selector . Only set resource_selector.full_resource_name (for example, //storage.googleapis.com/BUCKET_NAME ) if the user specifically asks for access to a particular resource within that scope. If a project scope is not specified in the request, confirm the scope before calling this tool. If execution_timeout is not specified in the request, set execution_timeout to 60s as a string with suffix 's'. You can also provide options to expand_groups , expand_roles , expand_resources (default false ), and analyze_service_account_impersonation (default false ). For supported policy types, see https://docs.cloud.google.com/policy-intelligence/docs/policy-analyzer-overview#supported-policy-types . For BYOID support, see https://docs.cloud.google.com/iam/docs/federated-identity-supported-services#policy-intelligence .
- **export_iam_analysis_results**: Analyzes Google Cloud IAM policies asynchronously and exports the results to a BigQuery dataset or Google Cloud Storage bucket. Use this for large-scale analysis (for example, expanding resources or impersonation). This tool requires the analysis_query parameter, which specifies the root container where policies are analyzed ( scope ) and offers optional selectors for resource names, principal identifiers, and applicable roles and permissions. Folder and Organization scopes are not supported; scope must be a project scope (for example, projects/PROJECT_ID ). When analyzing policies in a specific project (for example, 'in PROJECT_ID '), set scope to projects/PROJECT_ID and do not set resource_selector . Only set resource_selector.full_resource_name (for example, //storage.googleapis.com/BUCKET_NAME ) when a request is made specifically for access to a particular resource within that scope. This tool returns a long-running operation object containing an operation name . You must subsequently use the get_iam_policy_analysis_status tool with this name to poll the status until the done field is true .
- **get_iam_policy_analysis_status**: Polls the status of a long-running IAM Policy Analyzer operation. Use this only to pass the operation name returned by the export_iam_analysis_results tool. If the operation is finished, the done field will be true .

## Sources

- [official_server_catalog](https://docs.cloud.google.com/mcp/supported-products)
- [official_setup_guide](https://docs.cloud.google.com/mcp/configure-mcp-ai-application)
- [official_authentication_guide](https://docs.cloud.google.com/mcp/authenticate-mcp)
- [official_tool_reference](https://docs.cloud.google.com/asset-inventory/docs/reference/mcp)
- [official_tool_schema](https://docs.cloud.google.com/asset-inventory/docs/reference/mcp/tools_list/list_assets)

## Setup

Use the interactive setup panel on [the detail page](https://www.mcpfolio.com/servers/google-cloud-cloud-asset-inventory) to view instructions for each supported client.