About Policy Troubleshooter MCP

Google Cloud managed MCP server for Policy Troubleshooter. Exact tool names and accessible operations depend on the published server reference and configured Google Cloud permissions.

What you can use it for

• Analyzes Google Cloud IAM policies to diagnose why a principal has or does not have a specific permission on a resource. This tool examines allow policies, deny policies, and principal access boundary (PAB) policies that impact the principal's access. Use this tool when a user or service account is unexpectedly denied access to a Google Cloud resource, or to verify that a principal has been granted a specific permission. Do not use this tool for troubleshooting Cloud Storage Access Control Lists (ACLs). For diagnosing VPC Service Controls violations, use the VPC Service Controls violation analyzer ( https://docs.cloud.google.com/vpc-service-controls/docs/violation-analyzer ) instead. This tool requires the following parameters: principal (string): The email address of the principal (Google Account or service account) whose access you want to check. Only one principal can be specified per request. Group principals are not supported. full_resource_name (string): The full resource name of the Google Cloud resource, in the format described by https://cloud.google.com/iam/docs/full-resource-names . For example, //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance . permission (string): The IAM permission to check for. For example, storage.buckets.get . Do not pass roles, always pass a single permission. The tool returns an explanation of how the applicable IAM policies affect the final access state.
• Checks the access request associated with the error identifier and explains why the access is blocked by IAM policies. If the error ID is not found by the backend, retry using an exponential backoff strategy. Start with an initial delay of 1m , then retry. If the error ID is not found, double the delay time for each retry attempt (for example, 2m , 4m , 8m , etc.). If the total duration from the first attempt exceeds 60 minutes , terminate the process. Assume that the backend will not be able to provide an explanation for the error. It is possible that troubleshooting for this specific error ID is not supported or there is an issue on the backend. If you are an agent that does not have the capability to wait or understand time, do not retry. Instead, return an error stating that waiting is required to retry finding the error ID, but your environment does not support waiting or tracking time.