Google Cloud has shipped the remote MCP server that most cloud agents were going to need first. In Empower your agents with the Google Cloud CLI remote MCP server, Prosper Nwankpa and Adam Hwang describe a managed server that packages “the versatility of hundreds of gcloud and bq commands into one single MCP server,” exposed as two tools, run_gcloud_command and run_bq_command, running in “an isolated execution sandbox on Google Cloud infrastructure.” The argument for a CLI over an API is stated plainly: commands “package complex multi-step workflows, validation checks, and high-level operations into unified commands,” and “LLMs are heavily pre-trained on public command-line documentation.” The server is in public preview at no additional charge.
There are no adoption figures, and the content worth keeping is the security design. “Zero ambient credentials: The server isolates execution in a network-restricted proxy boundary with no ambient credentials,” with authentication through Agent Identity, OAuth 2.0 and IAM. “Every command executed through the remote MCP server is run with the permissions of the authenticated caller identity,” with organization policy constraints enforced against the target resource. Model Armor screens prompts and responses, and every tool invocation can be written to Cloud Audit Logs with the caller identity, the OAuth client and the IAM decision, without the command payload. The post is honest that this surface is for agents that cannot install a binary: hosted platforms and web interfaces where “users cannot control or install local packages.”
The catalog holds the surface in two records, and the split is the finding. The Google Cloud Platform provider page lists 8 API pages, and the gcloud tool’s scope runs over the Google Cloud Platform Projects API, the Google Cloud Platform Organizations API where the policy constraints the post enforces are defined, and the Google Cloud Platform Operations API for the long-running work a command starts. The MCP server, delegated identity, auth clarity and error semantics are lit on that record. BigQuery is held as its own provider on the Google BigQuery provider page, with 11 API pages, and the bq tool’s reservations and job monitoring map to the BigQuery Reservation API and the Google BigQuery Jobs API. On that record the MCP server dimension is unlit.
The Kin Scores read 63.4, strong band, for Google Cloud Platform, carried by developer ergonomics at 78.6 and contract quality at 65.3, with contract governance at 18.2, and 43.5, developing band, for BigQuery, with access clarity at 26.3. Agent Readiness is 42.3 against 26.5. The release ships a BigQuery MCP tool, and the BigQuery record the catalog can reach does not yet show a server, because the server lives at a host the platform record owns. That is a seam in how the catalog roots a company’s products, and it is filed on our side. The other observation is about the shape of the thing. Two tools that each accept a command string collapse hundreds of operations into one contract line, which is exactly what a model is good at and exactly what an agentic access profile cannot read. Google has made the whole CLI reachable from a chat window. The contract an agent could inspect before running a command is the command’s own help text.