MCP Servers in Gemini Enterprise: Connect Custom Tools and Data Securely With the Model Context Protocol

The Model Context Protocol (MCP) has become the standard way to give AI agents tools. Instead of building a custom integration for each AI product, you build one MCP server for your system (an internal ticketing tool, a pricing database, a homegrown CRM) and any MCP-capable agent can use it. Gemini Enterprise supports custom MCP servers too: this guide shows what a Gemini MCP server needs, how to connect one, and how to keep its actions safe.

Gemini Enterprise supports MCP in three places: custom MCP server data stores for chat and agents, MCP steps and tools in Workflow Builder, and MCP servers in Agent Registry for Agent Studio and Agent Platform. This guide covers how to connect an MCP server, the security model, Google’s Workspace MCP servers, and design tips for MCP server developers.

If you’re new to how agents talk to other agents, see yesterday’s post on the A2A protocol: MCP is the agent-to-tool counterpart.

Table of contents

Open Table of contents

• Where MCP Fits in Gemini Enterprise
• Requirements Before You Start
• Step-by-Step: Connect a Custom MCP Server
• Enabling Actions
• MCP in Workflow Builder
• Google’s Workspace MCP Servers
• Security Model
• Example: Connecting an Internal Ticketing System
• Tips for MCP Server Developers
• Conclusion

Where MCP Fits in Gemini Enterprise

Custom MCP server data stores became generally available in August 2026, off by default. A no-authentication option was added in Preview in July 2026.

---

Requirements Before You Start

Server requirements

Admin and policy requirements

• IAM: Discovery Engine Editor (roles/discoveryengine.editor)
• Organization policy: override the constraint that blocks custom MCP data store creation, and allow the domains (FQDNs, not full URLs) of the MCP server, authorization URL, and token URL
• VPC Service Controls / project enforcement: add custom_mcp to the allowed data sources
• OAuth client: register Gemini Enterprise with your identity provider (Okta, Microsoft Entra ID, Google, or another) with the redirect URL https://vertexaisearch.cloud.google.com/oauth-redirect

---

Step-by-Step: Connect a Custom MCP Server

1. Google Cloud console → Gemini Enterprise → Data stores → Create data store
2. Search for Custom MCP Server → Add MCP server
3. Choose the authentication option and fill in the fields (below)
4. For OAuth, click Verify Auth, then Continue
5. Choose the data connector location (multi-region), name it, and click Create
6. Wait for the state to go from Creating to Active
7. Enable actions (next section), then connect the data store to your app

OAuth fields

With OAuth, each user authorizes the connector and the server sees the user’s own token, so the MCP server can apply that user’s permissions. That’s the model to prefer for anything with per-user data.

No-authentication option

Select No authentication and enter only the server URL. Use it for genuinely public, read-only tools (a public product catalog, a holiday calendar), never for internal data.

---

Enabling Actions

Every tool the server exposes is imported as an action, and all actions are off by default.

1. Open the data store → Actions → Reload custom actions (this re-authenticates and runs the MCP tools/list call)
2. Select up to 100 actions
3. Click Enable actions

Reload whenever the server’s tools or annotations change.

Confirmation and tool annotations

By default, every action call requires user confirmation. Server developers control this with standard MCP tool annotations:

This is a sensible default: lookups feel instant, while anything that writes, sends, or deletes asks first.

---

MCP in Workflow Builder

Workflow Builder uses the same custom MCP data stores in two ways:

See our Workflow Builder guide for triggers, approvals, and limits. Google’s Workflow Builder quotas page caps a flow at 100 nodes and 20 skills per node, and an agent at 100 linked MCP servers.

---

Google’s Workspace MCP Servers

Google has also published MCP servers for Google Workspace, which can be added to Gemini Enterprise as custom MCP data stores:

What they enable: natural-language search and summaries across email, files, events, Chat messages, and contacts, plus drafting emails and cross-service tasks (“find the Q3 deck, summarize it, and draft an email to the team”).

Requirements (from Google’s codelab):

• Enrollment in the Google Workspace Developer Preview Program
• Gemini Enterprise Standard or Plus
• A Business or Enterprise Google Workspace account with Chat access and smart features on
• Overriding the custom MCP organization policy, enabling the Workspace MCP service APIs, an OAuth consent screen with the right scopes, and one custom MCP data connector per service

Most scopes are read-only; write-capable scopes include Gmail compose, Drive file access, Docs/Sheets/Slides editing, and Chat message creation. Calendar scopes are read-only. Because this is a developer preview, treat it as a pilot, not a production dependency: the generally available Google Drive, Gmail, and Calendar connectors remain the standard option (see our connectors guide).

---

Security Model

What Google builds in

• Actions off by default: nothing runs until an admin enables it
• User confirmation by default for every action call
• Per-user OAuth: the server receives the user’s token, preserved in the Authorization header (on Cloud Run, a Google-signed ID token is sent in a separate header)
• Organization policy: custom MCP creation is blocked unless explicitly allowed, and allowed domains are listed explicitly

What you must add

• Agent Gateway routing. Google notes that outbound MCP traffic bypasses Agent Gateway unless you configure egress routing under Advanced options when creating the data store. Configure it for anything sensitive.
• Model Armor. Enable it to screen malicious inputs and outputs: MCP tool results can carry prompt-injection attempts.
• Least-privilege scopes. Request only the OAuth scopes the enabled tools need.
• Server-side authorization. The MCP server should check the user’s permissions on every call, not trust the agent.
• Logging. Log tool calls with the user identity on the server side for audit.

Threats to plan for

---

Example: Connecting an Internal Ticketing System

Say your IT team runs a homegrown ticketing system and wants employees to check and create tickets from Gemini Enterprise.

1. Build the MCP server with three tools: search_tickets(query) and get_ticket(ticket_id) marked readOnlyHint: true, and create_ticket(summary, category, urgency) marked with destructiveHint.
2. Host it on Cloud Run with Streamable HTTP at https://tickets-mcp.example.com/mcp, behind a load balancer with a public CA certificate.
3. Register an OAuth client in your identity provider with the Gemini Enterprise redirect URL, so the server receives each user’s token and only returns tickets that user may see.
4. Allow the domains in the custom MCP organization policy, then create the data store and Verify Auth.
5. Reload and enable the three actions; turn on Agent Gateway egress routing and Model Armor.
6. Pilot with the IT team: searches run instantly, while “create a ticket” asks the user to confirm first.

Result: employees ask “what’s the status of my laptop request?” in Gemini Enterprise and get an answer from the ticketing system, with per-user permissions and an audit trail on the server.

---

Tips for MCP Server Developers

1. Design narrow tools. get_order_status(order_id) beats query_database(sql).
2. Write descriptions for the model. Say exactly when to use the tool and what each parameter means.
3. Annotate honestly. Mark lookups readOnlyHint: true; mark anything that changes data with destructiveHint.
4. Enforce permissions server-side using the user’s OAuth token.
5. Return concise, structured results. Large unfiltered dumps waste tokens and confuse the model.
6. Support Streamable HTTP and a public CA certificate from day one.
7. Version carefully. Tool changes take effect after an admin reloads actions: communicate changes.

---

Conclusion

MCP lets you plug any internal system into Gemini Enterprise once and use it everywhere: in chat, in agents, and in Workflow Builder automations. The setup is straightforward (Streamable HTTP, HTTPS with a public certificate, OAuth, and an organization policy override), and Google’s defaults are cautious: actions off until enabled, confirmation on every call unless a tool is marked read-only.

The parts that need your attention are the ones that sit outside Google’s defaults: route MCP traffic through Agent Gateway, turn on Model Armor, keep tools narrow, and enforce permissions on the server. Do that, and MCP becomes the fastest way to make Gemini Enterprise genuinely useful with the systems your teams (in Google Workspace and beyond) rely on every day.

---

Official Google documentation:

• Set up your custom MCP server data store
• Connect MCP servers in Workflow Builder
• Google Workspace MCP server connectors in Gemini Enterprise (codelab)
• Agent Registry overview

Related reading:

• Agent2Agent (A2A) Protocol Explained: the agent-to-agent counterpart to MCP.
• Gemini Enterprise Workflow Builder Guide: use MCP servers in automated workflows.
• Gemini Enterprise Connectors and Data Stores: the built-in connectors.