Investigate Cloud Run behavior
Find a service, inspect its current configuration and query its request or latency metrics. Give AI concrete resource state and a bounded monitoring interval to work with.
Cloud & infrastructure · MCP integration
Explore Google Cloud from your AI conversation.
Connect your AI client to Google Cloud inventory and monitoring without giving it a service account key. GateRook searches Cloud Asset Inventory, reads current state from supported service APIs and queries Cloud Monitoring. Projects, folders and organizations stay explicit in the connection and its policy.
Connection in GateRook
stage-gcp
Google Cloud
stage / QA- Projects, folders or organizations
- projects/acme-stage
- Credentials source
- adc
- Impersonate
- gw-reader@acme-stage.iam.gserviceaccount.com
- Metrics projects
- acme-stage
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Find Cloud Run services in the stage project.
gcp_describe · arguments
{
"connection": "stage-gcp",
"scope": "projects/acme-stage",
"assetTypes": [
"run.googleapis.com/Service"
],
"limit": 10
}Example result
{
"provider": "gcp",
"scope": "projects/acme-stage",
"mode": "search",
"resources": [
{
"name": "//run.googleapis.com/projects/acme-stage/locations/europe-west1/services/api",
"assetType": "run.googleapis.com/Service",
"location": "europe-west1",
"labels": {
"env": "stage"
}
}
],
"count": 1,
"truncated": false,
"nextCursor": null
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with Google Cloud and AI
Map a project before debugging
Search inventory across the allowed scope for Compute Engine, Cloud SQL, GKE and other resource types, then inspect the specific resources involved in the incident.
Connect cloud and cluster evidence
Use the GCP connector to inspect a GKE cluster and the Kubernetes connector to read workload state within it. Each connection keeps its own permissions and limits.
From service to MCP
How to connect Google Cloud
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select GCP. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare Google credentials
For ADC, run gcloud auth application-default login on the computer running GateRook. Alternatively, prepare a service account key for the protected connection field. Use an identity with the required inventory, monitoring and service read permissions.
Set the project scope
Add a GCP connection named stage-gcp in the stage environment. Enter projects/acme-stage, choose the credential source and optionally configure service account impersonation.
Check monitoring and live reads
Set metrics projects when needed, keep live reads enabled for current resource state, and run Test connection. Check the environment Cloud policy before saving so only intended services and resources are visible.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure Google Cloud in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Projects, folders or organizations | projects/acme-stage | Add the scopes this connection may search. Each scope must be accessible to the configured identity. |
Credentials source | adc | Use Application Default Credentials on this computer, or choose serviceAccountKey and store its JSON in the protected field. |
Impersonate | gw-reader@acme-stage.iam.gserviceaccount.com | Optional service account impersonation. Your source identity must be allowed to impersonate this account. |
Metrics projects | acme-stage | Defaults to the project scopes. Folder and organization scopes need explicit projects for monitoring queries. |
Read current state from service APIs | true | When inspecting a supported resource by full name, read the service API instead of relying only on the inventory snapshot. |
Know what you expose
Google Cloud tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
gcp_describe | Search Cloud Asset Inventory by scope, asset type and query. Pass a returned full resource name to inspect its state, using a live service API when supported. | Read only |
gcp_metrics | Query Cloud Monitoring time series with filters, alignment and reduction; discover recently active metric types or inspect alerts. | Read only |
Before you enable access
- The Google Cloud connector is read-only. It does not deploy services, modify IAM, restart instances or delete resources.
- Cloud Asset search results can lag behind the service. Supported live reads cover Compute Engine, Cloud Run, Cloud SQL, GKE, Pub/Sub, Storage bucket metadata, Cloud Functions and Memorystore.
- A live read returns resource metadata, not arbitrary object contents or secret payloads. Unsupported live routes fall back to inventory data.
- The source identity, impersonation permissions, enabled service APIs and gateway Cloud policy all affect which requests succeed.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
Google Cloud connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Can I use my existing gcloud login?
Use Application Default Credentials, which are separate from a normal gcloud CLI login. The connection form names gcloud auth application-default login as the setup command for ADC.
Are inventory results always current?
No. Cloud Asset Inventory can be minutes behind. Inspect a resource by the full name returned by search to use a live service read where supported, and check whether the response source is live or inventory.
Can I use a folder or organization scope?
Yes, when the configured identity can read that scope. Configure individual metrics projects as well if you want Cloud Monitoring queries; folder and organization scopes do not automatically select monitoring projects.
Keep exploring
Connect the rest of your stack
AWS
Connect Claude, Codex or Cursor to AWS through GateRook. Inspect resources and CloudWatch metrics with scoped regions, local credentials and read-only MCP tools.
Kubernetes
Connect AI to Kubernetes with GateRook. Inspect pods, events and logs over MCP, restrict namespaces, and review rollout restarts or manifest changes before execution.
Redis
Connect Redis to an AI app through MCP. Scan allowed keys, inspect values and TTLs, and troubleshoot cache data with the read-only GateRook connector.
Your infrastructure, on your terms
Bring Google Cloud into the conversation.
Start with one connection. Choose what your AI can do.