Google Cloud launches CLI remote MCP server in preview for AI agents

Why Google is putting the CLI behind MCP

Google Cloud says agents are increasingly performing complex cloud operations, but standardizing how they interact with backend systems remains a challenge. The new server packages hundreds of gcloud and bq commands into one single Model Context Protocol (MCP) server.

The company names two benefits for agents:

• Higher-level abstractions: CLI commands bundle multi-step workflows, validation checks and high-level operations into unified commands, instead of requiring multi-step API orchestration.
• Leverages model training: according to Google Cloud, LLMs are heavily pre-trained on public command-line documentation, syntaxes and usage examples, which makes CLI invocation intuitive and highly accurate for models.

Running the CLI remotely also removes operational work. Teams building custom agents otherwise have to maintain local CLI versions and dependencies across dev, test and production environments. Web-hosted agent platforms, such as Gemini Enterprise and other hosted enterprise agent platforms, run where users cannot install local packages. Google Cloud says remote MCP gives these surfaces secure, managed access to CLI operations.

Security and governance controls

Google Cloud describes several safeguards built on its standard identity and governance frameworks.

• Zero ambient credentials: execution is isolated in a network-restricted proxy boundary with no ambient credentials. Authentication and authorization run through Agent Identity, OAuth 2.0 and Identity and Access Management (IAM).
• Policy enforcement: every command runs with the permissions of the authenticated caller identity. Standard IAM permissions and organization policy service constraints are enforced against downstream target resources.
• Model Armor: the server integrates with Model Armor, so LLM prompts and responses can be screened for risks such as prompt injection and malicious inputs.
• Audit logging: the server can be configured to log every tool invocation to Data Access audit logs under cloudcli.googleapis.com/mcp. Security teams can see caller identities, OAuth clients and IAM authorization decisions without exposing sensitive command payloads or personally identifiable information.

Two tools: run_gcloud_command and run_bq_command

The server exposes two tools. With run_gcloud_command, agents can execute the full breadth of gcloud operations to manage, diagnose and secure a Google Cloud environment. Google Cloud gives observability and incident diagnostics as an example, where an agent automates command execution and reduces context-switching across tools.

The run_bq_command tool extends the existing BigQuery MCP server, which already helps organizations analyze and explore data with agents. Google Cloud says the new tool unlocks the full scope of the bq CLI for advanced tasks such as resource allocation, job monitoring and task scheduling. Named capabilities include:

• Automating scheduled queries through BigQuery Data Transfer Service configurations.
• Inspecting query execution details, including processed data volume, slot usage and execution plans, and managing reservations.
• Letting data administrators and owners inspect and update table permissions through the agent.

Connecting, pricing and availability

Because the server implements the standard Model Context Protocol, any MCP-compatible agent platform or orchestration runtime can connect through standard configuration pointing to https://cloudcli.googleapis.com/mcp. Authentication uses keyless Agent Identity for hosted Google Cloud platforms, or standard OAuth 2.0 for external runtimes.

The server is available in public preview. Google Cloud states there is no additional charge for the MCP server itself. Users pay only for the GCP resources they create and any applicable data transfer costs.

To start, enable the Cloud CLI Execution API (cloudcli.googleapis.com) in a Google Cloud project, grant the MCP Tool User (roles/mcp.toolUser) IAM role to the agent or user identity, and configure the MCP client to connect to cloudcli.googleapis.com/mcp.

What it means for teams building agents

For developers, the main change is operational: agent containers no longer need to bundle Google Cloud CLI binaries or manage local runtimes. For hosted platforms like Gemini Enterprise, it offers a managed route to gcloud and bq operations. Since commands run under the caller's own IAM permissions and can be audited, security teams keep their existing controls over what an agent can do.