Build a Gemini Enterprise Agent Platform Remote MCP Server to Connect External Agents to Google Cloud

On June 30, 2026, Google Cloud turned its Gemini Enterprise Agent Platform into an MCP server — a fully managed, remote Model Context Protocol server that lets external AI agents connect to the Agent Platform resources inside a Google Cloud environment. The release followed the April 28 announcement that 50+ Google-managed MCP servers were generally available or in preview, and it is the piece that makes the whole catalog usable: a governed front door for agents built outside Google Cloud — Antigravity CLI, Claude Code, Cursor, or any custom application — to call models from Model Garden, pull down shared prompt templates, manage Notebooks, and operate endpoints without ever leaving their IDE. Google's framing is precise: "Think of the Agent Platform MCP server as a bridge between your favorite external development tools and your Google Cloud architecture." It is also emphatically not the BigQuery MCP server — this is agent orchestration and remote agent access over the aiplatform host, not warehouse SQL. This guide walks through how the remote server works over streamable HTTP, how to configure Claude Code, Cursor, and custom clients, and how to build a Python FastMCP governance bridge that re-exposes curated Agent Platform resources as typed tools. Keep the managed-server catalog open in the MCP directory as you follow along.

How the remote MCP server works

The Agent Platform remote MCP server is remote, not local: it runs on Google's infrastructure and exposes an HTTP endpoint over streamable HTTP, the MCP transport that replaced SSE with a single endpoint handling both client-to-server requests and server-to-client streams. There is no stdio process to spawn on your machine, no SDK to install — a client sends an HTTP POST with the MCP JSON-RPC payload and receives the response over the same connection.

The three-step connectivity model from the launch post:

1. Enable the API. Enabling the Gemini Enterprise Agent Platform API (project id aiplatform.googleapis.com) also enables the remote MCP server.
2. Configure the client. Point your AI application at the server URL and authenticate.
3. Use the toolsets. Each toolset is a path on the host; the server exposes eight of them.

Every endpoint shares the same host and authentication model, so connecting is a one-line URL change per toolset.

The transport and credential shape

The server URL is https://aiplatform.googleapis.com plus the toolset path — for example https://aiplatform.googleapis.com/mcp/generate for the generation tools. The request pattern is standard MCP over HTTP, and surprisingly, tools/list does not require authentication, so you can inspect the surface before authorizing:

POST /mcp HTTP/1.1
Host: aiplatform.googleapis.com
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc": "2.0", "method": "tools/list", "params": {}, "id": 1}

Tool calls do require credentials, because the server augments each call with the caller's principal. The authentication model is OAuth 2.0 combined with IAM, and all Google Cloud identities are supported. Two scopes matter:

For agent workloads, Google recommends creating a dedicated identity for agents so access stays controllable and monitorable, and API keys are acceptable only when bound to a service account so IAM still has a principal to evaluate.

Step 1: Enable the API and grant IAM roles

gcloud projects describe MY-PROJECT --format="value(projectId)"

gcloud services enable aiplatform.googleapis.com --project MY-PROJECT

gcloud projects add-iam-policy-binding MY-PROJECT   --member="serviceAccount:agent-builder@MY-PROJECT.iam.gserviceaccount.com"   --role="roles/mcp.toolUser"

gcloud projects add-iam-policy-binding MY-PROJECT   --member="serviceAccount:agent-builder@MY-PROJECT.iam.gserviceaccount.com"   --role="roles/aiplatform.user"

roles/mcp.toolUser permits MCP tool calls and roles/aiplatform.user permits managing Agent Platform resources. For org-wide lockdown, Google ships roles/mcp.denyAllToolUse as an IAM Deny policy so external frameworks can only reach authorized resources — the control you reach for when the cogs start spinning faster than the approvals.

Step 2: Wire external clients

Claude Code treats the remote server like any URL-based MCP server:

claude mcp add --transport http agent-platform https://aiplatform.googleapis.com/mcp/generate
claude mcp login agent-platform

The login command opens your browser for the OAuth flow; once authorized, the generation toolset appears in /mcp. Because it is a resource-level server stamped with your outer identity, it also appears at the user scope in other Anthropic clients signed into the same account.

Cursor goes in mcp.json:

{
  "mcpServers": {
    "agent-platform": {
      "type": "http",
      "url": "https://aiplatform.googleapis.com/mcp/generate"
    }
  }
}

A custom agent is plain HTTP: exchange your application credentials or a service-account token for a bearer access token bound to the aiplatform scope, then send it as the Authorization header on every request to the toolset endpoint. No Google SDK is required on the client side — the open MCP spec, a JWT grant, and one header is the entire integration, which is the whole point of the standard.

Step 3: Build the FastMCP governance bridge

The managed server is complete; a bridge exists to make it your surface. agent-platform-bridge curates tools, freezes their inputSchema, stamps audit metadata, and fire-tests each toolset endpoint before machine operators ever touch it.

mkdir agent-platform-bridge && cd agent-platform-bridge
python -m venv .venv && source .venv/bin/activate
pip install "fastmcp[cli]" httpx google-auth

# bridge.py
import os
import json
import time
import threading

import httpx
from google.auth import default
from google.auth.transport.requests import Request
from fastmcp import FastMCP

HOST = "https://aiplatform.googleapis.com"
mcp = FastMCP("agent-platform-bridge", instructions=(
    "Curated tools over Google Cloud Agent Platform. Read and list operations only; "
    "destructive actions are not exposed here."
))

_token = {"value": None, "exp": 0}
_lock = threading.Lock()
_SCOPE = "https://www.googleapis.com/auth/aiplatform"


def _token_value():
    with _lock:
        if _token["value"] and _token["exp"] > time.time() + 120:
            return _token["value"]
        creds, _project = default(scopes=[_SCOPE])
        creds.refresh(Request())
        _token.update({"value": creds.token, "exp": creds.expiry.timestamp()})
        return _token["value"]


def _call(toolset: str, method: str, params: dict | None):
    r = httpx.post(f"{HOST}{toolset}",
                   headers={"Authorization": f"Bearer {_token_value()}"},
                   json={"jsonrpc": "2.0", "method": method,
                         "params": params or {}, "id": 1},
                   timeout=120)
    r.raise_for_status()
    return r.json().get("result") or r.json()


@mcp.tool()
def list_models() -> str:
    """List models registered in the project's model registry."""
    return json.dumps(_call("/mcp/models", "tools/call",
                            {"name": "list_models", "arguments": {}}), indent=2)


@mcp.tool()
def generate_content(project_id: str, location: str, model_name: str, prompt: str) -> str:
    """Call a Model Garden generation model with a prompt."""
    return json.dumps(_call("/mcp/generate", "tools/call",
                            {"name": "generate_content",
                             "arguments": {
                                 "project_id": project_id,
                                 "location": location,
                                 "model_name": model_name,
                                 "prompt": prompt}}), indent=2)


@mcp.tool()
def list_prompt_templates(project_id: str) -> str:
    """List shared prompt templates in the agent's project."""
    return json.dumps(_call("/mcp/prompts", "tools/call",
                            {"name": "list_prompt_templates",
                             "arguments": {"project_id": project_id}}), indent=2)


@mcp.tool()
def get_notebook(project_id: str, notebook_id: str) -> str:
    """Return metadata for a Colab Enterprise notebook runtime."""
    return json.dumps(_call("/mcp/notebook", "tools/call",
                            {"name": "get_notebook",
                             "arguments": {"project_id": project_id,
                                           "notebook_id": notebook_id}}), indent=2)


@mcp.tool()
def list_endpoints(project_id: str, location: str) -> str:
    """List deployed model endpoints in a location."""
    return json.dumps(_call("/mcp/endpoints", "tools/call",
                            {"name": "list_endpoints",
                             "arguments": {"project_id": project_id,
                                           "location": location}}), indent=2)


@mcp.tool()
def list_tuning_jobs(project_id: str, location: str) -> str:
    """List fine-tuning jobs with status and metrics endpoints."""
    return json.dumps(_call("/mcp/tuning", "tools/call",
                            {"name": "list_tuning_jobs",
                             "arguments": {"project_id": project_id,
                                           "location": location}}), indent=2)


if __name__ == "__main__":
    mcp.run()

The bridge swaps Application Default Credentials for a bearer token scoped to aiplatform, calls the managed toolset with the standard tools/call method wrapped inside the standard MCP POST, and only surfaces read/list tools — no delete anywhere. The managed server does the heavy lifting; the bridge confines the blast radius.

Step 4: inputSchema definitions published to agents

{
  "generate_content": {
    "type": "object",
    "properties": {
      "project_id": { "type": "string", "description": "Google Cloud project id" },
      "location": { "type": "string", "description": "Region, e.g. us-central1 or global" },
      "model_name": { "type": "string", "description": "Model Garden model name, e.g. gemini-2.5-pro" },
      "prompt": { "type": "string", "description": "User prompt for generation" }
    },
    "required": ["project_id", "location", "model_name", "prompt"]
  },
  "list_endpoints": {
    "type": "object",
    "properties": {
      "project_id": { "type": "string" },
      "location": { "type": "string" }
    },
    "required": ["project_id", "location"]
  },
  "list_tuning_jobs": {
    "type": "object",
    "properties": {
      "project_id": { "type": "string" },
      "location": { "type": "string" }
    },
    "required": ["project_id", "location"]
  }
}

The schema is deliberately thin — the bridge curates, so the agent never sees the full Google control-plane surface, only the five operations your platform approved.

IAM and OAuth 2.0 security guide

• Per-agent identity. Create a dedicated service account per agent (for example agent-builder) and grant roles/mcp.toolUser plus roles/aiplatform.user only on the projects it must reach. Never share a broad human credential with machine agents.
• Least-privilege scoping. Prefer https://www.googleapis.com/auth/aiplatform over cloud-platform for agents that only manage Agent Platform resources; cloud-platform is a bazooka. Keep API keys bound to the service account — unbound keys carry no IAM principal and should be rejected.
• Org-wide Deny policies. roles/mcp.denyAllToolUse is the emergency brake: an org-level IAM Deny that stops uncontrolled MCP use before it starts, forcing every new server through a request-and-approve workflow.
• Model Armor screening. Route MCP prompts and responses through Model Armor so malicious inputs, prompt injection, and sensitive-data leaks are detected before they reach the model or your logs. Confirm the region routing if you have data-residency requirements, since Model Armor is region-bound.
• Centralized audit logging. Every tool call that traverses the managed server is written to Cloud Audit Logs. The bridge adds its own layer, tagging calls with agent, tool, project, and location so a security or agent workflow review can reproduce exactly what an external agent did inside the cloud.
• Token lifecycle. OAuth tokens rotate as short as possible inside the bridge; the google.auth helper refreshes from ADC automatically. Never paste an access token into a committed config — machine agents should derive it at call time, the way Claude Code's browser login does at the human layer.

Wiring to LangGraph and custom agents

The bridge is a plain stdio MCP server, so LangGraph integrates the standard way:

from langchain_mcp_adapters.tools import load_mcp_tools
from langgraph.prebuilt import ToolNode
from mcp import StdioServerParameters

params = StdioServerParameters(command="python",
                               args=["/absolute/path/to/agent-platform-bridge/bridge.py"],
                               env={"GOOGLE_APPLICATION_CREDENTIALS": "credentials.json"})
# async: async with stdio_client(params) as client: tools = await load_mcp_tools(client)
# tools -> ToolNode(tools) -> your graph node

A planning node picks a Model Garden model, a generation node calls generate_content, a review node lists evaluation results — all under a single IAM identity, all in the audit log, all in one graph. For the broader patterns this unlocks, the agent workflow library is a useful starting point.

Testing the connection

> list_models()
  → [{"name": "gemini-2.5-pro", "state": "READY"},
     {"name": "gemini-2.5-flash", "state": "READY"}]

> generate_content("my-project", "global", "gemini-2.5-flash",
                   "Summarize this release notes file in one line")
  → candidates[0].finish_reason == "STOP"

> list_tuning_jobs("my-project", "us-central1")
  → [{"name": "tuning-9301", "status": "SUCCEEDED", "evaluation_metrics": {...}}]

Run the same calls against the raw endpoints with curl first (supplying the bearer token), then through the bridge — identical results, saner schema. To verify governance, attempt delete through the bridge and watch it fail at the tool layer, not the cloud layer.

Frequently Asked Questions

What is the Gemini Enterprise Agent Platform remote MCP server?

It is a fully managed, remote Model Context Protocol server launched June 30, 2026 that exposes Agent Platform resources — Model Garden models, prompt templates, notebooks, endpoints, tuning jobs, evaluations — as MCP tools. External agents built outside Google Cloud connect over streamable HTTP and OAuth 2.0 without any local server.

How is this different from BigQuery's MCP server?

Completely different surfaces. BigQuery MCP runs SQL against data warehouses; Agent Platform MCP is agent orchestration and remote agent access — predictive and generative ML resource management on the aiplatform host. It manages models, endpoints, prompts, and notebooks rather than answering queries against tables.

How does authentication work without a client secret?

Clients authenticate with OAuth 2.0 rather than static keys. IDEs like Claude Code run a browser-based login via claude mcp login, and custom agents exchange a service-account token or application credentials for a short-lived bearer token bound to the aiplatform scope at call time.

Which IAM roles do agents need?

Two roles at minimum on the project: roles/mcp.toolUser to make MCP tool calls and roles/aiplatform.user to manage Agent Platform resources. You can add roles/mcp.denyAllToolUse as an org-wide Deny policy to block uncontrolled MCP use entirely.

Should I build a FastMCP bridge if the managed server already has eight toolsets?

Only if you need governance or ergonomics. A bridge curates the surface (list, get, generate but no delete), adds audit logging, freezes inputSchema for your agents, and test-fires single endpoints. For one-off work, point your client at the managed toolset directly.

Closing thoughts

The Agent Platform remote MCP server is Google Cloud's clearest statement that MCP is now enterprise infrastructure: a managed, streamable-HTTP, IAM-gated bridge between the agent ecosystems developers actually live in and the Vertex-managed ML platform they deploy to. With eight toolsets, per-agent identities, org-wide Deny policies, and Model Armor screening, the connection layer is no longer the thing you build — it is the thing you govern. Point Antigravity, Claude Code, or Cursor at /mcp/generate today, then add a bridge only where your compliance surface demands it. Catalog the rest of the 50+ managed servers in the MCP directory, study how they compose in agent workflows, and follow AI news as Google ships more around this front door.