Set up your custom MCP server data store

This page explains how to connect your data sources using a custom Model Context Protocol (MCP) server, letting Gemini Enterprise securely access your company's private data.

The custom MCP data store lets you integrate public tools, as well as MCP-compliant third-party systems, directly into Gemini Enterprise. This approach provides a unified method to connect legacy systems when standard connectors are unavailable. With this integration, your AI agents can access business-critical information and specialized logic within your infrastructure.

Limitations

The custom MCP server has the following limitations:

  • Server-Sent Events (SSE): The old SSE transport is not supported. The connector exclusively supports the new StreamableHTTP transport.
  • TLS certificate requirement: Both public and private MCP servers must be configured with a TLS certificate signed by a publicly trusted Certificate Authority (CA). Self-signed certificates are not supported.
  • Actions limit: To ensure optimal performance, limit the number of enabled actions in your custom MCP server data store to 100 at a time. For more information, see Enable actions.
  • Existing data stores: Connecting to an existing data store is not supported. You must create and register a new custom MCP server data store directly within your Gemini Enterprise app.
  • VPC Service Controls: Egress controls are enforced through organization policy constraints, such as allowedEgressFqdns and allowedDataSources, rather than runtime traffic enforcement. Custom MCP servers are supported in VPC Service Controls-enabled projects when you explicitly allow the required egress domains and data sources. For more information, see Override the organization policy for Custom MCP data stores.

Before you begin

Before you set up your custom MCP server connection, ensure you perform the following:

  • Several organization policy constraints apply to Custom MCP data stores. You must:

    • Override the organization policy constraint that blocks Custom MCP data store creation. For more information, see Override the organization policy for Custom MCP data stores.

    • Explicitly allow the fully qualified domain names (FQDNs) for your custom MCP server URL, authorization URL, and token URL. For more information, see Configure allowed egress FQDNs.

    • If project enforcement is enabled or the project is VPC Service Controls-protected, you must add custom_mcp to the allowed data sources. See Configure allowed data sources.

  • Grant the Discovery Engine Editor role (roles/discoveryengine.editor). This role is required for your administrator to create the data store.

    To grant this role, do the following:

    1. In the Google Cloud console, go to the IAM page.

      Go to IAM

    2. Locate the user account, and click the edit Edit icon.

    3. Grant the Discovery Engine Editor role to your user. For more information, see IAM roles and permissions.

  • Register Gemini Enterprise as an OAuth client application with your identity provider (for example, Okta, Azure AD, or Google).

    To register the app, do the following:

    1. Set the authorization redirect URL to https://vertexaisearch.cloud.google.com/oauth-redirect.

    2. Grant necessary OAuth scopes to the client app.

    After you register the client app, obtain the client_id and client_secret that are needed for configuring the custom MCP server data store in the following steps.

  • If your custom MCP server is hosted on Cloud Run and requires authentication, grant the Cloud Run Invoker (roles/run.invoker) role to the service agent. For more information, see Set up authentication for a custom MCP server on Cloud Run.

    • Set up authentication for a custom MCP server on Cloud Run

    If your custom MCP server is hosted on Cloud Run and requires authentication, Gemini Enterprise can securely connect to private services that do not allow public access.

    How authentication works

    When you connect to a Cloud Run service, Gemini Enterprise automatically sends the following authorization headers in each request:

    • X-Serverless-Authorization: Contains a Google-signed ID token that authenticates the Gemini Enterprise service agent.
    • Authorization: Preserves the user's OAuth token intact.

    Grant access to the service agent

    To authorize Gemini Enterprise to invoke your private Cloud Run service, grant the Cloud Run Invoker (roles/run.invoker) role to the Gemini Enterprise service agent on the receiving service.

    The service agent email uses the following format: service-PROJECT_NUMBER@gcp-sa-discoveryengine.iam.gserviceaccount.com

    Replace PROJECT_NUMBER with the project number of the Google Cloud project that hosts your Gemini Enterprise app.

    For instructions on how to grant IAM roles on a service, see Authenticating service-to-service.

    Create the custom MCP server data store

    To set up the configuration flow, follow these steps:

    1. In the Google Cloud console, go to the Gemini Enterprise page.

      Gemini Enterprise

    2. In the navigation menu, click Data stores.

    3. Click Create data store.

    4. On the Select a data source page, enter Custom MCP Server into the Search sources field. The Custom MCP Server card displays.

    5. Click Add MCP server. The MCP Server Configuration page displays.

    6. In the Authentication settings section, select one of the following options:

      • No authentication: Select this option if your MCP server does not require authentication.

        1. Enter the MCP Server URL. This is the endpoint where your MCP server is hosted. It must be an HTTPS URL. Gemini Enterprise only supports the StreamableHTTP transport. The URL often ends with /mcp. For example, https://mcp.example.com/mcp.

        2. Click Continue.

      • OAuth 2.0: Select this option to add authentication.

        1. Enter the values in the following required fields:

          Field Description
          MCP Server URL This is the endpoint where your MCP server is hosted. It must be an HTTPS URL. Gemini Enterprise only supports the StreamableHTTP transport. The URL often ends with /mcp. For example, https://mcp.example.com/mcp.
          Authorization URL The base URL for the user to authorize Gemini Enterprise to access your MCP server. For example, https://mcp.example.com/authorize.
          Authorization URL Parameters Optional. Any additional parameters required by your authorization URL. For example, to get a refresh token from a Google MCP server, enter &access_type=offline&prompt=consent.

          If your authorization server requires an audience parameter, you can add it as a parameter in this setting. For example, &audience=https://api.your-domain.com/v1/.
          Token URL The endpoint used to exchange the authorization code for an access token during OAuth authentication. For example, https://mcp.cymbal.com/token.
          Client ID The unique identifier of the OAuth app that you registered in your identity provider to represent Gemini Enterprise.
          Enable PKCE Support Optional. Select this checkbox to enable Proof Key for Code Exchange (PKCE, RFC 7636) for additional OAuth security. We recommend this setting if your MCP server's OAuth provider supports PKCE.
          Client Secret The confidential key associated with the OAuth app that you registered in your identity provider to represent Gemini Enterprise.
          Scopes The permissions that define what actions Gemini Enterprise is allowed to perform on behalf of a user, or what data it's allowed to access. The scopes are used to access the MCP server. Gemini Enterprise requests these scopes during user authorization. Ensure that your OAuth app is configured to use these scopes.

          When you specify scopes, consider the following:
          • Provide a space-separated list of scopes. For example, for Box, you provide: root_readwrite manage_managed_users manage_groups.
          • Ensure the scopes provided are sufficient to let the user sign in and use the tools or actions enabled by the administrator; otherwise, the agent cannot access your app.
          • A common scope is offline_access, which lets the app request a refresh token.

        2. Click Verify Auth.

        3. Click Continue.

    1. Click Continue.

    2. In the Configure your data connector section, select the Location of your data connector from the Multi-region field list.

    3. In Your data connector name field, enter a name for your data store.

    4. Click Create. Gemini Enterprise creates your data store and displays your data stores on the Data Stores page.

    Verify the state of the custom MCP server

    To verify the state of the custom MCP server, do the following:

    1. Click your data store in the Data stores list. The details of your data store display.

    2. Monitor the state of your data store until it changes to Active. After the state of your data store changes from Creating to Active, your custom MCP server data store is ready to be used.

    Enable actions

    By default, all actions are turned off. When you connect an MCP server, all of its tools are imported and displayed as actions in the Gemini Enterprise data store. To ensure an optimal experience, you can enable up to 100 actions at a time. To enable these actions for your users, follow these steps:

    1. Go to your custom MCP server data store.

    2. Click Actions > Reload custom actions to reauthenticate.

    3. Select the actions to enable.

    4. Click Enable actions.

    Configure annotations to skip user confirmation

    When tools from your MCP server are imported as actions into the Gemini Enterprise data store, Gemini Enterprise checks their tool annotations to determine if user confirmation is required. By default, all calls to any action require confirmation from the user, because Gemini Enterprise assumes that any operation is potentially destructive and can mutate data.

    If your server provides read-only functionality (such as querying a database) and you want to skip this confirmation for a smoother user experience, you can configure annotations in the specifications of your MCP tools before they are imported as actions.

    We recommend configuring the following annotations in your MCP tool definitions to manage user confirmation for data store actions:

    • readOnlyHint: Add this annotation to your tool definition if the operation is non-destructive and only reads data. The tool execution bypasses user confirmation.
    • destructiveHint: Explicitly use this annotation if the tool modifies data. This maintains the default confirmation behavior.

    For example, in Python:

    @mcp.tool(annotations={
       "destructiveHint": False,
       "readOnlyHint": True
   })

    To ensure that your changes are reflected in your setup, reload custom actions. For more information, see Enable actions.

    What's next