GCP administration for Augment agents, governed.
gcsAdminMCP is a remote MCP server that gives Augment agents read — and
gated mutating — access to Google Cloud resources for the managed
customer-success projects. Every request is behind Google OAuth 2.1 with
@augmentcode.com domain enforcement, and tool calls run under the
caller’s own GCP credentials.
How to connect
The MCP endpoint is served at /mcp (Streamable HTTP transport).
Point your MCP client at the deployment’s public base URL with the
/mcp path appended.
-
Authentication: OAuth 2.1 via Google. Only Google identities
in the
@augmentcode.comWorkspace domain are accepted — every request is checked and a caller with no verifiable domain claim is rejected. - Per-user credentials: tools execute against GCP using your own Google access token, so a “permission denied” means your IAM lacks access, not a server misconfiguration.
RFC 8707 gotcha: set your client’s OAuth
resource indicator to the full endpoint — <base>/mcp
— not just the base origin <base>. A base-only indicator can
fail the resource-target match at /authorize.
What it can do
Read-only tools are always available; mutating tools are flag-gated, default to a dry run that makes no GCP call, and are audit-logged.
Cloud Run
List and inspect services, revisions, and traffic splits; gated deploy / update / traffic-split actions.
Logging
Read Cloud Logging entries newest-first and surface recent ERROR-and-above events.
Cloud Build
Check build status and, when enabled, run a Cloud Build trigger.
Artifact Registry
List Docker images in an Artifact Registry repository.
Secret metadata
List and describe Secret Manager secrets — metadata only, never the secret values.