Control MCP use with Identity and Access Management

Identity and Access Management (IAM) deny policies and allow policies help you secure Google Cloud Model Context Protocol (MCP) servers. Configure these policies to block unwanted MCP tool access.

For example, you can deny or allow access based on:

  • The principal.
  • Tool properties like read-only.
  • The service name or tool name.
  • The application's OAuth client ID.

You can configure authorization policies for agents and MCP servers using existing security controls, such as IAM allow and deny policies, and layer these attributes to build your security and governance policies.

Understand IAM permission checks for MCP

When you use Google or Google Cloud services through MCP servers, the principal making the tool call must have the following permissions:

  • The mcp.tools.call permission on the Google Cloud project.
  • The required permissions to access the underlying Google or Google Cloud resources.

For example, if an MCP tool call is sent to get a BigQuery Dataset's metadata, and the caller has the mcp.tools.call permission but lacks the bigquery.datasets.get permission, the tool call fails. Similarly, if the caller has the bigquery.datasets.get permission, but lacks the mcp.tools.call permission, the call fails.

IAM deny policy attributes

The following attributes can be used in your Identity and Access Management deny policies:

  • tool.isReadOnly: a resource attribute that indicates whether the invoked tool only reads data.
  • request.auth.oauth.client_id: the OAuth client ID.
  • resource.service: the name of service—for example, bigquery.googleapis.com.
  • tool.name: the name of the MCP tool, for example, list_agents.

IAM allow policy attributes

The following attributes can be used in your Identity and Access Management allow policies:

  • resource.service: the name of service—for example, bigquery.googleapis.com.
  • tool.name: the name of the MCP tool, for example, list_agents.

Limitations

Control of MCP use with IAM has the following limitations:

  • The request.auth.oauth.client_id attribute is only supported for IAM deny policies. IAM allow policies don't support this attribute.
  • These IAM attributes are only checked and enforced for the mcp.tools.call permission. These attributes cannot be combined with any other permissions in IAM deny policies.
  • Tags can't be mixed with the resource.service attribute or any MCP attributes in IAM conditions.
  • The resource.service and tool.name attributes aren't available in the Google Cloud console. IAM policies that use these attributes must be managed with Google Cloud CLI.
  • MCP IAM attributes can't be used to control access to the Resource Manager MCP server. For more information, see Resource Manager overview and Use the Resource Manager remote MCP server.

Example IAM deny policies

The following sections give examples of Identity and Access Management deny policies that can be used to control MCP use.

Deny all MCP tool use

The following IAM deny policy prevents use of Google and Google Cloud MCP server tools by all users.

{
  "displayName": "Deny access to MCP tools for all users",
  "rules": [
    {
      "denyRule": {