Deploy a Secure MCP Server on Cloud Run

You deploy a secure MCP server that exposes zoo data to language models and clients. This MCP server runs remotely on Cloud Run, requires authentication, and can be accessed from Gemini CLI or other MCP clients to retrieve animal data and run tools as part of prompt generation and tool calls.

How to use

Interact with the remote MCP server from an MCP client to access zoo data and run defined tools. The server is exposed over HTTP at a Cloud Run URL and requires authentication for every request. Tools available include data lookups like getting animals by species and requesting animal details. You can integrate the server into client workflows or automation to enrich LLM responses with real-time external data.

How to install

Prerequisites you need before starting:

• A Google Cloud account and a project with billing enabled
• Cloud Shell or a local terminal with gcloud configured
• Python 3.13 or compatible runtime installed if you work locally with Python tools

Follow these concrete steps to set up and deploy the MCP server:

# 1) Create and enter your project workspace
 mkdir mcp-on-cloudrun && cd mcp-on-cloudrun

# 2) Initialize a Python project (uses uv) and create pyproject.toml
 uv init --description "Example of deploying an MCP server on Cloud Run" --bare --python 3.13

# 3) Add FastMCP as a dependency
 uv add fastmcp==2.12.4 --no-sync

# 4) Create server.py with the zoo MCP server implementation (source code to be placed here)
# 5) Create a Dockerfile to containerize the application (deployment uses this Dockerfile)
# 6) Build and push to Artifact Registry via Cloud Run deployment steps (below)

The deployment is performed from source using Cloud Run. The key steps involve creating a service account, deploying with authentication enforced, and enabling the necessary Cloud Run resources. The final Cloud Run service URL is used by MCP clients to connect.

Additional sections

Configuration and security details are outlined below to ensure your MCP server is reachable only by authorized clients.

Configuration and security

The remote MCP server is served over HTTPS and requires authentication for all requests. A client must obtain a valid identity token and pass it in the Authorization header when calling the server. This keeps the endpoint secure and protects against unauthorized access.

Troubleshooting

If you encounter authentication errors while using Gemini CLI, refresh your ID token and ensure your project context is correct. Re-authenticate and retry the connection to the remote MCP server.

Notes and best practices

• Use the HTTP MCP URL provided by the deployment when configuring clients. - Always enable authentication to prevent unauthorized tool usage. - Regularly rotate tokens and refresh credentials in long-running sessions.

Available tools

get_animals_by_species

Query the zoo data to retrieve animals of a given species, returning a list of matching animals.

get_animal_details

Fetch detailed information about a specific animal, including its exhibit and trail location.