Zoo Cloud Run

You can run a secured MCP server on Cloud Run that requires an identity token for access. This setup lets you expose MCP tools remotely while enforcing authentication, so only authorized clients can invoke server tools.

How to use

To use the MCP server, you connect through an MCP client that can handle authenticated HTTP endpoints. A Gemini CLI client is provided as a quick way to test tools on the server. You will need to provide an identity token in your requests and point the client at the Cloud Run URL that hosts the MCP server.

In practical terms, you will: create a token from your Google Cloud session, configure the client to reach the Cloud Run endpoint, and call the available MCP tools as you would with any remote MCP server. The server requires an Authorization header with a Bearer token, so your client must supply a valid identity token for every request.

How to install

Prerequisites you need before starting:

• Node.js and npm (for installing the Gemini CLI)

• Google Cloud SDK (gcloud) installed and configured

• Access to a Google Cloud project with Cloud Run enabled

Install the Gemini CLI to test MCP server tools locally from your shell:

npm install -g @google/gemini-cli@latest

Configure a Cloud Run MCP server endpoint in Gemini by editing your settings to include the remote MCP server and its authentication header. The following example shows how to reference the Cloud Run URL pattern and the identity token that you will obtain from Cloud Shell or your local environment.

{
  "mcpServers": {
    "zoo-remote": {
      "httpUrl": "https://zoo-mcp-server-$PROJECT_NUMBER.$GOOGLE_CLOUD_LOCATION.run.app/mcp/",
      "headers": {
        "Authorization": "Bearer $ID_TOKEN"
      }
    }
  },
  "selectedAuthType": "cloud-shell",
  "hasSeenIdeIntegrationNudge": true
}

To retrieve a new token and update your settings, you can run a token update command or script provided in your environment to refresh the ID_TOKEN variable. The token may timeout, so you should refresh it as needed.

Additional sections

Security and access control: The MCP server deployed to Cloud Run is configured with the flag to disallow unauthenticated access. Traffic must include an Authorization header with a valid Bearer token to be accepted by the server.

Environment and credentials: Save your Google Cloud credentials and project number for configuring clients that consume the MCP server. Typical variables you will use include GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION, PROJECT_NUMBER, and ID_TOKEN.

Available tools

Gemini CLI

A command-line interface to interact with MCP servers, authenticate, and invoke remote MCP tools.

Cloud Run MCP Server

The remote MCP server deployed on Google Cloud Run that exposes MCP tools over HTTP with authentication.