Google Cloud

List Google Cloud projects the connected account can see, optionally narrowed by a search query.

Get one project's display name, state, parent and labels.

Get a project's IAM policy: every role binding, the principals in it, and any IAM conditions on it.

Replace a project's IAM policy. Send the policy returned by get_project_iam_policy with your edits and its etag — this overwrites every binding, so a policy fetched without etag can silently drop concurrent changes.

List Google Cloud APIs for a project and whether each is enabled.

Enable a Google Cloud API on a project, e.g. compute.googleapis.com.

Disable a Google Cloud API on a project. Resources that depend on it stop working.

List Compute Engine VMs in one zone, or across every zone when zone is omitted.

Get one VM's machine type, disks, network interfaces, status and metadata.

Create a VM from a complete Compute Engine instance resource, and start it. Returns a zone operation — poll it with get_zone_operation.

Delete a VM and its boot disk if that disk is set to auto-delete.

Start a stopped VM.

Stop a running VM. In-memory state is lost; the disks survive.

Hard-reset a VM. This is a power cycle, not a clean shutdown — unwritten data is lost.

Change a stopped VM's machine type.

List persistent disks in a zone.

Get one disk's size, type, source image and attachments.

Create a persistent disk from a complete disk resource.

Delete a persistent disk and everything on it.

List Compute Engine disk snapshots in a project.

List machine types available in a zone, with their vCPU and memory.

List boot images in a project. Public images live in their own projects, e.g. debian-cloud or ubuntu-os-cloud.

List Compute Engine zones and their status.

List Compute Engine regions, their zones and quota.

List VPC networks in a project.

List VPC firewall rules in a project.

List reserved IP addresses in a region.

Get a zone operation's progress — how Compute Engine reports whether create_instance, delete_instance and their siblings finished.

List the disks attached to one VM, without the rest of the instance resource.

List managed instance groups in a zone.

Get a managed instance group's template, target size, versions and current actions.

List the VMs a managed instance group currently owns, with each one's current action and health.

List instance templates in a project.

Get an instance template — the machine type, disks, network and metadata new VMs inherit from it.

Get a disk's provisioned IOPS and throughput, without the rest of the disk resource.

List the GPU types available in a zone.

List capacity reservations in a zone.

Get a reservation's machine shape, count and how much of it is in use.

List committed-use discounts in a region.

Get a commitment's term, resources and the reservations attached to it.

List Cloud Run services in a region.

Get a Cloud Run service: its URL, traffic split, revision template and last deployment's status.

Create a Cloud Run service from a complete Service resource, and start serving it. Returns a long-running operation — poll it with get_run_operation.

Update a Cloud Run service — a new image, env vars, scaling or traffic split. Cloud Run applies this as a full replace of the fields you send.

Delete a Cloud Run service and stop serving its URL.

List a Cloud Run service's revisions.

List Cloud Run jobs in a region.

Get a Cloud Run job's definition and last execution.

Start a new execution of a Cloud Run job. The job runs whatever image it was deployed with, under its own service account — treat it as running that code, not as creating a record.

Get a Cloud Run long-running operation's progress.

List GKE clusters in a region or zone. Use `-` as the location to list every cluster in the project.

Get a cluster's version, node pools, network configuration, endpoint and status.

Create a GKE cluster from a complete Cluster resource, and start its control plane and nodes. Returns an operation — poll it with get_gke_operation.

Apply a ClusterUpdate to an existing cluster — version upgrades, addon changes, network policy. Returns an operation.

List a cluster's node pools.

Get a node pool's machine type, size, autoscaling and upgrade settings.

Add a node pool to a cluster, and start its nodes. Returns an operation.

Update a node pool in place — node version, image type, autoscaling, machine type. Returns an operation.

List GKE operations in a location — how cluster and node-pool changes report progress.

Get one GKE operation's status, target and error.

Cancel a running GKE operation. The cluster is left in whatever state the operation had reached.

List Cloud Storage buckets in a project.

Get a bucket's location, storage class, versioning, lifecycle and access configuration.

Create a Cloud Storage bucket.

Patch a bucket's configuration — lifecycle rules, versioning, labels, public-access prevention.

Delete an empty bucket.

List objects in a bucket. Use prefix and delimiter to walk it like a directory tree.

Get an object's metadata: size, content type, checksums, generation and storage class. This does not return the object's bytes.

Copy an object to another bucket or name. An existing destination object is replaced.

Delete an object, or one generation of it.

List Cloud SQL instances in a project.

Get a Cloud SQL instance: engine version, tier, IP addresses, backup and IAM-auth settings, and its service account.

Create a Cloud SQL instance from a complete DatabaseInstance resource.

Patch a Cloud SQL instance's settings — tier, flags, backup schedule, IP configuration.

Restart a Cloud SQL instance. Connections drop for the duration.

Delete a Cloud SQL instance and its data.

List databases on a Cloud SQL instance.

Create a database on a Cloud SQL instance.

Drop a database from a Cloud SQL instance.

List database users on a Cloud SQL instance.

Create a database user on a Cloud SQL instance. Use type CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT for IAM database authentication instead of a password.

Update a database user on a Cloud SQL instance — its password, or the database roles it holds. Google's hosted MCP calls this update_user.

Delete a database user from a Cloud SQL instance.

List a Cloud SQL instance's backup runs.

Take an on-demand backup of a Cloud SQL instance.

Get a Cloud SQL operation's progress — how create, patch, restart and backup report completion.

Run SQL on a Cloud SQL instance through the Data API; the instance needs data_api_access=ALLOW_DATA_API. By default the statement runs as the connected Google identity's IAM database user (IAM database authentication must be on and that user must exist on the instance). To run as a built-in database user instead, pass user and password_secret_version. A statement the database rejects comes back as an error carrying the database's message.

Clone a Cloud SQL instance into a new one, optionally to a point in time.

Restore a backup onto an instance. Everything currently in that instance is replaced.

Import a SQL or CSV file from Cloud Storage into an instance. Conflicting rows and schema objects do not survive it.

Check whether a PostgreSQL instance is ready for a major version upgrade. Returns an operation; the findings are in its response. Does not affect availability.

List Pub/Sub topics in a project.

Get a topic's labels, schema settings, message retention and storage policy.

Create a Pub/Sub topic. Pub/Sub creates topics with PUT at the topic's own name, so the body carries only the settings.

Patch a topic's settings. `update_mask` decides which fields are replaced.

Delete a topic. Its subscriptions survive, orphaned, and stop receiving messages.

Publish one or more messages to a topic. Each message carries base64 `data` and/or `attributes`.

List Pub/Sub subscriptions in a project.

Get a subscription's topic, delivery configuration, ack deadline and retry policy.

Create a subscription on a topic. `resource.topic` is required and takes the full name, e.g. projects/my-project/topics/orders.

Patch a subscription's settings — ack deadline, push endpoint, retry policy, dead-letter topic.

Delete a subscription. Messages it had not acknowledged are gone with it.

List Pub/Sub snapshots in a project. (Compute Engine disk snapshots are list_disk_snapshots.)

Get a Pub/Sub snapshot's subscription, topic and expiry.

Snapshot a subscription's unacknowledged-message state so it can be replayed later. `resource.subscription` takes the full name.

Delete a Pub/Sub snapshot.

Read log entries with a Cloud Logging filter — the tool to reach for when debugging anything running on GCP.

List the log names a project has written to.

List a project's log sinks and where they export to.

List a project's log buckets — where retained logs actually live.

Get a log bucket's retention, locking and analytics settings.

List the views defined on a log bucket — the scoped windows other principals can be granted.

Get one log view's filter.

Read metric time series for a project over a time window.

List the metric types a project can be queried for.

List a project's alerting policies.

Get one alerting policy's conditions and notification channels.

List a project's uptime checks.

Run a PromQL range query against a project's metrics — the query language Cloud Monitoring's Managed Service for Prometheus speaks.

List a project's firing and recent alerts.

Get one alert's state, policy and the time series that opened it.

List a project's Monitoring dashboards.

Get one dashboard's layout and widgets.

List billing accounts the connected account can see.

Get a billing account's display name, open state and master account.

List the projects billed to a billing account.

List Google Cloud's billable services — the catalog SKUs are grouped under.

List public prices for one billable service, for cost estimation.

Create a billing account, or a subaccount under a reseller's account.

Move a billing account to another organization.

Get a billing account's IAM policy.

Replace a billing account's IAM policy. Send the policy from get_billing_account_iam_policy with its etag — this overwrites every binding.

Ask which of the named billing permissions the connected account actually holds.

List Google's public SKU groups — the catalog's top level.

Get one public SKU group.

List the SKUs in a public SKU group.

Get one SKU within a public SKU group.

List the public price history for one SKU.

Get one SKU's current public price.

List the billable services as one billing account sees them.

Get one billable service as a billing account sees it.

List the SKUs a billing account is charged for.

Get one SKU as a billing account sees it.

List a billing account's OWN price history for a SKU — its negotiated rate, not the public one.

Get a billing account's own current price for a SKU.

List the SKU groups visible to a billing account.

Get one SKU group as a billing account sees it.

List the SKUs in a group as a billing account sees them.

Get one SKU in a group as a billing account sees it.

Get which billing account a project is linked to, and whether billing is enabled.

List a project's service accounts.

Get one service account by email or unique id.

Create a service account. This mints an identity, not a key — grant it roles with set_project_iam_policy.

Delete a service account. Anything authenticating as it stops working.

List a service account's key metadata — ids, types and validity windows. Key material is never returned.

List Google's predefined IAM roles.

Get one role's permissions. Accepts a predefined role (roles/compute.admin) or a project custom role.

List a project's custom IAM roles.

List the deny policies attached to a project. Deny rules override any allow.

Get one deny policy's rules and etag.

Create a deny policy on a project. A deny rule beats any allow, so this REMOVES access from whoever it names — including, if it names broadly, the caller and the platform. Returns a long-running operation — poll it with get_deny_policy_status.

Replace a deny policy. Send the etag from get_deny_policy — this overwrites every rule on it.

Delete a deny policy. Whatever it was denying becomes allowed again if an allow policy grants it.

Get a deny-policy operation's progress.

Create a custom IAM role in a project.

Patch a custom role. Every principal holding it is re-scoped in place.

Delete a custom role. It is soft-deleted for 7 days, then permanent; undelete_role reverses it within that window.

Restore a soft-deleted custom role. Every principal still bound to it regains the permissions it carries, immediately and without any new binding being made.

List Recommender findings — idle VMs, oversized machine types, unattached disks, committed-use discounts.

Get one recommendation's content, impact and state.

List Recommender insights — the observations recommendations are derived from.

Get one insight's content, category and observation period.

Mark a recommendation as being acted on, so Recommender stops resurfacing it.

Mark a recommendation as applied successfully.

Mark a recommendation as attempted and failed.

Dismiss a recommendation.

Mark an insight as accepted.

List a service's quotas for a project, with the current limit and whether it is adjustable.

Get one quota's dimensions, limits and adjustability.

List the quota-increase preferences filed for a project.

File a quota preference for a project. The value can be LOWER than the current limit as well as higher, and a decrease cuts the capacity running workloads depend on. Google reviews increases; the new limit is not immediate.

Get whether the automatic quota adjuster is enabled for a project.

Enable or disable the automatic quota adjuster for a project.

List a project's assets — every resource Cloud Asset Inventory tracks, optionally by type.

Answer who-can-do-what across a project synchronously: which principals hold which permissions on which resources.

Run the same analysis asynchronously and write the results to BigQuery or Cloud Storage. Returns an operation — poll it with get_iam_policy_analysis_status.

Get an export_iam_analysis_results operation's progress.

List request traces in a project over a time window.

Get one trace with all of its spans.

List grouped application errors with their counts, first and last seen, and affected services.

List a project's support cases.

Search support cases with a query, e.g. `state=OPEN`.

Get one support case's state, priority, classification and escalation.

List the comments on a support case.

Get one comment on a support case.

Get one attachment's metadata — name, creator, size and MIME type. Not the bytes.

List the attachments on a support case (metadata, not the bytes).

List Google Cloud incidents and maintenance affecting a project.

Get one service-health event's state, products and updates.

List cloud locations — regions and zones with their carbon data and territory.

Find the cloud locations nearest a source location — the tool for `where should this run`.