Google Compute Engine

What the Google Compute Engine connector does

The Google Compute Engine MCP server lets Claude, ChatGPT and other agents inspect and operate real Google Cloud infrastructure. Its 29 tools list VMs, disks, snapshots, images, reservations and commitments, and six of them create, delete, stop, reset or resize live instances. Access runs on Google OAuth and IAM.

Google Compute Engine tools (29)

• create_instanceDestructive

  Create a new Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. If machine_type is not provided, it defaults to `e2-medium`. If image_project and image_family are not provided, it defaults to `debian-12` image from `debian-cloud` project. guest_accelerator and maintenance_policy can be optionally provided. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

• delete_instanceDestructive

  Delete a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

• start_instanceDestructive

  Starts a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

• stop_instanceDestructive

  Stops a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

• reset_instanceDestructive

  Resets a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

• get_instance_basic_infoRead-only

  Get basic information about a Compute Engine VM instance, including its name, ID, status, machine type, creation timestamp, and attached guest accelerators. Requires project, zone, and instance name as input.

• set_instance_machine_typeDestructive

  Sets the machine type for a stopped Google Compute Engine instance to the specified machine type. Requires project, zone, instance name and machine type as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

• list_instance_attached_disksRead-only

  Lists the disks attached to a Compute Engine virtual machine (VM) instance. For each attached disk, the response includes details such as kind, type, mode, saved state, source, device name, index, boot, initialize parameters, auto delete, licenses,, interface, guest OS features, disk encryption key, disk size, shielded instance initial state, force attach, and architecture. Requires project, zone, and instance name as input.

• list_instancesRead-only

  Lists Compute Engine virtual machine (VM) instances. Details for each instance include name, ID, status, machine type, creation timestamp, and attached guest accelerators. Use other tools to get more details about each instance. Requires project and zone as input.

• get_instance_group_manager_basic_infoRead-only

  Get basic information about a Compute Engine managed instance group (MIG), including its name, ID, instance template, base instance name, target size, target stopped size, target suspended size, status and creation timestamp. Requires project, zone, and MIG name as input.

• list_instance_group_managersRead-only

  Lists Compute Engine managed instance groups (MIGs). Details for each MIG include name, ID, instance template, base instance name, target size, target stopped size, target suspended size, status and creation timestamp. Requires project and zone as input.

• list_managed_instancesRead-only

  Lists managed instances for a given managed instance group (MIG). For each instance, details include id, instance URL, instance status, and current action. Requires project, zone, and MIG name as input.

• list_instance_templatesRead-only

  Lists Compute Engine instance templates. Details for each instance template include name, ID, description, machine type, region, and creation timestamp. Requires project as input.

• get_instance_template_basic_infoRead-only

  Get basic information about a Compute Engine instance template, including its name, ID, description, machine type, region, and creation timestamp. Requires project and instance template name as input.

• get_instance_template_propertiesRead-only

  Get instance properties of a Compute Engine instance template. This includes properties such as description, tags, machine type, network interfaces, disks, metadata, service accounts, scheduling options, labels, guest accelerators, reservation affinity, and shielded/confidential instance configurations. Requires project and instance template name as input.

• get_disk_basic_infoRead-only

  Get basic information about a Compute Engine disk, including its name, ID, description, creation timestamp, size, type, status, last attach timestamp, and last detach timestamp. Requires project, zone, and disk name as input.

• get_disk_performance_configRead-only

  Get performance configuration of a Compute Engine disk, including its type, size, provisioned IOPS, provisioned throughput, physical block size, storage pool and access mode. Requires project, zone, and disk name as input.

• list_disksRead-only

  Lists Compute Engine disks. Details for each disk include name, ID, description, creation timestamp, size, type, status, last attach timestamp, and last detach timestamp. Requires project and zone as input.

• list_accelerator_typesRead-only

  Lists the available Google Compute Engine accelerator types. Requires project and zone as input. Returns accelerator types, including id, creation timestamp, name, description, deprecated, zone, and maximum cards per instance.

• list_machine_typesRead-only

  Lists the available Google Compute Engine machine types. Requires project and zone as input. Returns machine types, including id, creationTimestamp, name, description, guest cpus, memory, image space, maximum persistent disks, maximum persisten disks size, deprecated, zone, is shared cpu, accelerators, and architecture.

• list_imagesRead-only

  Lists Compute Engine Images. Details for each image include name, ID, status, family, and creation timestamp. Requires project as input.

• get_zone_operationRead-only

  Get details of a zone operation, including its id, name, status, creation timestamp, error, warning, HTTP error message and HTTP error status code. Requires project, zone, and operation name as input.

• get_reservation_basic_infoRead-only

  Get Compute Engine reservation basic info including name, ID, creation timestamp, zone, status, specific reservation required, commitment, and linked commitments. Requires project, zone, and reservation name as input.

• get_reservation_detailsRead-only

  Get Compute Engine reservation details. Returns reservation details including name, ID, status, creation timestamp, specific reservation properties like machine type, guest accelerators and local SSDs, aggregate reservation properties like VM family and reserved resources, commitment and linked commitments, sharing settings, and resource status. Requires project, zone, and reservation name as input.

Read from the server on 2026-08-17, including each tool's own safety annotations.

Limits

• Six tools change live infrastructure and none is idempotent. A client that retries on timeout can create a second VM, or reset a machine twice. Check get_zone_operation before retrying.
• Creating resources creates a bill. create_instance produces a running VM that charges continuously. Google's lifecycle documentation states that attached resources such as disks and external IP addresses incur charges for as long as the resources exist, regardless of the instance's state. We make no claim about prices; the structural point is that the meter runs until something is deleted, not until it is stopped.
• Deleting an instance normally deletes its boot disk. Google's documentation says preserving a disk requires detaching it or setting its auto-delete flag to false first. No tool on this server does either, so that mitigation must exist before an agent is allowed near delete_instance.
• Nothing on this server restores anything. There is no undo, no snapshot-creation tool and no restore tool among the 29. list_snapshots reads snapshots; it does not make them.
• The advertised OAuth scope is read-write only. Google's docs describe a compute.read-only scope, but all 29 per-tool descriptors advertise the single full compute scope. Use IAM roles to achieve a read-only posture; the scope will not give you one.
• No security, networking or identity surface. The union of all input properties across the 29 tools contains no firewall, IAM, network, metadata, service-account or SSH-key field. This connector cannot change your project's access controls — a real limit, in the reader's favour.
• Reads are scoped by project and zone or region. Most read tools require an explicit project plus zone, and the commitment tools require region. There is no aggregated or cross-project listing tool, so an agent must be told where to look.
• No full regional isolation. Google notes the Compute Engine remote MCP server does not support full regional isolation and might route MCP tool calls through any region. That is a data-residency consideration and it survived the move to GA.
• set_instance_machine_type needs a stopped instance. Its own description says it sets the machine type for a stopped instance, so an agent must stop the VM first — which is itself a destructive call.
• Org-policy control of MCP has been withdrawn. Google's release notes record that organization policy control of MCP use was deprecated on 17 February 2026 and stopped working after 17 March 2026, with access control moving to IAM deny policies. A team relying on the old constraint no longer has it.
• Anthropic's directory points at the wrong documentation. The entry's documentation value is the generic cloud.google.com/docs root. The real page is docs.cloud.google.com/compute/docs/use-compute-engine-mcp, and a reader following the directory link lands on the whole of Google Cloud's documentation instead.
• We did not exercise any tool. Our checks were an anonymous initialize and tools/list, the .well-known descriptors, and one deliberately unauthenticated tools/call against a read-only tool to observe the auth challenge — which returned 401 and did nothing. No tool was ever called with a credential, and no resource was created, changed or deleted. Every behavioural claim above comes from the tool schemas or Google's own documentation.

Frequently asked questions

Sources

• Use the Compute Engine remote MCP server (retrieved 2026-08-17; HTTP 200, zero redirects). This is not the URL in Anthropic's directory entry, which gives the generic https://cloud.google.com/docs root; the specific page was found by search and verified by fetch. Source for the server URL and transport, the required MCP Tool User role and mcp.tools.call permission, the two documented OAuth scopes, the statement that tools/list requires no authentication, the redirect-URI constraint, the regional-isolation note, the named client list including Claude, and the example use cases and sample prompts. The legacy cloud.google.com path 301-redirects to this docs. host; the destination is cited. · retrieved 2026-08-17
• Google Cloud MCP servers overview (retrieved 2026-08-17; HTTP 200). Source for the OAuth-plus-IAM model, the fine-grained authorization framing and Model Armor as optional MCP call and response sanitisation. · retrieved 2026-08-17
• Authenticate to MCP servers (retrieved 2026-08-17; HTTP 200). Source for the MCP authorization specification version 2025-11-25, the user/workload/agent identity options, the OAuth client ID and secret route, and the recommendation to give an agent identity only the minimum permissions necessary. · retrieved 2026-08-17
• Compute Engine release notes (retrieved 2026-08-17; HTTP 200). Source for the Preview date of 10 December 2025, general availability on 20 April 2026, the deprecation of organization-policy control of MCP use on 17 February 2026 with effect after 17 March 2026, and the automatic enablement of the MCP server when Compute Engine is enabled. · retrieved 2026-08-17
• Stop and start a compute instance (retrieved 2026-08-17; HTTP 200 after one redirect from the cloud.google.com path). Source for the statement that after stopping an instance you keep incurring charges for attached resources. · retrieved 2026-08-17
• Compute instance lifecycle (retrieved 2026-08-17; HTTP 200 after two redirects from the directory-era instance-life-cycle path). Source for the statement that attached resources such as disks and external IP addresses incur charges for as long as they exist, regardless of instance state. · retrieved 2026-08-17
• Reset a Compute Engine instance (retrieved 2026-08-17; HTTP 200). Source for reset erasing memory, forcing an abrupt guest-OS shutdown, risking data loss and file-system corruption, creating no backup, and being advised only as a last resort. · retrieved 2026-08-17
• Delete a compute instance (retrieved 2026-08-17; HTTP 200). Source for boot-disk preservation requiring a detach or an auto-delete setting of false before deletion. · retrieved 2026-08-17
• Compute Engine IAM roles (retrieved 2026-08-17; HTTP 200). Source for Compute Viewer (roles/compute.viewer) as read-only access to get and list Compute Engine resources, and for Compute Instance Admin (v1) as the administrative counterpart. · retrieved 2026-08-17
• Live MCP handshake against https://compute.googleapis.com/mcp (2026-08-17). Anonymous initialize returned HTTP 200 with serverInfo StatelessServer; anonymous tools/list returned 29 tools with full descriptions, JSON Schemas and safety annotations. A single deliberately unauthenticated tools/call against the read-only list_machine_types returned HTTP 401 with WWW-Authenticate: Bearer and a body stating an OAuth 2 access token was expected. GET on the endpoint returns 405; it is POST-only. No tool was called with a credential. · retrieved 2026-08-17
• Server OAuth descriptor (retrieved 2026-08-17; HTTP 200). The server's own RFC 9728 declaration: authorisation server https://accounts.google.com/, bearer method header, resource https://compute.googleapis.com/mcp, and one supported scope, https://www.googleapis.com/auth/compute. The root and /mcp/-suffixed paths both return 404. We fetched the same descriptor under all 29 tool paths: 29 of 29 returned HTTP 200 with the identical single scope, and a fabricated tool name returned 404 — so the descriptor path is itself an independent confirmation of the 29-tool surface. · retrieved 2026-08-17
• Anthropic Connectors Directory entry (from the 2026-08-16 directory snapshot; partner tier, code category, endpoint, streamable-HTTP transport, auth_posture: auth_required, permissions recorded as "Read and write", and 29 tool names that match the live server exactly, in order). · retrieved 2026-08-16
• robots.txt — and (retrieved 2026-08-17; HTTP 200 each, genuine text/plain). Neither disallows the Compute Engine documentation paths, and neither carries a Content-Signal line, so no AI-use preference is expressed in either direction. cloud.google.com/llms.txt returns 404 as a large HTML shell rather than a file, so no machine index was available. · retrieved 2026-08-17
• Google Cloud privacy (HTTP 200, 2026-08-17) and Google Cloud Platform Terms of Service (HTTP 200, 2026-08-17). Both are the values published in Anthropic's directory entry and both are live. No specific claim on this page is drawn from either document. · retrieved 2026-08-17