Google Compute Engine

Name: Google Compute Engine MCP Server
Availability: InStock
Author: Google Compute Engine

Developer Tools29 tools

Let an agent inspect and manage Google Cloud VMs, disks, snapshots and reservations in plain English. 29 tools verified live — 23 read-only and 6 the server annotates destructive, including delete and reset.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 17 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Google Compute Engine via MCP

https://compute.googleapis.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Google Compute Engine Tools & Capabilities (29)

create_instanceDestructive

Create a new Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. If machine_type is not provided, it defaults to `e2-medium`. If image_project and image_family are not provided, it defaults to `debian-12` image from `debian-cloud` project. guest_accelerator and maintenance_policy can be optionally provided. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

delete_instanceDestructive

Delete a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

start_instanceDestructive

Starts a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

stop_instanceDestructive

Stops a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

reset_instanceDestructive

Resets a Google Compute Engine virtual machine (VM) instance. Requires project, zone, and instance name as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

get_instance_basic_infoRead-only

Get basic information about a Compute Engine VM instance, including its name, ID, status, machine type, creation timestamp, and attached guest accelerators. Requires project, zone, and instance name as input.

set_instance_machine_typeDestructive

Sets the machine type for a stopped Google Compute Engine instance to the specified machine type. Requires project, zone, instance name and machine type as input. Proceed only if there is no error in response and the status of the operation is `DONE` without any errors. To get details of the operation, use the `get_zone_operation` tool.

list_instance_attached_disksRead-only

Lists the disks attached to a Compute Engine virtual machine (VM) instance. For each attached disk, the response includes details such as kind, type, mode, saved state, source, device name, index, boot, initialize parameters, auto delete, licenses,, interface, guest OS features, disk encryption key, disk size, shielded instance initial state, force attach, and architecture. Requires project, zone, and instance name as input.

list_instancesRead-only

Lists Compute Engine virtual machine (VM) instances. Details for each instance include name, ID, status, machine type, creation timestamp, and attached guest accelerators. Use other tools to get more details about each instance. Requires project and zone as input.

get_instance_group_manager_basic_infoRead-only

Get basic information about a Compute Engine managed instance group (MIG), including its name, ID, instance template, base instance name, target size, target stopped size, target suspended size, status and creation timestamp. Requires project, zone, and MIG name as input.

list_instance_group_managersRead-only

Lists Compute Engine managed instance groups (MIGs). Details for each MIG include name, ID, instance template, base instance name, target size, target stopped size, target suspended size, status and creation timestamp. Requires project and zone as input.

list_managed_instancesRead-only

Lists managed instances for a given managed instance group (MIG). For each instance, details include id, instance URL, instance status, and current action. Requires project, zone, and MIG name as input.

list_instance_templatesRead-only

Lists Compute Engine instance templates. Details for each instance template include name, ID, description, machine type, region, and creation timestamp. Requires project as input.

get_instance_template_basic_infoRead-only

Get basic information about a Compute Engine instance template, including its name, ID, description, machine type, region, and creation timestamp. Requires project and instance template name as input.

get_instance_template_propertiesRead-only

Get instance properties of a Compute Engine instance template. This includes properties such as description, tags, machine type, network interfaces, disks, metadata, service accounts, scheduling options, labels, guest accelerators, reservation affinity, and shielded/confidential instance configurations. Requires project and instance template name as input.

get_disk_basic_infoRead-only

Get basic information about a Compute Engine disk, including its name, ID, description, creation timestamp, size, type, status, last attach timestamp, and last detach timestamp. Requires project, zone, and disk name as input.

get_disk_performance_configRead-only

Get performance configuration of a Compute Engine disk, including its type, size, provisioned IOPS, provisioned throughput, physical block size, storage pool and access mode. Requires project, zone, and disk name as input.

list_disksRead-only

Lists Compute Engine disks. Details for each disk include name, ID, description, creation timestamp, size, type, status, last attach timestamp, and last detach timestamp. Requires project and zone as input.

list_accelerator_typesRead-only

Lists the available Google Compute Engine accelerator types. Requires project and zone as input. Returns accelerator types, including id, creation timestamp, name, description, deprecated, zone, and maximum cards per instance.

list_machine_typesRead-only

Lists the available Google Compute Engine machine types. Requires project and zone as input. Returns machine types, including id, creationTimestamp, name, description, guest cpus, memory, image space, maximum persistent disks, maximum persisten disks size, deprecated, zone, is shared cpu, accelerators, and architecture.

list_imagesRead-only

Lists Compute Engine Images. Details for each image include name, ID, status, family, and creation timestamp. Requires project as input.

get_zone_operationRead-only

Get details of a zone operation, including its id, name, status, creation timestamp, error, warning, HTTP error message and HTTP error status code. Requires project, zone, and operation name as input.

get_reservation_basic_infoRead-only

Get Compute Engine reservation basic info including name, ID, creation timestamp, zone, status, specific reservation required, commitment, and linked commitments. Requires project, zone, and reservation name as input.

get_reservation_detailsRead-only

Get Compute Engine reservation details. Returns reservation details including name, ID, status, creation timestamp, specific reservation properties like machine type, guest accelerators and local SSDs, aggregate reservation properties like VM family and reserved resources, commitment and linked commitments, sharing settings, and resource status. Requires project, zone, and reservation name as input.

list_reservationsRead-only

Lists Compute Engine reservations. Details for each reservation include name, ID, creation timestamp, zone, status, specific reservation required, commitment, and linked commitments. Requires project and zone as input.

list_commitmentsRead-only

Lists Compute Engine Commitments in a region. Details for each commitment include name, ID, status, plan, type, resources, and creation, start and end timestamps. Requires project and region as input.

get_commitment_basic_infoRead-only

Get basic information about a Compute Engine Commitment, including its name, ID, status, plan, type, resources, and creation, start and end timestamps. Requires project, region, and commitment name as input.

list_commitment_reservationsRead-only

Lists reservations for a Compute Engine Commitment. Returns reservation details including name, ID, status, creation timestamp, specific reservation properties like machine type, guest accelerators and local SSDs, aggregate reservation properties like VM family and reserved resources, commitment and linked commitments, sharing settings, and resource status. Requires project, region, and commitment name as input.

list_snapshotsRead-only

Lists snapshots in a project providing basic information per snapshot including name, id, status, creation time, disk size, storage bytes, source disk, and source disk id. Requires project as input.

Read from the server on 2026-08-17, including each tool's own safety annotations.

Limits

Six tools change live infrastructure and none is idempotent. A client that retries on timeout can create a second VM, or reset a machine twice. Check get_zone_operation before retrying.
Creating resources creates a bill. create_instance produces a running VM that charges continuously. Google's lifecycle documentation states that attached resources such as disks and external IP addresses incur charges for as long as the resources exist, regardless of the instance's state. We make no claim about prices; the structural point is that the meter runs until something is deleted, not until it is stopped.
Deleting an instance normally deletes its boot disk. Google's documentation says preserving a disk requires detaching it or setting its auto-delete flag to false first. No tool on this server does either, so that mitigation must exist before an agent is allowed near delete_instance.
Nothing on this server restores anything. There is no undo, no snapshot-creation tool and no restore tool among the 29. list_snapshots reads snapshots; it does not make them.
The advertised OAuth scope is read-write only. Google's docs describe a compute.read-only scope, but all 29 per-tool descriptors advertise the single full compute scope. Use IAM roles to achieve a read-only posture; the scope will not give you one.
No security, networking or identity surface. The union of all input properties across the 29 tools contains no firewall, IAM, network, metadata, service-account or SSH-key field. This connector cannot change your project's access controls — a real limit, in the reader's favour.
Reads are scoped by project and zone or region. Most read tools require an explicit project plus zone, and the commitment tools require region. There is no aggregated or cross-project listing tool, so an agent must be told where to look.
No full regional isolation. Google notes the Compute Engine remote MCP server does not support full regional isolation and might route MCP tool calls through any region. That is a data-residency consideration and it survived the move to GA.
set_instance_machine_type needs a stopped instance. Its own description says it sets the machine type for a stopped instance, so an agent must stop the VM first — which is itself a destructive call.
Org-policy control of MCP has been withdrawn. Google's release notes record that organization policy control of MCP use was deprecated on 17 February 2026 and stopped working after 17 March 2026, with access control moving to IAM deny policies. A team relying on the old constraint no longer has it.
Anthropic's directory points at the wrong documentation. The entry's documentation value is the generic cloud.google.com/docs root. The real page is docs.cloud.google.com/compute/docs/use-compute-engine-mcp, and a reader following the directory link lands on the whole of Google Cloud's documentation instead.
We did not exercise any tool. Our checks were an anonymous initialize and tools/list, the .well-known descriptors, and one deliberately unauthenticated tools/call against a read-only tool to observe the auth challenge — which returned 401 and did nothing. No tool was ever called with a credential, and no resource was created, changed or deleted. Every behavioural claim above comes from the tool schemas or Google's own documentation.

Frequently asked questions

Does the Google Compute Engine MCP server need a Google Cloud account?

Yes, for everything except listing the tools. We opened an anonymous handshake on 2026-08-17 and the server returned all 29 tool definitions with no credential, which matches Google's own documentation stating the tools/list method requires no authentication. Calling a tool is different: an anonymous read returned HTTP 401 with a Bearer challenge, so every actual operation needs Google Cloud credentials.

Which Compute Engine MCP tools can delete or damage infrastructure?

Six of the 29, and the server names them itself. create_instance, delete_instance, start_instance, stop_instance, reset_instance and set_instance_machine_type all carry destructiveHint true. Deleting a VM also destroys its boot disk unless you set that disk's auto-delete flag to false beforehand, per Google's own delete documentation. The other 23 tools are annotated read-only.

What happens if an agent retries a Compute Engine tool call after a timeout?

It performs the action a second time. All six destructive tools are annotated idempotentHint false, meaning the server makes no promise that a repeat call is harmless. A retried create_instance can leave you two billable VMs, and a retried reset_instance forces a second abrupt shutdown. Use get_zone_operation to check the outcome before retrying anything.

Can I give the Compute Engine MCP server read-only access?

Through IAM, yes; through the connector's advertised scope, no. Google documents a compute.read-only OAuth scope, but the server's own RFC 9728 descriptor advertises only the full read-write compute scope for all 29 tools, which we confirmed on 2026-08-17. The reliable control is IAM: grant the agent identity a viewer role so destructive calls fail on permission.

Does using the Compute Engine MCP server cost money?

The tool calls are not what costs money; the resources they create are. A successful create_instance produces a running VM that bills continuously. Google's documentation states that after you stop an instance you keep incurring charges for resources that remain attached to it, so stopping is not the same as deleting and an agent that stops a VM has not stopped the bill.

Why does reset_instance need more care than start_instance or stop_instance?

Because it is not a clean reboot. Google's documentation says resetting erases all data in the instance memory, forces an abrupt shutdown of the guest OS, can cause data loss and file system corruption, and creates no backup first. Google advises it only as a last resort when the guest OS has crashed. The connector exposes it as a peer of the other lifecycle tools.

Is the Compute Engine MCP server generally available or preview?

Generally available. Google's Compute Engine release notes record the remote MCP server arriving in Preview on 10 December 2025 and reaching general availability on 20 April 2026. One documented caveat survives GA: Google notes the server does not support full regional isolation and might route MCP tool calls through any region.