MCP on GCP
Deploy an MCP server on Google Cloud: build or borrow, the Cloud Run IAM versus MCP OAuth collision on the Authorization header, what breaks at more than one instance, the clocks that end long tools, network paths for private systems, and what Google logs versus what you must.
Last updated
After this section you can
- Assign each caller to the lock it can pass: an ID token for internal agents, OAuth for third-party clients
- Configure a Cloud Run service for MCP: bind 0.0.0.0 on the PORT variable and set the Host and Origin allow-lists
- Explain which clock ends a long tool call, and which log entries can name the tool and the user
MCP on Google Cloud
Put a remote MCP server on Cloud Run: which lock admits which caller, what the container must do, and what the logs can name.
Two locks on a remote MCP server both read the Authorization header: Cloud Run's IAM check wants a Google ID token, and your OAuth check wants an MCP token. Choose the lock by who the caller is.
Numbers: 1 POST, 2 balancer, 3 IAM, 4 your checks, 5 Google API, 6 result. Blue request, amber locks, red failure, purple state. On a phone the figure pans sideways.