Using Google SecOps with Gemini CLI and Hosted MCP

In this post I explore how to set up the Gemini CLI with Google Cloud’s Hosted MCP Servers. This setup will be the basis for an upcoming series of posts where I will explore how to automate and scale Google SecOps workflows using Model Context Protocol (MCP).

By the end of this guide, you will have setup Gemini CLI with the following GCP Hosted MCP Servers:

• **Google SecOps MCP:
• **Ingestion, Normalization, and Detection & Response workflows
• **GCP Developer Knowledge MCP:
• **Access live, authoritative documentation to troubleshoot Gcloud/SecOps configurations.
• **GCP BigQuery MCP:
• **Perform deep-dive SQL forensics across your SecOps data lake.
• **GCP Logging MCP & GCP Monitoring MCP:
• **Audit platform health and detect failures in your SecOps pipelines.

Setup Gemini CLI + GCP Hosted MCP Servers

In order to use Google’s Hosted MCP you are going to need a MCP Client. I will be using Gemini CLI, but you should also be able to this guide as a basis and adapt to alternate MCP clients.

1. Environment Initialization:

• Install the Gemini CLI and enable Google’s MCP Servers.

2. GCP Hosted MCP Servers:

• Enable the Google Cloud Hosted MCP servers.

3. SecOps Integration:

• Map IAM roles and verify access to the Google SecOps API.

4. Gemini CLI Configuration:

• Connect the Gemini CLI to your hosted MCP servers.

5. Validation:

• Test authentication and run your first SecOps-connected prompt.

Prerequisites

To complete this setup as documented below, verify you have the following access and tools available before beginning:

Google Cloud Environment

• Google Cloud SDK (gcloud):
• Installed and authenticated on your local machine.
• GCP Project Access:
• An active Google Cloud Project with the **Vertex AI API** enabled.
• IAM Roles:
• Your user account needs the **Vertex AI User** role at minimum.

Google SecOps Configuration

• Initial Access:
• You must have logged into the Google SecOps UI at least once to initialize your profile.
• **Permissions:
• GCP IAM:** Appropriate permissions to view/manage SecOps resources.
• Internal Mapping: A valid IAM Role Mapping configured within the Google SecOps settings.

3. Authentication

• Gemini API Key:
• A valid key generated from **Google AI Studio** or via your GCP project using Vertex AI, depending on your preferred auth method.

Cost and Billing Overview

While setting up the Gemini CLI and most MCP servers is free, some services operate on a “pay-as-you-go” model.

1. Free

• GCP Developer Knowledge MCP:
• No cost for documentation retrieval.
• SecOps SIEM & SOAR APIs:
• Covered by your SecOps license; no additional per-query surcharge for API access.
• Logging & Monitoring:
• Standard platform logs and metrics retrieval via MCP are free of charge.

2. Billable

• **Gemini (Vertex AI/AI Studio):
• You are charged based on tokens** (input and output).
• Using Gemini Flash is cheaper than Gemini Pro
• GCP BigQuery MCP:
• BigQuery charges based on the **amount of data scanned
• *⚠️ An accidental `SELECT on a massive SecOps datalake table can be expensive. Always useWHERE` clauses and limit your columns.

As a best practice you can set GCP Budget Alerts to keep track of your spend and cost.

1. Environment Initialization

Install the Google Cloud SDK (GCloud)

To securely use the Gemini CLI with Google Cloud OAuth locally, we’re going to need to install the Google Cloud CLI (gcloud).

Instructions for all Operating Systems are available here:

[embed]Quickstart: Install the Google Cloud CLI | Google Cloud SDK | Google Cloud Documentation Learn how to install Google Cloud CLI and run a few core gcloud CLI c ommands.docs.cloud.google.com

Once gcloud is installed, open your terminal or command prompt and run the following commands to initialize, generate your Application Default Credentials (ADC), and set your active configuration. Replace the <bracketed values> with your actual email and Google Cloud Project ID:

# Initialize gcloud and follow the browser prompts
gcloud init

# Configure Application Default Credentials (ADC)
gcloud auth application-default login

# Set your project defaults explicitly
gcloud config set project <your_gcp_project_id>
gcloud config set billing/quota_project <your_gcp_project_id>

# Enable the Vertex AI API
gcloud services enable aiplatform.googleapis.com

Optionally, but highly recommended, if you will be using Vertex AI over a Gemini API key, enable the required Vertex AI API in your Google Cloud project:

gcloud services enable aiplatform.googleapis.com

Prepare Gemini CLI Authentication

To use Gemini CLI you need to authenticate, and you can use either a Gemini API Key, or Vertex AI.

• AI Studio (GEMINI_API_KEY): A static key like AIzaSy... pasted into your config or environment variables. This carries a higher security risk; static keys can be inadvertently captured in shell history (~/.bash_history) or leaked via GitHub commits..
• Vertex AI (gcloud auth): Your CLI relies on the Google Cloud SDK. You run: gcloud auth application-default login The CLI then acts as you (or a service account) without you ever handling a raw secret string. This is the industry standard for secure CLI tools.

Given this, the recommended approach for authentication within Gemini CLI is to Login with Google and use Vertex AI.

AI Studio versus Vertex AI: A Summary

⚠️ Note on Workforce Identity Federation (WIF)

While Google SecOps supports WIF, the specific Provider used for SecOps authentication does not appear to be compatible for OneMCP. I think this is because the SecOps authentication callback does not provide the needed parameters by the GCP Console. If you intend to use WIF for OneMCP, you must configure a separate WIF flow specifically for GCP Console access.

[embed]Set up user access to the console (federated) | Identity and Access Management (IAM) | Google Cloud… This guide shows you how to set up access to the Google Cloud Workforce Identity Federation console, also known as the…docs.cloud.google.com

[embed]Sign in to the gcloud CLI with your federated identity | Identity and Access Management (IAM) |… This document describes how to sign in to the Google Cloud CLI with your federated identity by using a browser-based…docs.cloud.google.com

Install Node & Gemini CLI

Gemini CLI is published as a Node.js package, which means you will need Node and npm installed on your system to run it. Detailed system requirements and instructions for various operating systems can be found in the official documentation:

[embed]Gemini CLI installation, execution, and releases This document provides an overview of Gemini CLI’s sytem requriements, installation methods, and release types…geminicli.com

Once Node is installed, you can install the Gemini CLI either locally or globally, depending on your preference:

# Local installation
npm install @google/gemini-cli@latest

# or, Global installation
npm install -g @google/gemini-cli@latest

# Verify the installation
gemini --version

⚠️ ️Troubleshooting: Installing Node on Debian Linux

If you are using a Debian-based Linux distribution, you might find that the default apt version of Node is too old to run the Gemini CLI. The best workaround I found is to install Node via NVM (Node Version Manager).

Run the following commands to install NVM and grab the latest Long Term Support (LTS) version of Node:

# 1. Download and install NVM
wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash

# 2. Load NVM into your current shell session
export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"

# 3. Install the latest LTS version of Node.js
nvm install --lts

# 4. Verify installation
node -v
npm -v

2. GCP Hosted MCP Servers

Configure GCP Hosted MCP Servers

Google Cloud released their initial series of Hosted Model Context Protocol (MCP) servers in Q4 2025, and in this section we’ll enable the following MCP Servers:

• **Google SecOps MCP**
• **GCP Developer Knowledge MCP**
• **GCP BigQuery MCP**
• **GCP Logging MCP**
• **GCP Monitoring MCP**

Google Cloud Hosted MCP: An Overview

Enable the GCP Hosted MCP Services

MCP Services are automatically enabled when the associated API is enabled now; however, to manually enable the a MCP Server the commands are as follows.

Replace <your_gcp_project_id> with your actual Google Cloud project ID:

# Google SecOps
gcloud beta services mcp enable chronicle.googleapis.com --project=<your_gcp_project_id>

# GCP Developer Knowledge
gcloud beta services mcp enable developerknowledge.googleapis.com --project=<your_gcp_project_id>

# GCP BigQuery
gcloud beta services mcp enable bigquery.googleapis.com --project=<your_gcp_project_id>

# GCP Logging
gcloud beta services mcp enable logging.googleapis.com --project=<your_gcp_project_id>

# GCP Monitoring
gcloud beta services mcp enable monitoring.googleapis.com --project=<your_gcp_project_id>

3. SecOps Integration

Configure GCP IAM for SecOps MCP Access

In order to access a Google Cloud Hosted MCP Server the principal (a user, service account, or group) will require the MCP Tool User IAM Role:

• [MCP tool user](https://docs.cloud.google.com/iam/docs/roles-permissions/mcp#mcp.toolUser)

To use Google SecOps, the principal requires appropriate IAM permissions. A standard admin setup includes:

• [Chronicle API Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.admin)
• [Chronicle SOAR Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.soarAdmin)
• [Service Usage Consumer](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.serviceUsageConsumer)
• [Vertex AI User](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.user)

However, because the Admin roles are highly privileged, it is strongly recommended to apply the principle of least privilege using the following roles:

• [Chronicle API Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.viewer)
• Chronicle SOAR Viewer * (See note below)
• [Service Usage Consumer](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.serviceUsageConsumer)
• [Vertex AI User](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform#aiplatform.user)

Why is the Service Usage Consumer IAM Role needed?

The roles/serviceusage.serviceUsageConsumer role is required because it provides the serviceusage.services.use permission, which authorizes a user to consume the quota and billing of a Google Cloud project.

The “Chronicle SOAR Viewer” Role & IAM Role Mapping

If you are looking for the native Chronicle SOAR Viewer role, you’ll find it has been deprecated. This change appears a result of the ongoing SOAR migration process, which unifies SecOps (SIEM and SOAR) under a single, standard API: chronicle.googleapis.com.

This former IAM Role (below) appears to have been mostly merged into the Chronicle API Viewer role, which can now be used in its place.

# Chronicle SOAR Viewer (deprecated)
'chronicle.attachments.get', 
'chronicle.caseAlerts.get',
'chronicle.caseCloseDefinitions.get',
'chronicle.caseComments.get',
'chronicle.caseQueueFilters.get',
'chronicle.caseTagDefinitions.get',
'chronicle.cases.generateReport',
'chronicle.cases.get',
'chronicle.chatMessages.get',
'chronicle.contentPacks.get',
'chronicle.contextProperties.get',
'chronicle.customFieldValues.get',
'chronicle.customFields.get',
'chronicle.environmentGroups.get',
'chronicle.environments.get',
'chronicle.integrationActions.get',
'chronicle.involvedEntities.get',
'chronicle.legacyCases.get',
'chronicle.legacySearches.searchCases',
'chronicle.legacySearches.searchEntities',
'chronicle.legacySoarAdvancedReports.get',
'chronicle.legacySoarDashboards.get',
'chronicle.legacySoarReports.get',
'chronicle.legacySoarUsers.get',
'chronicle.legacySystemMetadata.get',
'chronicle.marketplaceIntegrations.get',
'chronicle.moduleSettings.rebranding',
'chronicle.requestTemplates.get',
'resourcemanager.projects.get',
'resourcemanager.projects.list'

However, from testing it is missing two required IAM permissions needed in order to login to the UX. I create a new custom IAM Role called Chronicle SOAR Viewer for this purpose.

chronicle.userNotifications.get
chronicle.userLocalizations.get

📝 The new way of managing IAM in a migrated SOAR post stage 2 probably deserves a blog post of its own due to the significant and what appears not fully documented changes at present.

To maintain a Least Privilege approach for your MCP integration, I see two approaches:

A) Use “Default Access Settings”

Combine the Chronicle API Viewer and Chronicle SOAR Viewer role in GCP IAM with the Default Access Settings within the SecOps UI. This is best suited for where broad default access is acceptable across the tenant.

Assign roles/chronicle.viewer in GCP IAM and ensure the "Default Access" in SecOps is configured for least privilege permissions with a custom SOC Role.

B) Custom IAM Roles Mapping

Create a Custom GCP IAM Role and pair it with IAM Role Mapping. This is best suited for production environments requiring least privilege access for multiple groups to different SOAR environments.

• Create a custom role with the specific chronicle.* permissions. This can be based off of the existing Chronicle API Viewer.
• Map this role within the SecOps "Role Mapping" settings

⚠️ This approach is challenging at present as there appears to be a lack of documentation for creating custom SOAR Roles and which IAM roles are required.

Configure and Verify Google SecOps Access

❗Even after granting GCP IAM roles, SecOps SOAR may require an explicit internal mapping to authorize your specific identity. Because we are using Google Managed Accounts, SecOps does not automatically “see” your group memberships from Cloud Identity — you must define them manually. This is unless you have already logged into the tenant and have an existing User in SOAR Settings > Users.

To enforce a least privilege approach map your GCP IAM Role to the appropriate Permission Groups, SOC Roles, and Environments within the SecOps UI.

⚠️ Note, I am not 100% that the Permissions Group does anything here in that in a stage 2 migrated SOAR, Permissions Groups are only for API access. The SecOps provided migration scripts will have in effect re-created these as custom GCP IAM Roles, which are likely what you will be mapping in the IAM Role section.

How to configure IAM Role Access with Group Members in SecOps SOAR

If a user has not previously logged in then you will need to manually add thier email address into the Group Memebers associated with that IAM order to login.

Adding Group Members to the appropriate IAM Role

4. Gemini CLI Configuration

There are several steps required to get the Gemini CLI working with Google Cloud Hosted MCP Services.

Configure and Test Auth

The first step is to verify your configured authentication method works as expected.

Because we are accessing sensitive security data via Google SecOps, we will use Vertex AI as the authentication method. To use Vertex AI with the Gemini CLI, you must set the required environment variables. Add the following to your terminal initialization script (e.g., ~/.bashrc or ~/.zshrc):

export GOOGLE_CLOUD_PROJECT="<your_gcp_project_id>"
export GOOGLE_CLOUD_LOCATION="global"

Run source ~/.bashrc to apply the changes.

When you run the gemini command and log in for the first time, you will be prompted to choose your auth method - choose accordingly.

Choosing your authentication method in Gemini CLI

Add MCP Servers

The next step is to configure your MCP Servers to connect the Gemini CLI to your external services.

Note: While you can add MCP Servers using the *gemini mcp add* command line syntax, at the time of writing, not all the required OAuth parameters are fully supported. Therefore, we will manually edit the configuration file.

[embed]Set up an MCP server Connect Gemini CLI to your external databases and services. In this guide, you’ll learn how to extend Gemini CLI’s…geminicli.com

The Gemini CLI configuration file is located in your home directory at ~/.gemini/settings.json.

The following example configuration will add Google SecOps, Google Developer Knowledge, Cloud Monitoring, and Cloud Logging MCP Servers.

{
  "security": {
    "auth": {
      "selectedType": "vertex-ai"
    }
  },
  "ui": {
    "theme": "Atom One"
  },
  "mcpServers": {
    "GoogleSecOps": {
      "httpUrl": "https://us-chronicle.googleapis.com/mcp",
      "authProviderType": "google_credentials",
      "oauth": {
        "scopes": [
          "https://www.googleapis.com/auth/cloud-platform"
        ]
      },
      "timeout": 30000,
      "headers": {
        "x-goog-user-project": "<YOUR_SECOPS_GCP_PROJECT>"
      },
      "includeTools": [
        "create_case_comment",
        "execute_manual_action",
        "get_alert_latest_investigation",
        "get_case",
        "get_case_alert",
        "get_connector_event",
        "get_investigation_by_id",
        "get_involved_entity",
        "get_ioc_match",
        "get_reference_list",
        "get_rule",
        "get_security_alert",
        "list_case_alerts",
        "list_case_comments",
        "list_cases",
        "list_connector_events",
        "list_data_table_rows",
        "list_data_tables",
        "list_feeds",
        "list_integration_actions",
        "list_integration_instances",
        "list_integrations",
        "list_involved_entities",
        "list_log_types",
        "list_parsers",
        "list_playbook_instances",
        "list_playbooks",
        "list_rule_detections",
        "list_rule_errors",
        "list_rules",
        "list_security_alerts",
        "search_entity",
        "summarize_entity",
        "translate_udm_query",
        "trigger_investigation",
        "udm_search",
        "update_case",
        "update_case_alert"
      ],
      "trust": true
    },
    "DeveloperKnowledge": {
      "httpUrl": "https://developerknowledge.googleapis.com/mcp",
      "authProviderType": "google_credentials",
      "oauth": {
        "scopes": [
          "https://www.googleapis.com/auth/cloud-platform"
        ]
      },
      "headers": {
        "x-goog-user-project": "<YOUR_SECOPS_GCP_PROJECT>"
      }
    },
    "CloudLogging": {
      "httpUrl": "https://logging.googleapis.com/mcp",
      "authProviderType": "google_credentials",
      "oauth": {
        "scopes": [
          "https://www.googleapis.com/auth/cloud-platform"
        ]
      },
      "headers": {
        "x-goog-user-project": "<YOUR_SECOPS_GCP_PROJECT>"
      }
    },
    "CloudMonitoring": {
      "httpUrl": "https://monitoring.googleapis.com/mcp",
      "authProviderType": "google_credentials",
      "oauth": {
        "scopes": [
          "https://www.googleapis.com/auth/cloud-platform"
        ]
      },
      "headers": {
        "x-goog-user-project": "<YOUR_SECOPS_GCP_PROJECT>"
      }
    }
  },
  "general": {
    "previewFeatures": true,
    "vimMode": true,
    "sessionRetention": {
      "enabled": true,
      "maxAge": "30d",
      "warningAcknowledged": true
    }
  },
  "experimental": {
    "skills": true
  }
}

Key Configuration Fields Explained:

• **selectedType:** Set to vertex-ai for this guide. If you are not using Vertex AI, you may need to change this (e.g., gemini-api-key).
• **httpUrl:** The endpoint must match your specific Google SecOps tenant region. For example, if you use the europe-west3 region, the URL is [https://chronicle.europe-west3.rep.googleapis.com/mcp.](https://chronicle.europe-west3.rep.googleapis.com/mcp.)
• **x-goog-user-project:** This header must contain the GCP Project ID associated with your Google SecOps tenant
• **includeTools:* (Optional) You can restrict the AI to only use specific tools from the server by listing them here. - Note, in a future post I will explore in more detail why a limited set of Tools is used*

The list of available themes for Gemini CLI (or even creating your own) is documented here:

[embed]Themes Gemini CLI supports a variety of themes to customize its color scheme and appearance. You can change the theme to suit…geminicli.com

Add a GEMINI.md for the SecOps OneMCP Server

In Gemini CLI, a GEMINI.md file is a markdown document used to provide instructional context to the AI.

[embed]Provide context with GEMINI.md files Context files, which use the default name GEMINI.md, are a powerful feature for providing instructional context to the…geminicli.com

These files allow you to define project-specific rules, personas, or coding style guides once, ensuring they are applied to all your interactions without needing to repeat them in every prompt.

For the Google SecOps Hosted MCP server, specific tenant parameters are required for tool execution. Since these cannot currently be passed as HTTP headers in the CLI configuration, the simplest workaround is to provide them via the context file.

Create a global context file in your Gemini directory:

nano ~/.gemini/GEMINI.md

Add the following instructions, replacing the bracketed values with your actual SecOps details:

# Google SecOps Configuration
My Google SecOps environment details are:
- Customer ID: <SECOPS_CUSTOMER_ID>
- Region: <SECOPS_REGION>
- Project ID: <GCP_PROJECT_ID>
**Rule:** Always use these exact parameters for EVERY SecOps tool request.

Note: Because this file is located at ~/.gemini/GEMINI.md, these instructions will apply globally to all your CLI sessions. If you manage multiple SecOps tenants and only want these rules applied to a specific project, create the GEMINI.md file in your local working directory instead.

Verify Context Loading

When you launch the Gemini CLI, you can verify that these instructions were successfully loaded into the AI’s memory using the /memory command:

• Type /memory show to print the current active context and verify your SecOps parameters are visible.
• Type /memory refresh to force the CLI to re-scan the file if you make changes while a session is already running.

Verifying your custom context instructions for SecOps MCP Server are loaded in Gemini CLI

Test your MCP Server

At this stage, we are finally ready to test the SecOps Hosted MCP Service and ensure the CLI can communicate with your environment.

1. Launch a new instance of the Gemini CLI in your terminal.

2. Run the following command to verify your MCP servers are connected successfully:

/mcp list

The expected output will be a list of your configured MCP servers and their available tools.

Testing you can list Tools on your MCP Server

3. Choose a tool to test. For example, to test the list_rules tool from the Google SecOps MCP Server, simply prompt the AI:

"Please use the SecOps MCP to list my rules."

Or you can literally just write the Tool name

4. Verify that the output returned by the CLI matches what you would expect to see directly in your SecOps tenant UI.

You can repeat the same process for a given tool from each GCP hosted MCP server to test they work as expected.

Congratulations, you have setup your Gemini CLI as a MCP Client to GCP’s hosted MCP Servers 🎉

Errors & Troubleshooting

Setting up MCP involves several authentication layers. If you run into issues, use the following guide to identify the “break” in the chain.

Identity Mismatch (WIF vs. Google Account)

Error: ✕ MCP ERROR (GoogleSecOps) ... PERMISSION_DENIED

This occurs if your SecOps tenant is configured for Workforce Identity Federation (WIF) and permissions are assigned to a WIF principal (e.g., principalSet://...), but you logged into gcloud using a standard Google

Ensure your gcloud auth login matches the identity type that holds the IAM permissions.

• If you are testing as an individual, ensure your Google Identity email has the roles assigned directly, rather than relying on a WIF pool.

Example minimal GCP IAMs to use SecOps MCP logged in with a Google account

MCP Service Not Enabled

Error: ✕ MCP ERROR (DeveloperKnowledge) ... tool reported a permission error related to project gus-sdl

The specific Hosted MCP Server has not been enabled for your project. Re-run the enablement command for the specific service:

gcloud beta services mcp enable chronicle.googleapis.com --project=<YOUR_PROJECT_

Missing “First Login” Initialization

Error: ✕ MCP ERROR (GoogleSecOps) ... list_cases tool is not available.

Google SecOps SOAR requires a "profile initialization" that only happens when you log into the web UI for the first time. Open the Google SecOps URL in your browser, log in once, and then retry the CLI command.

Missing Role Mapping in SOAR

Error: I encountered a PERMISSION_DENIED error... Project ID: thatsiemguy might be incorrect.

Even if GCP IAM is correct, the SOAR Group Mapping (Settings > Advanced > Group Mapping) is missing your email or the associated IAM role. Ensure your email is manually added to the Group Members list in the SecOps SOAR settings as detailed in Step 3.

Debugging with curl

If the Gemini CLI output is too vague, you can bypass the CLI and hit the MCP endpoint directly using curl. This helps determine if the issue is with the CLI configuration or your GCP Permissions.

curl --location 'https://chronicle.us.rep.googleapis.com/mcp' \
  -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'x-goog-user-project: <YOUR_PROJECT_ID>' \
  -d '{
    "method": "tools/call",
    "params": {
      "name": "list_rules",
      "arguments": {
        "project_id": "<YOUR_PROJECT_ID>",
        "customer_id": "<YOUR_CUSTOMER_ID>",
        "region": "<YOUR_REGION>"
      }
    },
    "jsonrpc": "2.0",
    "id": 1
  }' -s

This curl tip is from the official GCP SecOps MCP GitHub repo, a resource worth being aware of.

[embed]mcp-security/docs/remote_server.md at main · google/mcp-security Contribute to google/mcp-security development by creating an account on GitHub.github.com

Conclusion

This post covers setting up the Gemini CLI with Google’s Hosted MCP servers, but while hopefully a useful configuration exercise — it will be the foundation for future posts. In the coming weeks, I aim to release a series of deep dives into each GCP MCP server, how you can use them in combination, explore **Gemini CLI Skills, and build custom [Google ADK Agents](https://google.github.io/adk-docs/)**.

As the the world of MCP and AI-driven security is moving fast (it has likely changed by the time I’ve finished this…) as Google releases updates to the hosted servers and authentication flows, I will aim keep this guide updated.

Let me know how it goes: Did you run into a unique error? Have a specific use case you want to see covered? Drop a comment below or message me.