Gemini Enterprise MCP: How to Connect Your Own Software

To connect your own software to Gemini Enterprise, you expose it as a custom MCP server: a Streamable HTTP endpoint over public HTTPS, usually with OAuth, which an administrator adds as a data store in the Google Cloud console. Each tool on the server becomes an "action" the Gemini agent can call, off by default, up to 100 enabled at once, with a confirmation before anything that is not marked read-only. It matters more since 8 October, when Google put an agent inside Gemini that plans work, delegates to subagents and "can connect and work securely with any Model Context Protocol (MCP) server inside or outside the company's network", launching for businesses first. Below: the setup as Google documents it, the traps, and how it compares with Claude and ChatGPT.

---

What Google announced on 8 October

At a Google Cloud event, Google launched a single agent inside Gemini that takes objectives rather than instructions, plans the work, uses skills and tools, and connects to internal systems. Per TechCrunch's report:

• Businesses first, consumers later. Early testers named: On, Shopify and PayPal.
• Built-in connectors for Google Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake and others.
• Any MCP server for everything else, inside or outside the company network.
• Its own Workspace account and email address, so its actions show in an audit trail under the agent, not a person.
• A model picker that includes Anthropic's Claude models.

The built-in connectors cover common SaaS. Your ERP, your quoting tool, the back-office app someone built in 2017: those reach Gemini through MCP.

The setup, step by step

From Google's documentation for the Custom MCP Server connector:

Prerequisites (an administrator, once):

1. Override the organization policy that blocks creating custom MCP data stores. It is blocked by default.
2. Allow egress to your server's domain and its authorization and token domains (the allowedEgressFqdns constraint). Only the domain, not the full URL.
3. If your project restricts data sources or uses VPC Service Controls, add custom_mcp to the allowed data sources (allowedDataSources).
4. Give the person creating it the Discovery Engine Editor role.
5. Register Gemini Enterprise as an OAuth client with your identity provider, redirect URL https://vertexaisearch.cloud.google.com/oauth-redirect.

Then in the console: Gemini Enterprise, Data stores, Create data store, search "Custom MCP Server", add the server URL and the OAuth fields (authorization URL, token URL, client ID, client secret, scopes, optional PKCE), Verify Auth, Create. Once it shows Active: Actions, Reload custom actions (this runs tools/list), pick the actions, Enable actions.

The traps

• Streamable HTTP only. Google's words: the connector "exclusively supports the new StreamableHTTP transport". A server still on the legacy SSE transport will not connect.
• A real certificate. HTTPS with a publicly trusted CA, for public and private servers alike. Self-signed is refused.
• Private servers mean Cloud Run. The documented private option is a Cloud Run service reachable by Gemini Enterprise's service agent, which then needs the Cloud Run Invoker role. Google sends its own signed ID token in X-Serverless-Authorization and the user's OAuth token in Authorization, so both arrive on the same request.
• You register the client, not Gemini. Claude and ChatGPT can register themselves with your authorization server, through Client ID Metadata Documents or dynamic client registration. Gemini Enterprise's form asks you for a client ID and secret. If your authorization server only hands out public clients that way, add a confidential client first.
• 100 actions at a time. Every tool is imported, all start disabled, and you enable up to 100. A server with hundreds of fine-grained tools needs grouping before it fits. We wrote about running 91 tools on one server.
• Confirmation is on by default. Every action asks the user first, unless the tool is annotated readOnlyHint: true. Annotate read-only tools honestly, and leave destructiveHint on anything that changes data.
• Long work should not block. Google recommends job-polling tools for long-running operations: one tool starts the job, another checks it.
• Tools are what Google documents. The connector imports tools as actions; Google's page does not mention MCP resources, prompts or elicitation. Design for tools only.

Gemini Enterprise vs Claude vs ChatGPT

One well-built server can serve all three. The work is the same: tools that match how your team works, permissions enforced on every call, sign-in per user. See what MCP OAuth is and remote MCP servers.

What we do, and what we don't do yet

What we run: MCP servers for business systems on the official Go SDK, stateless over Streamable HTTP, which is the transport Gemini Enterprise requires. Users sign in with OAuth and PKCE, and each tool's scope follows its readOnlyHint: read-only tools need only the read scope, everything else needs write, the same annotation Gemini uses to skip confirmation. Our servers run on Google Cloud, in our own infrastructure.

What we don't do yet: we have not connected one of our servers to Gemini Enterprise in production. Our CRM's authorization server registers only public clients through dynamic registration, with no client secret, which suits Claude and ChatGPT. For Gemini Enterprise we would add a confidential client, which is a small change but one we have not shipped. If your company is on Gemini Enterprise, that is the first thing we would check together.

Related

• What is MCP?
• MCP elicitation: how a server asks the user mid-task
• MCP security