-
Notifications
You must be signed in to change notification settings - Fork 0
MCP Resources Reference
MCP Resources are read-only data sources that the LLM can access directly without a tool call. They are always available regardless of which --modules are enabled, as long as the required GCP APIs are accessible.
Unlike tools, resources are identified by URI rather than name. The LLM reads them as context when composing answers.
These URIs resolve to a full snapshot of the resource type.
All BigQuery datasets in the project.
Returns: Dataset ID, location, description, default table expiration, labels, creation time.
Required API: bigquery.googleapis.com
Required role: roles/bigquery.metadataViewer
All Cloud Run services across all regions.
Returns: Service name, region, URL, latest revision, traffic allocation, labels.
Required API: run.googleapis.com
Required role: roles/run.viewer
All Cloud Storage buckets in the project.
Returns: Bucket name, location, storage class, creation time, labels.
Required API: storage.googleapis.com
Required role: roles/storage.objectViewer
The effective IAM permissions held by the server's identity (the service account or ADC principal).
Returns: Per-permission allowed: true/false for the set of permissions the server tests.
Required API: cloudresourcemanager.googleapis.com
Required role: The caller needs no special role — this tests the caller's own permissions.
Use case: Read this resource first in any automated workflow to understand the audit scope before calling tools.
These URIs are resolved at read time by substituting path segments.
All tables in a BigQuery dataset with row counts, sizes, and schema summaries.
Required: dataset ID in the path.
Full field definitions for a BigQuery table, including nested fields.
Required: dataset ID and table ID in the path.
A snapshot of a single Cloud Run service: URL, traffic splits, container image, CPU/memory limits.
Required: region and service name in the path.
The revision list for a Cloud Run service with traffic allocation per revision.
Required: region and service name in the path.
Metadata for a single Cloud Storage bucket: versioning, lifecycle rules, uniform access control, public access prevention, CORS, retention policy.
Required: bucket name in the path.
A summary of objects in a Cloud Storage bucket (configuration summary, not a full object listing).
Required: bucket name in the path.
Resources are most useful when the LLM needs persistent context across a multi-step workflow. For example, the audit-security-posture prompt reads gcp://{project}/iam/my-permissions first to understand what the server can see before calling any tools.
You can also explicitly direct the LLM to read a resource:
"Read the BigQuery datasets resource for project my-project and tell me which datasets have no description."
"Use the Cloud Run services resource for project my-project to list all services that have more than one revision receiving traffic."