docs(mcp): add Gemini Enterprise connection guide - #461
Open
leet-c1 wants to merge 4 commits into
Open
Conversation
Documents connecting Google Gemini Enterprise to the C1 MCP gateway so tool calls are attributed to individual users rather than a shared service account. Covers the Google Cloud prerequisites, the organization policy that blocks custom MCP data connectors by default, the OAuth client ID C1 publishes for Gemini Enterprise, the data store wizard, and enabling tools. Gives gcloud equivalents alongside the console steps wherever an API exists, and recommends the command line given the number of steps. Agent Registry and Agent Gateway are documented as an optional catalog path rather than a requirement, since Gemini Enterprise data connector traffic does not trigger gateway policy enforcement. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Corrects placeholder conventions so bash fences use YOUR_TENANT and text fences use angle-bracket values, which also stops the shell from reading angle brackets as redirection. Adds outcome sentences after each procedure, moves the irreversible-ID warning and the connector-state note above the steps they govern, splits bundled actions into single-action steps, and makes the Limitations and Related headings self-describing. Adds the AI access management prerequisite link, corrects the CLI coverage claim to match what the page actually provides, points administrators at AI access management for verification, and uses the documented kill switch terminology. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
leet-c1
marked this pull request as ready for review
August 19, 2026 01:05
A usability pass and an accuracy pass against Google's and C1's
documentation and the C1 source found roughly thirty defects, thirteen of
which stopped a reader outright. The page went out console-first in shape
but had been written from lab notes, so several console paths named no
values and several claims were lab observations presented as documented
behavior.
Reader-blocking fixes:
- The API section named no APIs in the console path. It now leads with a
table carrying the console display name, the service ID, and what each
API is for, which serves both the console and CLI reader.
- The organization policy section was CLI-only, despite being the one
step that has to be handed to someone else. It now gives the console
path first and a check-before-you-change command.
- Added the C1-side prerequisite. A reader could complete every step and
still get an empty action list because the authorizing user has no
toolset, which was the most likely real-world outcome and appeared
nowhere.
- Added a table of the four values every step reuses, each with where to
obtain it. Nothing previously said where the project ID or tenant came
from, and one command referenced an engine ID the page never defined.
- Confirmed the client metadata URL resolves before the reader depends
on it, since the endpoint ships in a release not all tenants run.
Accuracy fixes:
- offline_access does not gate refresh-token issuance. Nothing in the
token path reads the scope string; the gate is the client declaring
the refresh_token grant. The causal claim and the troubleshooting row
built on it are gone.
- The one-hour dynamic-registration expiry applies to an unapproved
registration. Stated unconditionally before.
- roles/orgpolicy.policyAdmin is grantable at the organization level
only, not organization or folder.
- Google asks for roles/discoveryengine.editor, not .admin.
- Client Secret is required by the console, so the page now says to
enter a placeholder and explains that C1 never reads it.
- Dropped the gcloud beta prerequisite and its troubleshooting row. Both
commands that needed it are gone and the rest are GA.
- The metadata document returns two values, not three. The MCP server
URL comes from the C1 UI.
- Replaced the borrowed system-log filter. It came from a page covering
a different feature; AI access management logs a different schema.
Structure: the Agent Registry path consumed a quarter of the page, could
not be completed from it, and by Google's own documentation adds no
governance to this traffic. It is now a short section that says what it is
and links to Google's documentation, which removed the region table, the
beta prerequisite, two roles rows and several troubleshooting rows along
with it. Form caveats moved into the field table where the reader meets
them rather than after the form is submitted, the action limit moved ahead
of the selection step, verification gained a failure branch, and the
limitations list separates what constrains the reader from what C1
already satisfies.
Net 92 lines shorter.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Follow-up corrections from the accuracy pass. Client Secret now says to enter `none`, which is the value Google's own documentation gives for PKCE clients, rather than an arbitrary placeholder. The field is required by the console even though PKCE needs no secret. The 100-action figure is a documented maximum, not a recommendation. Softened the orgpolicy.policyAdmin claim. Project Owner is genuinely insufficient and an organization-level grant is what worked in testing, but the page asserted that a project-level grant is impossible, which Google does not state. Added the two things most likely to strand someone on the optional Agent Registry path: the gateway denies egress until the calling identity is authorized through IAM, and C1's client metadata self-fetch requires a publicly resolving tenant hostname, which affects self-hosted installations. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
product/admin/mcp-server/gemini-enterprise.mdxand registers it in the C1 MCP nav group, following thecopilot-studioprecedent for an AI client platform connecting inbound to the C1 MCP gateway.Why this page
Gemini Enterprise is the first client platform that cannot register itself with C1. Claude Code and Cursor use dynamic client registration; Gemini Enterprise takes a static OAuth client configuration. Getting that working required a specific, non-obvious setup, and several of the steps are documented nowhere else.
What was verified in a live lab
Every command and console step was run against a real Google Cloud project and C1 tenant. Confirmed working end to end:
Findings that shaped the page
Four steps are missing from Google's own documentation, and each one blocked setup completely:
constraints/discoveryengine.managed.disableCustomMcpServerConnectorblocks data store creation by default. Google's docs reference an unnamed constraint; this is the actual ID. It needs org-level permission and takes minutes to propagate, failing identically the whole time.connectors.googleapis.com,integrations.googleapis.com,secretmanager.googleapis.comback the tool actions and are absent from Google's required-API list.inputSchemais required intoolspec.jsoneven though Google's published example omits it.Agent Gateway is documented as optional. The live connector reports
use_agent_gateway_egress: false, and Google's documentation confirms Gemini Enterprise data connector traffic does not trigger gateway policy enforcement. Presenting it as required would roughly double the setup burden for governance the gateway does not actually apply here. C1 governs the tool calls.CLI coverage
There is no
gcloudsurface for Gemini Enterprise. The page givesgcloudwhere it exists, raw REST for the Agent Gateway binding, and console steps for the two operations with no public API (creating the data store, enabling tools).Known gap, and why this is a draft
Tool discovery does not currently succeed in testing. "Reload custom actions" returns
400 FAILED_PRECONDITIONfromRefreshDataConnectorTools. Ruled out: C1 availability, the missing tool-action APIs, and the known API-key 401 bug affecting other customers, which presents differently. The method is not exposed on the public API endpoint, so there is no CLI workaround to document.Until that is resolved, a customer following this page reaches the final step and stops. Do not merge as published customer guidance yet.
Companion change
The client ID this page tells customers to paste depends on C1 publishing a client metadata document for Gemini Enterprise. That is a separate pull request in the product repository and must ship first.
Style
Written against
.claude/skills/docs-writing.mdand the C1 brand voice guidance, then audited. No banned words or hedges, no em dashes, all six in-page anchors resolve, all component tags balanced, placeholder conventions consistent per fence type, anddocs.jsonvalidates.🤖 Generated with Claude Code