Google Cloud Compute Engine MCP server
29 tools · Last check that passed 27 Oct 2026, 01:50 UTC
Google's own remote MCP server for Compute Engine gives an agent the VM instances, instance groups, templates, disks and snapshots of the Google Cloud projects its sign-in reaches. Once a day, Stackduke connects to it the way any MCP client would, with no account and no sign-in, and lists its tools. It never runs them.
All 29 tools
| Tool | Counted as |
|---|---|
create_instance | Deletes |
delete_instance | Deletes |
reset_instance | Deletes |
set_instance_machine_type | Deletes |
start_instance | Deletes |
stop_instance | Deletes |
get_commitment_basic_info | Said to only read |
get_disk_basic_info | Said to only read |
get_disk_performance_config | Said to only read |
get_instance_basic_info | Said to only read |
get_instance_group_manager_basic_info | Said to only read |
get_instance_template_basic_info | Said to only read |
get_instance_template_properties | Said to only read |
get_reservation_basic_info | Said to only read |
get_reservation_details | Said to only read |
get_zone_operation | Said to only read |
list_accelerator_types | Said to only read |
list_commitment_reservations | Said to only read |
list_commitments | Said to only read |
list_disks | Said to only read |
list_images | Said to only read |
list_instance_attached_disks | Said to only read |
list_instance_group_managers | Said to only read |
list_instance_templates | Said to only read |
list_instances | Said to only read |
list_machine_types | Said to only read |
list_managed_instances | Said to only read |
list_reservations | Said to only read |
list_snapshots | Said to only read |
The tools the server listed at the last check that passed, at its default address and settings, with no sign-in; an account that signs in, or other settings, may see other tools. What a tool is counted as doing is Stackduke's cautious reading of the server's labels, the tool's name and its description: where they disagree it takes whichever says the tool can do most, so it overcounts on purpose. It does not say the server is safe, and it does not list what a tool cannot do. Descriptions are not shown, because they are written for models and may try to steer them.
Recent checks
13 of the last 13 checks passed
A check passes when the server lists its tools. Checked at https://compute.googleapis.com/mcp.
Recent changes
24 Oct 2026, 06:07 UTC, after a check on 23 Oct 2026, 09:50 UTC
Inputs or outputs changed on get_commitment_basic_info, get_instance_group_manager_basic_info, get_instance_template_properties, list_commitments, list_instance_group_managers.
From the scan of 27 Oct 2026, 01:52 UTC. "Changed" and "Can do more" count changes from the last 30 days; older ones stay listed here. A change made and undone between two checks is not seen. Every check is in the scanner's public data.
Know when Google Cloud Compute Engine's tools change.
One email when Google Cloud Compute Engine's official MCP server adds, removes or changes tools, with what changed. Nothing else.
What to watch for
- With the read-write scope, an agent can create, resize, reboot and delete VM instances, and clean up disks and snapshots. Google's Compute Engine MCP documentation
- Google notes that the server does not support full regional isolation and might route tool calls through any region. Google's Compute Engine MCP documentation
How to limit it
With Google Cloud Compute Engine's own settings, as its documentation describes them. Stackduke has not tested them.
- Sign in with the compute.read-only scope when the agent only needs to read. The compute.read-write scope also allows changes. Google's Compute Engine MCP documentation
- Google recommends a separate identity for agents that use MCP tools, so that their access can be controlled and monitored. Google's Compute Engine MCP documentation
- IAM allow and deny policies can allow or refuse tool calls by principal, by service or tool name, by the application's OAuth client, or by whether a tool is marked read-only. Google's Compute Engine MCP documentation
What Stackduke is designed to do
Stackduke is designed to sit between your agents and their MCP servers: to check each tool call against your rules before it runs, hold the risky ones for a person to approve, and keep a record of what was decided.
It does not yet forward or block tool calls for customers. Today it reads what this server offers and publishes what changes.