Skip to main content

Connecting with Google Gemini Enterprise

You can connect to Google Gemini Enterprise with the AtScale MCP Server.

Prerequisites​

Before you can configure a connection to Gemini Enterprise, verify you meet the following requirements:

  • The AtScale MCP server is enabled for your AtScale instance.
  • You have either the admin or application_admin role assigned in the Identity Broker.
  • Your AtScale instance is reachable from the public internet. Gemini Enterprise is a Google-hosted SaaS product and cannot reach a privately-networked AtScale endpoint.
  • The endpoint serves a publicly trusted TLS certificate with a complete chain. Self-signed certificates, private CA certificates, or incomplete chains will prevent the OAuth/MCP handshake from completing.
  • The GCP org policy constraint constraints/discoveryengine.managed.disableCustomMcpServerConnector is set to Not Enforced for your project. By default, Google Cloud blocks the creation of custom MCP server connectors at the org level. A GCP org admin needs to override this constraint for your project before you can create the data store. If they do not, you will see an Operation denied by org policy error when creating the connector. For more information, see Override the organization policy for Custom MCP data stores in the Gemini Enterprise documentation.
  • You have the Discovery Engine Editor IAM role (roles/discoveryengine.editor). This is required to create a data store for the AtScale MCP Server.

Add a Gemini Enterprise data store for the AtScale MCP Server​

First, you must create a Gemini Enterprise data store for the AtScale MCP Server. To create the data store:

  1. Obtain the atscale-mcp client's credentials from the Identity Broker:

    1. In Design Center, in the sidebar, click Security. The Identity Broker opens.

    2. In the sidebar, click Clients.

    3. Click the atscale-mcp client.

    4. Go to the Credentials tab and copy the Client Secret.

      Important

      Do not regenerate the Client Secret.

  2. Log in to Gemini Enterprise and navigate to Data Stores.

  3. Click + Create data store.

  4. Search for and select Custom MCP Server.

  5. Click Add MCP Server.

  6. On the MCP Server Configuration page, in the Authentication settings section, complete the following fields:

    • MCP Server URL: Enter https://<atscale_url>/mcp.

      This endpoint must use HTTPS. Gemini Enterprise only supports the StreamableHTTP transport, and not the older SSE transport. Confirm your AtScale MCP Server endpoint serves StreamableHTTP at the /mcp path.

    • Authorization URL: Enter https://<atscale_url>/auth/realms/atscale/protocol/openid-connect/auth.

      This points to the AtScale realm in the Identity Broker. This is the standard OAuth2/OIDC flow exposed by the Identity Broker, with atscale-mcp as the registered client.

      Only enter the base URL. Do not append query parameters. Gemini Enterprise automatically appends standard OAuth parameters (such as client_id, redirect_uri, and scope). If you need extra parameters (such as access_type=offline), define them in the Authorization URL Parameters field.

    • Token URL: Enter https://<atscale_url>/auth/realms/atscale/protocol/openid-connect/token.

      This points to the AtScale realm in the Identity Broker. This is the standard OAuth2/OIDC flow exposed by the Identity Broker, with atscale-mcp as the registered client.

    • Client ID: Enter atscale-mcp.

    • Client Secret: Enter the atscale-mcp client secret you copied above.

    • Scopes: Enter openid.

  7. Click Login and sign in with AtScale.

  8. Click Continue.

  9. Under Advanced options, enter an MCP Server Description.

  10. (Optional) In the Instructions field, add any extra instructions you want to include.

  11. Click Continue.

  12. Select a Location (multi-region) and give the data store a name.

  13. Click Create.

  14. Wait for the data store's status to move from Creating to Active before continuing to the next section.

Reload and enable the AtScale MCP Server's custom actions​

Once the data store is created, you need to reload and enable the AtScale MCP Server's custom actions directly. This ensures Gemini Enterprise picks up the MCP Server's tools.

  1. Open the connector console for your data store.

  2. In the sidebar, navigate to Data Stores and select your AtScale MCP Server data store.

  3. In the sidebar, click Actions.

  4. Click Reload custom actions. This re-queries the AtScale MCP Server's tools/list endpoint and lists all available tools.

  5. Select the MCP Server tools you want available to the assistant and click Enable actions.

    Note

    AtScale recommends enabling all available tools, as the agent requires the full tool workflow in order to work correctly. For more information, see the MCP Server Tools Reference.

Connect the data store to a Gemini Enterprise app​

Next, you must create a Gemini Enterprise app and connect it to your AtScale MCP Server data store. For instructions, see Create an app and Connect a data store to app and authorize Gemini Enterprise in the Gemini Enterprise documentation.

Verify the connection​

Finally, you should verify your connection:

  1. Confirm that the status of the AtScale MCP Server data store shows Active, and not Creating or an error state.

  2. Confirm that your Gemini Enterprise app is connected to your AtScale MCP Server data store:

    1. Open your Gemini Enterprise app.
    2. Below the chat input, click Manage your data.
    3. Confirm your AtScale MCP Server connection shows as enabled and authorized. If it's listed but disabled, or shows an authorization/login prompt, the app will not be able to connect to AtScale even if everything else is configured correctly.

  3. Ask a simple, AtScale-specific question to confirm everything is properly connected. For example, "What AtScale models are available?"

If the app responds with real model/catalog names, your connection is working and you can begin asking business questions.

If you receive a generic answer containing no AtScale-specific content, check the following:

  • You entered the Authorization URL and Token URL correctly, and the atscale-mcp client secret hasn't rotated.
  • The AtScale MCP Server's custom actions are loaded and enabled.
  • Your Gemini Enterprise app is connected to your AtScale MCP Server data store.