Google Cloud Resource Manager integration for AI agents.
Google Cloud Resource Manager integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Google Cloud Resource Manager tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.
Real Google Cloud Resource Manager actions, managed and audited.
Your user connects Google Cloud Resource Manager once; your agent can then cloud Resource Manager provides APIs to create, read, organize, and manage Google Cloud projects and resources in the hierarchy — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.
- 1
Your user grants Google Cloud Resource Manager access once (OAuth) — the token lands in the vault.
- 2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
- 3
Every routed call appends a hash-chained audit record — nothing leaves your infra.
Supported Google Cloud Resource Manager tools.
17 tools are generated from the published Google Cloud Resource Manager catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.
Showing 17 tools. All published catalog entries are included in this page's server-rendered HTML.
- Cloudresourcemanager EffectiveTags List
- Return a list of effective tags for the given Google Cloud resource, as specified in `parent`.
- effectivetags
- Cloudresourcemanager FetchResourceSemantics
- Returns the semantics associated with the specified resource.
- cloudresourcemanager
- Cloudresourcemanager Folders List
- Lists the folders that are direct descendants of supplied parent resource. `list()` provides a strongly consistent view of the folders underneath the specified parent resource. `list()` returns folders sorted based upon the (ascending) lexical ordering of their display_name. The caller must have `resourcemanager.folders.list` permission on the identified parent.
- folders
- Cloudresourcemanager Folders Search
- Search for folders that match specific filter criteria. `search()` provides an eventually consistent view of the folders a user has access to which meet the specified filter criteria. This will only return folders on which the caller has the permission `resourcemanager.folders.get`.
- folders
- Cloudresourcemanager Liens Get
- Retrieve a Lien by `name`. Callers of this method will require permission on the `parent` resource. For example, a Lien with a `parent` of `projects/1234` requires permission `resourcemanager.projects.get`
- liens
- Cloudresourcemanager Liens List
- List all Liens applied to the `parent` resource. Callers of this method will require permission on the `parent` resource. For example, a Lien with a `parent` of `projects/1234` requires permission `resourcemanager.projects.get`.
- liens
- Cloudresourcemanager Organizations Search
- Searches organization resources that are visible to the user and satisfy the specified filter. This method returns organizations in an unspecified order. New organizations do not necessarily appear at the end of the results, and may take a small amount of time to appear. Search will only return organizations on which the user has the permission `resourcemanager.organizations.get` or has super admin privileges.
- organizations
- Cloudresourcemanager Projects List
- Lists projects that are direct children of the specified folder or organization resource. `list()` provides a strongly consistent view of the projects underneath the specified parent resource. `list()` returns projects sorted based upon the (ascending) lexical ordering of their `display_name`. The caller must have `resourcemanager.projects.list` permission on the identified parent.
- projects
- Cloudresourcemanager Projects Search
- Search for projects that the caller has the `resourcemanager.projects.get` permission on, and also satisfy the specified query. This method returns projects in an unspecified order. This method is eventually consistent with project mutations; this means that a newly created project may not appear in the results or recent updates to an existing project may not be reflected in the results. To retrieve the latest state of a project, use the GetProject method.
- projects
- Cloudresourcemanager TagBindings List
- Lists the TagBindings for the given Google Cloud resource, as specified with `parent`. NOTE: The `parent` field is expected to be a full resource name: https://cloud.google.com/apis/design/resource_names#full_resource_name
- tagbindings
- Cloudresourcemanager TagKeys GetNamespaced
- Retrieves a TagKey by its namespaced name. This method will return `PERMISSION_DENIED` if the key does not exist or the user does not have permission to view it.
- tagkeys
- Cloudresourcemanager TagKeys List
- Lists all TagKeys for a parent resource.
- tagkeys
- Cloudresourcemanager TagValues GetIamPolicy
- Gets the access control policy for a TagValue. The returned policy may be empty if no such policy or resource exists. The `resource` field should be the TagValue's resource name. For example: `tagValues/1234`. The caller must have the `cloudresourcemanager.googleapis.com/tagValues.getIamPolicy` permission on the identified TagValue to get the access control policy.
- tagvalues
- Cloudresourcemanager TagValues GetNamespaced
- Retrieves a TagValue by its namespaced name. This method will return `PERMISSION_DENIED` if the value does not exist or the user does not have permission to view it.
- tagvalues
- Cloudresourcemanager TagValues List
- Lists all TagValues for a specific TagKey.
- tagvalues
- Cloudresourcemanager TagValues TagHolds List
- Lists TagHolds under a TagValue.
- tagvalues
- Cloudresourcemanager TagValues TestIamPermissions
- Returns permissions that a caller has on the specified TagValue. The `resource` field should be the TagValue's resource name. For example: `tagValues/1234`. There are no permissions required for making this API call.
- tagvalues
Google Cloud Resource Manager integration, answered
- How do AI agents use Google Cloud Resource Manager through Open Connector?
- Your user connects Google Cloud Resource Manager once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Google Cloud Resource Manager tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
- Is this a Google Cloud Resource Manager MCP server?
- Yes. Open Connector can serve Google Cloud Resource Manager as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Google Cloud Resource Manager actions with credentials injected server-side.
- Where do Google Cloud Resource Manager credentials live?
- In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.
Give your agents Google Cloud Resource Manager — keep the keys.
Open source, self-hostable, with Google Cloud Resource Manager credentials that never leave your infrastructure. Run it from source today.