How do AI agents use Google Cloud Resource Manager through Open Connector?

Your user connects Google Cloud Resource Manager once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Google Cloud Resource Manager tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Google Cloud Resource Manager MCP server?

Yes. Open Connector can serve Google Cloud Resource Manager as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Google Cloud Resource Manager actions with credentials injected server-side.

Where do Google Cloud Resource Manager credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Google Cloud Resource Manager for AI agents.

Google Cloud Resource Manager integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Google Cloud Resource Manager tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

Example

# Add your Open Connector MCP server (per-user mcp_url)
$ claude mcp add --transport http \
    open-connector <your mcp_url>

# Then ask: “open an issue for the launch checklist”

// .cursor/mcp.json
{
  "mcpServers": {
    "open-connector": { "url": "<your mcp_url>" }
  }
}

const composio = new Composio({
  apiKey: "oc_…",
  baseURL: "https://connect.acme.com", // your host
});

await composio.tools.proxy({ … });

{
  "tool": "GOOGLE_CLOUD_RESOURCE_MANAGER_EFFECTIVE_TAGS_LIST",
  "arguments": { … }
}

What your agents can do

Real Google Cloud Resource Manager actions, managed and audited.

Your user connects Google Cloud Resource Manager once; your agent can then search projects and folders, find organizations, and list tag bindings and resource liens — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

01Connect
Your user grants Google Cloud Resource Manager access once (OAuth) — the token lands in the vault.
02Call
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
03Audit
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Google Cloud Resource Manager tools.

Browse 17 tools in the Google Cloud Resource Manager catalog. Each action uses your configured authentication and tool allowlist.

Showing 17 tools.

Cloudresourcemanager EffectiveTags List: GOOGLE_CLOUD_RESOURCE_MANAGER_EFFECTIVE_TAGS_LIST; Return a list of effective tags for the given Google Cloud resource, as specified in `parent`.; effectivetags
Cloudresourcemanager FetchResourceSemantics: GOOGLE_CLOUD_RESOURCE_MANAGER_FETCH_RESOURCE_SEMANTICS; Returns the semantics associated with the specified resource.; cloudresourcemanager
Cloudresourcemanager Folders List: GOOGLE_CLOUD_RESOURCE_MANAGER_FOLDERS_LIST; Lists the folders that are direct descendants of supplied parent resource. `list()` provides a strongly consistent view of the folders underneath the specified parent resource. `list()` returns folders sorted based upon the (ascending) lexical ordering of their display_name. The caller must have `resourcemanager.folders.list` permission on the identified parent.; folders
Cloudresourcemanager Folders Search: GOOGLE_CLOUD_RESOURCE_MANAGER_FOLDERS_SEARCH; Search for folders that match specific filter criteria. `search()` provides an eventually consistent view of the folders a user has access to which meet the specified filter criteria. This will only return folders on which the caller has the permission `resourcemanager.folders.get`.; folders
Cloudresourcemanager Liens Get: GOOGLE_CLOUD_RESOURCE_MANAGER_LIENS_GET; Retrieve a Lien by `name`. Callers of this method will require permission on the `parent` resource. For example, a Lien with a `parent` of `projects/1234` requires permission `resourcemanager.projects.get`; liens
Cloudresourcemanager Liens List: GOOGLE_CLOUD_RESOURCE_MANAGER_LIENS_LIST; List all Liens applied to the `parent` resource. Callers of this method will require permission on the `parent` resource. For example, a Lien with a `parent` of `projects/1234` requires permission `resourcemanager.projects.get`.; liens
Cloudresourcemanager Organizations Search: GOOGLE_CLOUD_RESOURCE_MANAGER_ORGANIZATIONS_SEARCH; Searches organization resources that are visible to the user and satisfy the specified filter. This method returns organizations in an unspecified order. New organizations do not necessarily appear at the end of the results, and may take a small amount of time to appear. Search will only return organizations on which the user has the permission `resourcemanager.organizations.get` or has super admin privileges.; organizations
Cloudresourcemanager Projects List: GOOGLE_CLOUD_RESOURCE_MANAGER_PROJECTS_LIST; Lists projects that are direct children of the specified folder or organization resource. `list()` provides a strongly consistent view of the projects underneath the specified parent resource. `list()` returns projects sorted based upon the (ascending) lexical ordering of their `display_name`. The caller must have `resourcemanager.projects.list` permission on the identified parent.; projects
Cloudresourcemanager Projects Search: GOOGLE_CLOUD_RESOURCE_MANAGER_PROJECTS_SEARCH; Search for projects that the caller has the `resourcemanager.projects.get` permission on, and also satisfy the specified query. This method returns projects in an unspecified order. This method is eventually consistent with project mutations; this means that a newly created project may not appear in the results or recent updates to an existing project may not be reflected in the results. To retrieve the latest state of a project, use the GetProject method.; projects
Cloudresourcemanager TagBindings List: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_BINDINGS_LIST; Lists the TagBindings for the given Google Cloud resource, as specified with `parent`. NOTE: The `parent` field is expected to be a full resource name: https://cloud.google.com/apis/design/resource_names#full_resource_name; tagbindings
Cloudresourcemanager TagKeys GetNamespaced: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_KEYS_GET_NAMESPACED; Retrieves a TagKey by its namespaced name. This method will return `PERMISSION_DENIED` if the key does not exist or the user does not have permission to view it.; tagkeys
Cloudresourcemanager TagKeys List: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_KEYS_LIST; Lists all TagKeys for a parent resource.; tagkeys
Cloudresourcemanager TagValues GetIamPolicy: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_VALUES_GET_IAM_POLICY; Gets the access control policy for a TagValue. The returned policy may be empty if no such policy or resource exists. The `resource` field should be the TagValue's resource name. For example: `tagValues/1234`. The caller must have the `cloudresourcemanager.googleapis.com/tagValues.getIamPolicy` permission on the identified TagValue to get the access control policy.; tagvalues
Cloudresourcemanager TagValues GetNamespaced: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_VALUES_GET_NAMESPACED; Retrieves a TagValue by its namespaced name. This method will return `PERMISSION_DENIED` if the value does not exist or the user does not have permission to view it.; tagvalues
Cloudresourcemanager TagValues List: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_VALUES_LIST; Lists all TagValues for a specific TagKey.; tagvalues
Cloudresourcemanager TagValues TagHolds List: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_VALUES_TAG_HOLDS_LIST; Lists TagHolds under a TagValue.; tagvalues
Cloudresourcemanager TagValues TestIamPermissions: GOOGLE_CLOUD_RESOURCE_MANAGER_TAG_VALUES_TEST_IAM_PERMISSIONS; Returns permissions that a caller has on the specified TagValue. The `resource` field should be the TagValue's resource name. For example: `tagValues/1234`. There are no permissions required for making this API call.; tagvalues

FAQ

Google Cloud Resource Manager integration, answered

How do AI agents use Google Cloud Resource Manager through Open Connector?: Your user connects Google Cloud Resource Manager once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Google Cloud Resource Manager tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Google Cloud Resource Manager MCP server?: Yes. Open Connector can serve Google Cloud Resource Manager as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Google Cloud Resource Manager actions with credentials injected server-side.
Where do Google Cloud Resource Manager credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Google Cloud Resource Manager — keep the keys.

Open source, self-hostable, with Google Cloud Resource Manager credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →