MCP Tools Reference: auditmanager.googleapis.com

Tool: list_audit_reports

Lists the audit reports for the specified parent scope. Format: 'projects/{project}/locations/{location}'. CRITICAL: For {location}, use the location specified by the user. If no location is specified, prompt the user to provide one. Do not use 'global'. The location must match the chosen Regional Endpoint (REP) region (e.g., us-central1). * Filter or review the returned list of audit reports as needed based on the user's request.

The following code sample shows how to use curl to call the list_audit_reports MCP tool.

Curl Request 
curl --location 'https://auditmanager.us-central1.rep.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "list_audit_reports",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for ListAuditReports.

ListAuditReportsRequest

JSON representation 
{
  "parent": string,
  "pageSize": integer,
  "pageToken": string
}
Fields
parent

string

Required. Parent organization, folder, or project to list reports for, in one of the following formats:

  • projects/{project}/locations/{location}
  • folders/{folder}/locations/{location}
  • organizations/{organization}/locations/{location}
pageSize

integer

Optional. Maximum number of items to return in a single page. The service might return fewer items than this value. If unspecified, the service picks an appropriate default. The maximum value is 100; values above 100 are reduced to 100.
pageToken

string

Optional. A page token, received from a previous call, to retrieve the next page of results.

Output Schema

Response message for ListAuditReports.

ListAuditReportsResponse

JSON representation 
{
  "auditReports": [
    {
      object (AuditReport)
    }
  ],
  "nextPageToken": string
}
Fields
auditReports[]

object (AuditReport)

Output only. Audit reports.
nextPageToken

string

Output only. A token that you can send as the page_token in a subsequent request to retrieve the next page of results. If this field is empty, there are no subsequent pages.

AuditReport

JSON representation 
{
  "name": string,
  "reportSummary": {
    object (ReportSummary)
  },
  "operationId": string,
  "destinationDetails": {
    object (DestinationDetails)
  },
  "complianceStandard": string,
  "scope": string,
  "createTime": string,
  "controlDetails": [
    {
      object (ControlDetails)
    }
  ],
  "reportGenerationState": enum (ReportGenerationState),
  "complianceFramework": string,
  "scopeId": string
}
Fields
name

string

Identifier. Name of the audit report, in one of the following formats:

  • projects/{project}/locations/{location}/auditReports/{audit_report}
  • folders/{folder}/locations/{location}/auditReports/{audit_report}
  • organizations/{organization}/locations/{location}/auditReports/{audit_report}
reportSummary

object (ReportSummary)

Output only. Report summary that includes information about compliance and violation counts.
operationId

string

Output only. Client operation ID for the audit report.
destinationDetails

object (DestinationDetails)

Output only. Cloud Storage bucket where the audit report is uploaded to.
complianceStandard
(deprecated)

string

Output only. Deprecated. Compliance standard to be audited against.

Use the compliance_framework field instead.
scope

string

Output only. Organization, folder, or project that the report is generated for, in one of the following formats:

  • projects/{project}/locations/{location}
  • folders/{folder}/locations/{location}
  • organizations/{organization}/locations/{location}
createTime

string (Timestamp format)

Output only. Creation time of the audit report.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
controlDetails[]

object (ControlDetails)

Output only. Overall status of the controls.
reportGenerationState

enum (ReportGenerationState)

Output only. State of audit report generation.
complianceFramework

string

Output only. Compliance framework to use for the audit report. For example, CIS_GCP_FOUNDATIONS_V1_2_0.
scopeId

string

Output only. Project number, folder ID, or organization ID that the audit report was generated for.

ReportSummary

JSON representation 
{
  "totalCount": integer,
  "compliantCount": integer,
  "violationCount": integer,
  "manualReviewNeededCount": integer,
  "errorCount": integer
}
Fields
totalCount

integer

Total number of evaluated checks.
compliantCount

integer

Number of compliant checks.
violationCount

integer

Number of checks with violations.
manualReviewNeededCount

integer

Number of checks that require a manual review.
errorCount

integer

Number of checks that can't be performed due to errors.

DestinationDetails

JSON representation 
{

  // Union field destination can be only one of the following:
  "gcsBucketUri": string
  // End of list of possible types for union field destination.
}
Fields
Union field destination. The specific destination where the audit report and evidence are stored. destination can be only one of the following:
gcsBucketUri

string

URI for the Cloud Storage bucket, in the format gs://{bucket_name}.

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

ControlDetails

JSON representation 
{
  "control": {
    object (Control)
  },
  "complianceState": enum (ComplianceState),
  "controlReportSummary": {
    object (ReportSummary)
  }
}
Fields
control

object (Control)

Control that the findings are being reported for.
complianceState

enum (ComplianceState)

Output only. Overall status of the findings for the control.
controlReportSummary

object (ReportSummary)

A control report summary that provides a high-level overview of the compliance controls and the assessment status.

Control

JSON representation 
{
  "id": string,
  "displayName": string,
  "family": enum (Family),
  "controlFamily": {
    object (ControlFamily)
  },
  "description": string,
  "responsibilityType": string,
  "googleResponsibilityDescription": string,
  "googleResponsibilityImplementation": string,
  "customerResponsibilityDescription": string,
  "customerResponsibilityImplementation": string
}
Fields
id

string

Output only. Control identifier that's used to fetch the findings. The identifier is the same as the control report name.
displayName

string

Output only. Display name of the control.
family

enum (Family)

Output only. Category that the control belongs to.
controlFamily

object (ControlFamily)

Output only. Regulatory family of the control.
description

string

Output only. Description of the control.
responsibilityType

string

Output only. Who is responsible for implementing this control. Set to one of the following values: GOOGLE, CUSTOMER, or SHARED.
googleResponsibilityDescription

string

Output only. A description of Google's responsibility for this control.
googleResponsibilityImplementation

string

Output only. A description of how Google implements its responsibility for this control.
customerResponsibilityDescription

string

Output only. A description of your responsibility for this control.
customerResponsibilityImplementation

string

Output only. A description of how you can implement your responsibility for this control.

ControlFamily

JSON representation 
{
  "familyId": string,
  "displayName": string
}
Fields
familyId

string

ID of the regulatory control family. To find the list of supported control families, use the ListControls method and review the control_family field in the response.
displayName

string

Display name of the regulatory control family.

Family

Category of the control.

Enums
FAMILY_UNSPECIFIED Default value. This value is unused.
AC Access control.
AT Awareness and training.
AU Audit and accountability.
CA Certification, accreditation and security assessments.
CM Configuration management and change control.
CP Contingency planning and disaster recovery.
IA Identification and authentication.
IR Incident response.
MA Maintenance.
MP Media protection.
PE Physical and environmental protection.
PL Security planning.
PS Personnel security.
RA Risk assessment.
SA System services and acquisition.
SC System and communications protection.
SI System and information integrity.
SR Supply chain risk management.

ComplianceState

Compliance state after evaluation.

Enums
COMPLIANCE_STATE_UNSPECIFIED Default value. This value is unused.
COMPLIANT The resource is compliant.
VIOLATION The resource isn't compliant.
MANUAL_REVIEW_NEEDED You must complete a manual review.
ERROR An error was encountered during the evaluation or evidence gathering process.
AUDIT_NOT_SUPPORTED The resource can't be audited.

ReportGenerationState

Different states of report generation.

Enums
REPORT_GENERATION_STATE_UNSPECIFIED Default value. This value is unused.
IN_PROGRESS The process is in progress. The operation can have any state except for OPERATION_STATE_DONE or OPERATION_STATE_FAILED.
COMPLETED The process is completed. The operation state is OPERATION_STATE_DONE.
FAILED The process has failed. The operation state is OPERATION_STATE_FAILED.
SUMMARY_UNKNOWN The process completed, but the report summary's status is unknown. This state isn't used for new reports.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌