MCP Tools Reference: ces.googleapis.com

Tool: `create_toolset`

Creates a new toolset in the given app.

The following sample demonstrate how to use curl to invoke the create_toolset MCP tool.

Curl Request
curl --location 'https://ces.[REGION].rep.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "create_toolset", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }'

Curl Request

                  
curl --location 'https://ces.[REGION].rep.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "create_toolset",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for AgentService.CreateToolset.

CreateToolsetRequest

JSON representation
{ "parent": string, "toolsetId": string, "toolset": { object (`Toolset`) } }

Fields

Fields
`parent`	`string` Required. The resource name of the app to create a toolset in.
`toolsetId`	`string` Optional. The ID to use for the toolset, which will become the final component of the toolset's resource name. If not provided, a unique ID will be automatically assigned for the toolset.
`toolset`	`object (Toolset)` Required. The toolset to create.

parent

string

Required. The resource name of the app to create a toolset in.

toolsetId

string

Optional. The ID to use for the toolset, which will become the final component of the toolset's resource name. If not provided, a unique ID will be automatically assigned for the toolset.

toolset

object (Toolset)

Required. The toolset to create.

Toolset

JSON representation

JSON representation
{ "name": string, "displayName": string, "description": string, "createTime": string, "updateTime": string, "etag": string, "executionType": enum (`ExecutionType`), "toolFakeConfig": { object (`ToolFakeConfig`) }, // Union field `toolset_type` can be only one of the following: "mcpToolset": { object (`McpToolset`) }, "openApiToolset": { object (`OpenApiToolset`) }, "connectorToolset": { object (`ConnectorToolset`) } // End of list of possible types for union field `toolset_type`. }

{
  "name": string,
  "displayName": string,
  "description": string,
  "createTime": string,
  "updateTime": string,
  "etag": string,
  "executionType": enum (ExecutionType),
  "toolFakeConfig": {
    object (ToolFakeConfig)
  },

  // Union field toolset_type can be only one of the following:
  "mcpToolset": {
    object (McpToolset)
  },
  "openApiToolset": {
    object (OpenApiToolset)
  },
  "connectorToolset": {
    object (ConnectorToolset)
  }
  // End of list of possible types for union field toolset_type.
}

Fields
`name`	`string` Identifier. The unique identifier of the toolset. Format: `projects/{project}/locations/{location}/apps/{app}/toolsets/{toolset}`
`displayName`	`string` Optional. The display name of the toolset. Must be unique within the same app.
`description`	`string` Optional. The description of the toolset.
`createTime`	`string (Timestamp format)` Output only. Timestamp when the toolset was created. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`updateTime`	`string (Timestamp format)` Output only. Timestamp when the toolset was last updated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`etag`	`string` ETag used to ensure the object hasn't changed during a read-modify-write operation. If the etag is empty, the update will overwrite any concurrent changes.
`executionType`	`enum (ExecutionType)` Optional. The execution type of the tools in the toolset.
`toolFakeConfig`	`object (ToolFakeConfig)` Optional. Configuration for tools behavior in fake mode.
Union field `toolset_type`. The type of the toolset. `toolset_type` can be only one of the following:
`mcpToolset`	`object (McpToolset)` Optional. A toolset that contains a list of tools that are offered by the MCP server.
`openApiToolset`	`object (OpenApiToolset)` Optional. A toolset that contains a list of tools that are defined by an OpenAPI schema.
`connectorToolset`	`object (ConnectorToolset)` Optional. A toolset that generates tools from an Integration Connectors Connection.

McpToolset

JSON representation
{ "serverAddress": string, "apiAuthentication": { object (`ApiAuthentication`) }, "serviceDirectoryConfig": { object (`ServiceDirectoryConfig`) }, "tlsConfig": { object (`TlsConfig`) } }

Fields
`serverAddress`	`string` Required. The address of the MCP server, for example, "https://example.com/mcp/". If the server is built with the MCP SDK, the url should be suffixed with "/mcp/". Only Streamable HTTP transport based servers are supported. See https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http for more details.
`apiAuthentication`	`object (ApiAuthentication)` Optional. Authentication information required to access tools and execute a tool against the MCP server. For bearer token authentication, the token applies only to tool execution, not to listing tools. This requires that tools can be listed without authentication.
`serviceDirectoryConfig`	`object (ServiceDirectoryConfig)` Optional. Service Directory configuration for VPC-SC, used to resolve service names within a perimeter.
`tlsConfig`	`object (TlsConfig)` Optional. The TLS configuration. Includes the custom server certificates that the client should trust.

ApiAuthentication

JSON representation

JSON representation
{ // Union field `auth_config` can be only one of the following: "apiKeyConfig": { object (`ApiKeyConfig`) }, "oauthConfig": { object (`OAuthConfig`) }, "serviceAgentIdTokenAuthConfig": { object (`ServiceAgentIdTokenAuthConfig`) }, "serviceAccountAuthConfig": { object (`ServiceAccountAuthConfig`) }, "bearerTokenConfig": { object (`BearerTokenConfig`) } // End of list of possible types for union field `auth_config`. }

{

  // Union field auth_config can be only one of the following:
  "apiKeyConfig": {
    object (ApiKeyConfig)
  },
  "oauthConfig": {
    object (OAuthConfig)
  },
  "serviceAgentIdTokenAuthConfig": {
    object (ServiceAgentIdTokenAuthConfig)
  },
  "serviceAccountAuthConfig": {
    object (ServiceAccountAuthConfig)
  },
  "bearerTokenConfig": {
    object (BearerTokenConfig)
  }
  // End of list of possible types for union field auth_config.
}

Fields
Union field `auth_config`. The auth configuration. `auth_config` can be only one of the following:
`apiKeyConfig`	`object (ApiKeyConfig)` Optional. Config for API key auth.
`oauthConfig`	`object (OAuthConfig)` Optional. Config for OAuth.
`serviceAgentIdTokenAuthConfig`	`object (ServiceAgentIdTokenAuthConfig)` Optional. Config for ID token auth generated from CES service agent.
`serviceAccountAuthConfig`	`object (ServiceAccountAuthConfig)` Optional. Config for service account authentication.
`bearerTokenConfig`	`object (BearerTokenConfig)` Optional. Config for bearer token auth.

ApiKeyConfig

JSON representation
{ "keyName": string, "apiKeySecretVersion": string, "requestLocation": enum (`RequestLocation`) }

Fields

Fields
`keyName`	`string` Required. The parameter name or the header name of the API key. E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.
`apiKeySecretVersion`	`string` Required. The name of the SecretManager secret version resource storing the API key. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com`.
`requestLocation`	`enum (RequestLocation)` Required. Key location in the request.

keyName

string

Required. The parameter name or the header name of the API key. E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.

apiKeySecretVersion

string

Required. The name of the SecretManager secret version resource storing the API key. Format: projects/{project}/secrets/{secret}/versions/{version}

Note: You should grant roles/secretmanager.secretAccessor role to the CES service agent service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com.

requestLocation

enum (RequestLocation)

Required. Key location in the request.

OAuthConfig

JSON representation
{ "oauthGrantType": enum (`OauthGrantType`), "clientId": string, "clientSecretVersion": string, "tokenEndpoint": string, "scopes": [ string ] }

Fields
`oauthGrantType`	`enum (OauthGrantType)` Required. OAuth grant types.
`clientId`	`string` Required. The client ID from the OAuth provider.
`clientSecretVersion`	`string` Required. The name of the SecretManager secret version resource storing the client secret. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com`.
`tokenEndpoint`	`string` Required. The token endpoint in the OAuth provider to exchange for an access token.
`scopes[]`	`string` Optional. The OAuth scopes to grant.

ServiceAccountAuthConfig

JSON representation
{ "serviceAccount": string, "scopes": [ string ] }

Fields

Fields
`serviceAccount`	`string` Required. The email address of the service account used for authentication. CES uses this service account to exchange an access token and the access token is then sent in the `Authorization` header of the request. The service account must have the `roles/iam.serviceAccountTokenCreator` role granted to the CES service agent `service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com`.
`scopes[]`	`string` Optional. The OAuth scopes to grant. If not specified, the default scope `https://www.googleapis.com/auth/cloud-platform` is used.

serviceAccount

string

Required. The email address of the service account used for authentication. CES uses this service account to exchange an access token and the access token is then sent in the Authorization header of the request.

The service account must have the roles/iam.serviceAccountTokenCreator role granted to the CES service agent service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com.

scopes[]

string

Optional. The OAuth scopes to grant. If not specified, the default scope https://www.googleapis.com/auth/cloud-platform is used.

BearerTokenConfig

JSON representation
{ "token": string }

Fields

Fields
`token`	`string` Required. The bearer token. Must be in the format `$context.variables.<name_of_variable>`.

token

string

Required. The bearer token. Must be in the format $context.variables.<name_of_variable>.

ServiceDirectoryConfig

JSON representation
{ "service": string }

Fields

Fields
`service`	`string` Required. The name of Service Directory service. Format: `projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}`. Location of the service directory must be the same as the location of the app.

service

string

Required. The name of Service Directory service. Format: projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}. Location of the service directory must be the same as the location of the app.

TlsConfig

JSON representation
{ "caCerts": [ { object (`CaCert`) } ] }

Fields

Fields
`caCerts[]`	`object (CaCert)` Required. Specifies a list of allowed custom CA certificates for HTTPS verification.

caCerts[]

object (CaCert)

Required. Specifies a list of allowed custom CA certificates for HTTPS verification.

CaCert

JSON representation
{ "displayName": string, "cert": string }

Fields

Fields
`displayName`	`string` Required. The name of the allowed custom CA certificates. This can be used to disambiguate the custom CA certificates.
`cert`	`string (bytes format)` Required. The allowed custom CA certificates (in DER format) for HTTPS verification. This overrides the default SSL trust store. If this is empty or unspecified, CES will use Google's default trust store to verify certificates. N.B. Make sure the HTTPS server certificates are signed with "subject alt name". For instance a certificate can be self-signed using the following command, openssl x509 -req -days 200 -in example.com.csr \ -signkey example.com.key \ -out example.com.crt \ -extfile <(printf "\nsubjectAltName='DNS:www.example.com'") A base64-encoded string.

displayName

string

Required. The name of the allowed custom CA certificates. This can be used to disambiguate the custom CA certificates.

cert

string (bytes format)

Required. The allowed custom CA certificates (in DER format) for HTTPS verification. This overrides the default SSL trust store. If this is empty or unspecified, CES will use Google's default trust store to verify certificates. N.B. Make sure the HTTPS server certificates are signed with "subject alt name". For instance a certificate can be self-signed using the following command, openssl x509 -req -days 200 -in example.com.csr \ -signkey example.com.key \ -out example.com.crt \ -extfile <(printf "\nsubjectAltName='DNS:www.example.com'")

A base64-encoded string.

OpenApiToolset

JSON representation

JSON representation
{ "openApiSchema": string, "apiAuthentication": { object (`ApiAuthentication`) }, "tlsConfig": { object (`TlsConfig`) }, "serviceDirectoryConfig": { object (`ServiceDirectoryConfig`) }, "ignoreUnknownFields": boolean, "url": string }

{
  "openApiSchema": string,
  "apiAuthentication": {
    object (ApiAuthentication)
  },
  "tlsConfig": {
    object (TlsConfig)
  },
  "serviceDirectoryConfig": {
    object (ServiceDirectoryConfig)
  },
  "ignoreUnknownFields": boolean,
  "url": string
}

Fields
`openApiSchema`	`string` Required. The OpenAPI schema of the toolset.
`apiAuthentication`	`object (ApiAuthentication)` Optional. Authentication information required by the API.
`tlsConfig`	`object (TlsConfig)` Optional. The TLS configuration. Includes the custom server certificates
`serviceDirectoryConfig`	`object (ServiceDirectoryConfig)` Optional. Service Directory configuration.
`ignoreUnknownFields`	`boolean` Optional. If true, the agent will ignore unknown fields in the API response for all operations defined in the OpenAPI schema.
`url`	`string` Optional. The server URL of the Open API schema. This field is only set in toolsets in the environment dependencies during the export process if the schema contains a server url. During the import process, if this url is present in the environment dependencies and the schema has the $env_var placeholder, it will replace the placeholder in the schema.

ConnectorToolset

JSON representation
{ "connection": string, "authConfig": { object (`EndUserAuthConfig`) }, "connectorActions": [ { object (`Action`) } ] }

Fields

Fields
`connection`	`string` Required. The full resource name of the referenced Integration Connectors Connection. Format: `projects/{project}/locations/{location}/connections/{connection}`
`authConfig`	`object (EndUserAuthConfig)` Optional. Configures how authentication is handled in Integration Connectors. By default, an admin authentication is passed in the Integration Connectors API requests. You can override it with a different end-user authentication config. Note: The Connection must have authentication override enabled in order to specify an EUC configuration here - otherwise, the Toolset creation will fail. See: https://cloud.google.com/application-integration/docs/configure-connectors-task#configure-authentication-override
`connectorActions[]`	`object (Action)` Required. The list of connector actions/entity operations to generate tools for.

connection

string

Required. The full resource name of the referenced Integration Connectors Connection. Format: projects/{project}/locations/{location}/connections/{connection}

authConfig

object (EndUserAuthConfig)

Optional. Configures how authentication is handled in Integration Connectors. By default, an admin authentication is passed in the Integration Connectors API requests. You can override it with a different end-user authentication config. Note: The Connection must have authentication override enabled in order to specify an EUC configuration here - otherwise, the Toolset creation will fail. See: https://cloud.google.com/application-integration/docs/configure-connectors-task#configure-authentication-override

connectorActions[]

object (Action)

Required. The list of connector actions/entity operations to generate tools for.

EndUserAuthConfig

JSON representation

JSON representation
{ // Union field `auth_config` can be only one of the following: "oauth2AuthCodeConfig": { object (`Oauth2AuthCodeConfig`) }, "oauth2JwtBearerConfig": { object (`Oauth2JwtBearerConfig`) } // End of list of possible types for union field `auth_config`. }

{

  // Union field auth_config can be only one of the following:
  "oauth2AuthCodeConfig": {
    object (Oauth2AuthCodeConfig)
  },
  "oauth2JwtBearerConfig": {
    object (Oauth2JwtBearerConfig)
  }
  // End of list of possible types for union field auth_config.
}

Fields

Fields
Union field `auth_config`. The auth configuration. `auth_config` can be only one of the following:
`oauth2AuthCodeConfig`	`object (Oauth2AuthCodeConfig)` Oauth 2.0 Authorization Code authentication.
`oauth2JwtBearerConfig`	`object (Oauth2JwtBearerConfig)` JWT Profile Oauth 2.0 Authorization Grant authentication.

Union field auth_config. The auth configuration. auth_config can be only one of the following:

oauth2AuthCodeConfig

object (Oauth2AuthCodeConfig)

Oauth 2.0 Authorization Code authentication.

oauth2JwtBearerConfig

object (Oauth2JwtBearerConfig)

JWT Profile Oauth 2.0 Authorization Grant authentication.

Oauth2AuthCodeConfig

JSON representation
{ "oauthToken": string }

Fields

Fields
`oauthToken`	`string` Required. Oauth token parameter name to pass through. Must be in the format `$context.variables.<name_of_variable>`.

oauthToken

string

Required. Oauth token parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

Oauth2JwtBearerConfig

JSON representation
{ "issuer": string, "subject": string, "clientKey": string }

Fields

Fields
`issuer`	`string` Required. Issuer parameter name to pass through. Must be in the format `$context.variables.<name_of_variable>`.
`subject`	`string` Required. Subject parameter name to pass through. Must be in the format `$context.variables.<name_of_variable>`.
`clientKey`	`string` Required. Client parameter name to pass through. Must be in the format `$context.variables.<name_of_variable>`.

issuer

string

Required. Issuer parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

subject

string

Required. Subject parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

clientKey

string

Required. Client parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

Action

JSON representation

JSON representation
{ "inputFields": [ string ], "outputFields": [ string ], // Union field `action_spec` can be only one of the following: "connectionActionId": string, "entityOperation": { object (`EntityOperation`) } // End of list of possible types for union field `action_spec`. }

{
  "inputFields": [
    string
  ],
  "outputFields": [
    string
  ],

  // Union field action_spec can be only one of the following:
  "connectionActionId": string,
  "entityOperation": {
    object (EntityOperation)
  }
  // End of list of possible types for union field action_spec.
}

Fields
`inputFields[]`	`string` Optional. Entity fields to use as inputs for the operation. If no fields are specified, all fields of the Entity will be used.
`outputFields[]`	`string` Optional. Entity fields to return from the operation. If no fields are specified, all fields of the Entity will be returned.
Union field `action_spec`. Specification for an action to configure for the tool to use. `action_spec` can be only one of the following:
`connectionActionId`	`string` ID of a Connection action for the tool to use.
`entityOperation`	`object (EntityOperation)` Entity operation configuration for the tool to use.

EntityOperation

JSON representation
{ "entityId": string, "operation": enum (`OperationType`) }

Fields

Fields
`entityId`	`string` Required. ID of the entity.
`operation`	`enum (OperationType)` Required. Operation to perform on the entity.

entityId

string

Required. ID of the entity.

operation

enum (OperationType)

Required. Operation to perform on the entity.

Timestamp

JSON representation
{ "seconds": string, "nanos": integer }

Fields

Fields
`seconds`	`string (int64 format)` Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
`nanos`	`integer` Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).

nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

ToolFakeConfig

JSON representation
{ "enableFakeMode": boolean, // Union field `tool_response` can be only one of the following: "codeBlock": { object (`CodeBlock`) } // End of list of possible types for union field `tool_response`. }

Fields

Fields
`enableFakeMode`	`boolean` Optional. Whether the tool is using fake mode.
Union field `tool_response`. The response is either static or it is provided by a python function. `tool_response` can be only one of the following:
`codeBlock`	`object (CodeBlock)` Optional. Code block which will be executed instead of a real tool call.

enableFakeMode

boolean

Optional. Whether the tool is using fake mode.

Union field tool_response. The response is either static or it is provided by a python function. tool_response can be only one of the following:

codeBlock

object (CodeBlock)

Optional. Code block which will be executed instead of a real tool call.

CodeBlock

JSON representation
{ "pythonCode": string }

Fields

Fields
`pythonCode`	`string` Required. Python code which will be invoked in tool fake mode. Expected Python function signature - To catch all tool calls: def fake_tool_call(tool: Tool, input: dict[str, Any], callback_context: CallbackContext) -> Optional[dict[str, Any]]: To catch a specific tool call: def fake_{tool_id}(tool: Tool, input: dict[str, Any], callback_context: CallbackContext) -> Optional[dict[str, Any]]: If the function returns None, the real tool will be invoked instead.

pythonCode

string

Required. Python code which will be invoked in tool fake mode. Expected Python function signature - To catch all tool calls: def fake_tool_call(tool: Tool, input: dict[str, Any], callback_context: CallbackContext) -> Optional[dict[str, Any]]: To catch a specific tool call: def fake_{tool_id}(tool: Tool, input: dict[str, Any], callback_context: CallbackContext) -> Optional[dict[str, Any]]: If the function returns None, the real tool will be invoked instead.

Output Schema

A toolset represents a group of dynamically managed tools that can be used by the agent.

Toolset

JSON representation

JSON representation
{ "name": string, "displayName": string, "description": string, "createTime": string, "updateTime": string, "etag": string, "executionType": enum (`ExecutionType`), "toolFakeConfig": { object (`ToolFakeConfig`) }, // Union field `toolset_type` can be only one of the following: "mcpToolset": { object (`McpToolset`) }, "openApiToolset": { object (`OpenApiToolset`) }, "connectorToolset": { object (`ConnectorToolset`) } // End of list of possible types for union field `toolset_type`. }

{
  "name": string,
  "displayName": string,
  "description": string,
  "createTime": string,
  "updateTime": string,
  "etag": string,
  "executionType": enum (ExecutionType),
  "toolFakeConfig": {
    object (ToolFakeConfig)
  },

  // Union field toolset_type can be only one of the following:
  "mcpToolset": {
    object (McpToolset)
  },
  "openApiToolset": {
    object (OpenApiToolset)
  },
  "connectorToolset": {
    object (ConnectorToolset)
  }
  // End of list of possible types for union field toolset_type.
}

Fields
`name`	`string` Identifier. The unique identifier of the toolset. Format: `projects/{project}/locations/{location}/apps/{app}/toolsets/{toolset}`
`displayName`	`string` Optional. The display name of the toolset. Must be unique within the same app.
`description`	`string` Optional. The description of the toolset.
`createTime`	`string (Timestamp format)` Output only. Timestamp when the toolset was created. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`updateTime`	`string (Timestamp format)` Output only. Timestamp when the toolset was last updated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`etag`	`string` ETag used to ensure the object hasn't changed during a read-modify-write operation. If the etag is empty, the update will overwrite any concurrent changes.
`executionType`	`enum (ExecutionType)` Optional. The execution type of the tools in the toolset.
`toolFakeConfig`	`object (ToolFakeConfig)` Optional. Configuration for tools behavior in fake mode.
Union field `toolset_type`. The type of the toolset. `toolset_type` can be only one of the following:
`mcpToolset`	`object (McpToolset)` Optional. A toolset that contains a list of tools that are offered by the MCP server.
`openApiToolset`	`object (OpenApiToolset)` Optional. A toolset that contains a list of tools that are defined by an OpenAPI schema.
`connectorToolset`	`object (ConnectorToolset)` Optional. A toolset that generates tools from an Integration Connectors Connection.

McpToolset

JSON representation
{ "serverAddress": string, "apiAuthentication": { object (`ApiAuthentication`) }, "serviceDirectoryConfig": { object (`ServiceDirectoryConfig`) }, "tlsConfig": { object (`TlsConfig`) } }

Fields
`serverAddress`	`string` Required. The address of the MCP server, for example, "https://example.com/mcp/". If the server is built with the MCP SDK, the url should be suffixed with "/mcp/". Only Streamable HTTP transport based servers are supported. See https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http for more details.
`apiAuthentication`	`object (ApiAuthentication)` Optional. Authentication information required to access tools and execute a tool against the MCP server. For bearer token authentication, the token applies only to tool execution, not to listing tools. This requires that tools can be listed without authentication.
`serviceDirectoryConfig`	`object (ServiceDirectoryConfig)` Optional. Service Directory configuration for VPC-SC, used to resolve service names within a perimeter.
`tlsConfig`	`object (TlsConfig)` Optional. The TLS configuration. Includes the custom server certificates that the client should trust.

ApiAuthentication

JSON representation

JSON representation
{ // Union field `auth_config` can be only one of the following: "apiKeyConfig": { object (`ApiKeyConfig`) }, "oauthConfig": { object (`OAuthConfig`) }, "serviceAgentIdTokenAuthConfig": { object (`ServiceAgentIdTokenAuthConfig`) }, "serviceAccountAuthConfig": { object (`ServiceAccountAuthConfig`) }, "bearerTokenConfig": { object (`BearerTokenConfig`) } // End of list of possible types for union field `auth_config`. }

{

  // Union field auth_config can be only one of the following:
  "apiKeyConfig": {
    object (ApiKeyConfig)
  },
  "oauthConfig": {
    object (OAuthConfig)
  },
  "serviceAgentIdTokenAuthConfig": {
    object (ServiceAgentIdTokenAuthConfig)
  },
  "serviceAccountAuthConfig": {
    object (ServiceAccountAuthConfig)
  },
  "bearerTokenConfig": {
    object (BearerTokenConfig)
  }
  // End of list of possible types for union field auth_config.
}

Fields
Union field `auth_config`. The auth configuration. `auth_config` can be only one of the following:
`apiKeyConfig`	`object (ApiKeyConfig)` Optional. Config for API key auth.
`oauthConfig`	`object (OAuthConfig)` Optional. Config for OAuth.
`serviceAgentIdTokenAuthConfig`	`object (ServiceAgentIdTokenAuthConfig)` Optional. Config for ID token auth generated from CES service agent.
`serviceAccountAuthConfig`	`object (ServiceAccountAuthConfig)` Optional. Config for service account authentication.
`bearerTokenConfig`	`object (BearerTokenConfig)` Optional. Config for bearer token auth.

ApiKeyConfig

JSON representation
{ "keyName": string, "apiKeySecretVersion": string, "requestLocation": enum (`RequestLocation`) }

Fields

keyName

string

Required. The parameter name or the header name of the API key. E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.

apiKeySecretVersion

string

Required. The name of the SecretManager secret version resource storing the API key. Format: projects/{project}/secrets/{secret}/versions/{version}

Note: You should grant roles/secretmanager.secretAccessor role to the CES service agent service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com.

requestLocation

enum (RequestLocation)

Required. Key location in the request.

OAuthConfig

JSON representation
{ "oauthGrantType": enum (`OauthGrantType`), "clientId": string, "clientSecretVersion": string, "tokenEndpoint": string, "scopes": [ string ] }

Fields
`oauthGrantType`	`enum (OauthGrantType)` Required. OAuth grant types.
`clientId`	`string` Required. The client ID from the OAuth provider.
`clientSecretVersion`	`string` Required. The name of the SecretManager secret version resource storing the client secret. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com`.
`tokenEndpoint`	`string` Required. The token endpoint in the OAuth provider to exchange for an access token.
`scopes[]`	`string` Optional. The OAuth scopes to grant.

ServiceAccountAuthConfig

JSON representation
{ "serviceAccount": string, "scopes": [ string ] }

Fields

serviceAccount

string

The service account must have the roles/iam.serviceAccountTokenCreator role granted to the CES service agent service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com.

scopes[]

string

Optional. The OAuth scopes to grant. If not specified, the default scope https://www.googleapis.com/auth/cloud-platform is used.

BearerTokenConfig

JSON representation
{ "token": string }

Fields

token

string

Required. The bearer token. Must be in the format $context.variables.<name_of_variable>.

ServiceDirectoryConfig

JSON representation
{ "service": string }

Fields

service

string

TlsConfig

JSON representation
{ "caCerts": [ { object (`CaCert`) } ] }

Fields

caCerts[]

object (CaCert)

Required. Specifies a list of allowed custom CA certificates for HTTPS verification.

CaCert

JSON representation
{ "displayName": string, "cert": string }

Fields

displayName

string

Required. The name of the allowed custom CA certificates. This can be used to disambiguate the custom CA certificates.

cert

string (bytes format)

A base64-encoded string.

OpenApiToolset

JSON representation

{
  "openApiSchema": string,
  "apiAuthentication": {
    object (ApiAuthentication)
  },
  "tlsConfig": {
    object (TlsConfig)
  },
  "serviceDirectoryConfig": {
    object (ServiceDirectoryConfig)
  },
  "ignoreUnknownFields": boolean,
  "url": string
}

Fields
`openApiSchema`	`string` Required. The OpenAPI schema of the toolset.
`apiAuthentication`	`object (ApiAuthentication)` Optional. Authentication information required by the API.
`tlsConfig`	`object (TlsConfig)` Optional. The TLS configuration. Includes the custom server certificates
`serviceDirectoryConfig`	`object (ServiceDirectoryConfig)` Optional. Service Directory configuration.
`ignoreUnknownFields`	`boolean` Optional. If true, the agent will ignore unknown fields in the API response for all operations defined in the OpenAPI schema.
`url`	`string` Optional. The server URL of the Open API schema. This field is only set in toolsets in the environment dependencies during the export process if the schema contains a server url. During the import process, if this url is present in the environment dependencies and the schema has the $env_var placeholder, it will replace the placeholder in the schema.

ConnectorToolset

JSON representation
{ "connection": string, "authConfig": { object (`EndUserAuthConfig`) }, "connectorActions": [ { object (`Action`) } ] }

Fields

connection

string

Required. The full resource name of the referenced Integration Connectors Connection. Format: projects/{project}/locations/{location}/connections/{connection}

authConfig

object (EndUserAuthConfig)

connectorActions[]

object (Action)

Required. The list of connector actions/entity operations to generate tools for.

EndUserAuthConfig

JSON representation

{

  // Union field auth_config can be only one of the following:
  "oauth2AuthCodeConfig": {
    object (Oauth2AuthCodeConfig)
  },
  "oauth2JwtBearerConfig": {
    object (Oauth2JwtBearerConfig)
  }
  // End of list of possible types for union field auth_config.
}

Fields

Union field auth_config. The auth configuration. auth_config can be only one of the following:

oauth2AuthCodeConfig

object (Oauth2AuthCodeConfig)

Oauth 2.0 Authorization Code authentication.

oauth2JwtBearerConfig

object (Oauth2JwtBearerConfig)

JWT Profile Oauth 2.0 Authorization Grant authentication.

Oauth2AuthCodeConfig

JSON representation
{ "oauthToken": string }

Fields

oauthToken

string

Required. Oauth token parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

Oauth2JwtBearerConfig

JSON representation
{ "issuer": string, "subject": string, "clientKey": string }

Fields

issuer

string

Required. Issuer parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

subject

string

Required. Subject parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

clientKey

string

Required. Client parameter name to pass through. Must be in the format $context.variables.<name_of_variable>.

Action

JSON representation

{
  "inputFields": [
    string
  ],
  "outputFields": [
    string
  ],

  // Union field action_spec can be only one of the following:
  "connectionActionId": string,
  "entityOperation": {
    object (EntityOperation)
  }
  // End of list of possible types for union field action_spec.
}

Fields
`inputFields[]`	`string` Optional. Entity fields to use as inputs for the operation. If no fields are specified, all fields of the Entity will be used.
`outputFields[]`	`string` Optional. Entity fields to return from the operation. If no fields are specified, all fields of the Entity will be returned.
Union field `action_spec`. Specification for an action to configure for the tool to use. `action_spec` can be only one of the following:
`connectionActionId`	`string` ID of a Connection action for the tool to use.
`entityOperation`	`object (EntityOperation)` Entity operation configuration for the tool to use.

EntityOperation

JSON representation
{ "entityId": string, "operation": enum (`OperationType`) }

Fields

entityId

string

Required. ID of the entity.

operation

enum (OperationType)

Required. Operation to perform on the entity.

Timestamp

JSON representation
{ "seconds": string, "nanos": integer }

Fields

seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).

nanos

integer

ToolFakeConfig

JSON representation
{ "enableFakeMode": boolean, // Union field `tool_response` can be only one of the following: "codeBlock": { object (`CodeBlock`) } // End of list of possible types for union field `tool_response`. }

Fields

enableFakeMode

boolean

Optional. Whether the tool is using fake mode.

Union field tool_response. The response is either static or it is provided by a python function. tool_response can be only one of the following:

codeBlock

object (CodeBlock)

Optional. Code block which will be executed instead of a real tool call.

CodeBlock

JSON representation
{ "pythonCode": string }

Fields

pythonCode

string

Tool Annotations

Destructive Hint: ✅ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌

MCP Tools Reference: ces.googleapis.com Stay organized with collections Save and categorize content based on your preferences.

Tool: create_toolset

Input Schema

CreateToolsetRequest

Toolset

McpToolset

ApiAuthentication

ApiKeyConfig

OAuthConfig

ServiceAccountAuthConfig

BearerTokenConfig

ServiceDirectoryConfig

TlsConfig

CaCert

OpenApiToolset

ConnectorToolset

EndUserAuthConfig

Oauth2AuthCodeConfig

Oauth2JwtBearerConfig

Action

EntityOperation

Timestamp

ToolFakeConfig

CodeBlock

Output Schema

Toolset

McpToolset

ApiAuthentication

ApiKeyConfig

OAuthConfig

ServiceAccountAuthConfig

BearerTokenConfig

ServiceDirectoryConfig

TlsConfig

CaCert

OpenApiToolset

ConnectorToolset

EndUserAuthConfig

Oauth2AuthCodeConfig

Oauth2JwtBearerConfig

Action

EntityOperation

Timestamp

ToolFakeConfig

CodeBlock

Tool Annotations

MCP Tools Reference: ces.googleapis.com

Tool: `create_toolset`