MCP Tools Reference: dataform.googleapis.com

Tool: update_repository

Update the properties of an existing Dataform repository, such as its Git remote settings, workspace compilation overrides, or the default service account.

Prerequisite: Use the get_repository tool to read the current repository state before updating.

If the update_mask parameter value is omitted, all mutable fields are overwritten with the values supplied in the repository parameter value. To modify only specific fields without clearing the others, list those fields in update_mask.

The repository.name parameter value must be in the format projects/{project_id}/locations/{location}/repositories/{repository}.

The following code sample shows how to use curl to call the update_repository MCP tool.

Curl Request 
curl --location 'https://dataform.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "update_repository",
    "arguments": {
      // Provide these details according to the MCP tool specification.
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

UpdateRepository request message.

UpdateRepositoryRequest

JSON representation 
{
  "updateMask": string,
  "repository": {
    object (Repository)
  }
}
Fields
updateMask

string (FieldMask format)

Optional. Specifies the fields to be updated in the repository. If left unset, all fields will be updated.

This is a comma-separated list of fully qualified names of fields. Example: "user.displayName,photo".
repository

object (Repository)

Required. The repository to update.

FieldMask

JSON representation 
{
  "paths": [
    string
  ]
}
Fields
paths[]

string

The set of field mask paths.

Repository

JSON representation 
{
  "name": string,
  "createTime": string,
  "displayName": string,
  "gitRemoteSettings": {
    object (GitRemoteSettings)
  },
  "npmrcEnvironmentVariablesSecretVersion": string,
  "workspaceCompilationOverrides": {
    object (WorkspaceCompilationOverrides)
  },
  "labels": {
    string: string,
    ...
  },
  "setAuthenticatedUserAdmin": boolean,
  "serviceAccount": string,
  "kmsKeyName": string,
  "dataEncryptionState": {
    object (DataEncryptionState)
  },

  // Union field _containing_folder can be only one of the following:
  "containingFolder": string
  // End of list of possible types for union field _containing_folder.

  // Union field _team_folder_name can be only one of the following:
  "teamFolderName": string
  // End of list of possible types for union field _team_folder_name.

  // Union field _internal_metadata can be only one of the following:
  "internalMetadata": string
  // End of list of possible types for union field _internal_metadata.
}
Fields
name

string

Identifier. The repository's name.
createTime

string (Timestamp format)

Output only. The timestamp of when the repository was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
displayName

string

Optional. The repository's user-friendly name.
gitRemoteSettings

object (GitRemoteSettings)

Optional. If set, configures this repository to be linked to a Git remote.
npmrcEnvironmentVariablesSecretVersion

string

Optional. The name of the Secret Manager secret version to be used to interpolate variables into the .npmrc file for package installation operations. Must be in the format projects/*/secrets/*/versions/*. The file itself must be in a JSON format.
workspaceCompilationOverrides

object (WorkspaceCompilationOverrides)

Optional. If set, fields of workspace_compilation_overrides override the default compilation settings that are specified in dataform.json when creating workspace-scoped compilation results. See documentation for WorkspaceCompilationOverrides for more information.
labels

map (key: string, value: string)

Optional. Repository user labels.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
setAuthenticatedUserAdmin

boolean

Optional. Input only. If set to true, the authenticated user will be granted the roles/dataform.admin role on the created repository. To modify access to the created repository later apply setIamPolicy from https://cloud.google.com/dataform/reference/rest#rest-resource:-v1beta1.projects.locations.repositories
serviceAccount

string

Optional. The service account to run workflow invocations under.
kmsKeyName

string

Optional. The reference to a KMS encryption key. If provided, it will be used to encrypt user data in the repository and all child resources. It is not possible to add or update the encryption key after the repository is created. Example: projects/{kms_project}/locations/{location}/keyRings/{key_location}/cryptoKeys/{key}
dataEncryptionState

object (DataEncryptionState)

Output only. A data encryption state of a Git repository if this Repository is protected by a KMS key.

Union field _containing_folder.

_containing_folder can be only one of the following:
containingFolder

string

Optional. The name of the containing folder of the repository. The field is immutable and it can be modified via a MoveRepository operation. Format: projects/*/locations/*/folders/*. or projects/*/locations/*/teamFolders/*.

Union field _team_folder_name.

_team_folder_name can be only one of the following:
teamFolderName

string

Output only. The resource name of the TeamFolder that this Repository is associated with. This should take the format: projects/{project}/locations/{location}/teamFolders/{teamFolder}. If this is not set, the Repository is not associated with a TeamFolder.

Union field _internal_metadata.

_internal_metadata can be only one of the following:
internalMetadata

string

Output only. All the metadata information that is used internally to serve the resource. For example: timestamps, flags, status fields, etc. The format of this field is a JSON string.

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

GitRemoteSettings

JSON representation 
{
  "url": string,
  "defaultBranch": string,
  "effectiveDefaultBranch": string,
  "authenticationTokenSecretVersion": string,
  "sshAuthenticationConfig": {
    object (SshAuthenticationConfig)
  },
  "tokenStatus": enum (TokenStatus),

  // Union field _git_repository_link can be only one of the following:
  "gitRepositoryLink": string
  // End of list of possible types for union field _git_repository_link.
}
Fields
url

string

Required. The Git remote's URL.
defaultBranch

string

Optional. The Git remote's default branch name. If not set, main will be used.
effectiveDefaultBranch

string

Output only. The Git remote's effective default branch name. This is the default branch name of the Git remote if it is set, otherwise it is main.
authenticationTokenSecretVersion

string

Optional. The name of the Secret Manager secret version to use as an authentication token for Git operations. Must be in the format projects/*/secrets/*/versions/*.
sshAuthenticationConfig

object (SshAuthenticationConfig)

Optional. Authentication fields for remote uris using SSH protocol.
tokenStatus
(deprecated)

enum (TokenStatus)

Output only. Deprecated: The field does not contain any token status information. Instead use https://cloud.google.com/dataform/reference/rest/v1beta1/projects.locations.repositories/computeAccessTokenStatus

Union field _git_repository_link.

_git_repository_link can be only one of the following:
gitRepositoryLink

string

Optional. Resource name for the GitRepositoryLink used for machine credentials. Must be in the format projects/*/locations/*/connections/*/gitRepositoryLinks/*

SshAuthenticationConfig

JSON representation 
{
  "userPrivateKeySecretVersion": string,
  "hostPublicKey": string
}
Fields
userPrivateKeySecretVersion

string

Required. The name of the Secret Manager secret version to use as a ssh private key for Git operations. Must be in the format projects/*/secrets/*/versions/*.
hostPublicKey

string

Required. Content of a public SSH key to verify an identity of a remote Git host.

WorkspaceCompilationOverrides

JSON representation 
{
  "defaultDatabase": string,
  "schemaSuffix": string,
  "tablePrefix": string
}
Fields
defaultDatabase

string

Optional. The default database (Google Cloud project ID).
schemaSuffix

string

Optional. The suffix that should be appended to all schema (BigQuery dataset ID) names.
tablePrefix

string

Optional. The prefix that should be prepended to all table names.

LabelsEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string

DataEncryptionState

JSON representation 
{
  "kmsKeyVersionName": string
}
Fields
kmsKeyVersionName

string

Required. The KMS key version name with which data of a resource is encrypted.

TokenStatus

The status of the authentication token.

Enums
TOKEN_STATUS_UNSPECIFIED Default value. This value is unused.
NOT_FOUND The token could not be found in Secret Manager (or the Dataform Service Account did not have permission to access it).
INVALID The token could not be used to authenticate against the Git remote.
VALID The token was used successfully to authenticate against the Git remote.

Output Schema

Represents a Dataform Git repository.

Repository

JSON representation 
{
  "name": string,
  "createTime": string,
  "displayName": string,
  "gitRemoteSettings": {
    object (GitRemoteSettings)
  },
  "npmrcEnvironmentVariablesSecretVersion": string,
  "workspaceCompilationOverrides": {
    object (WorkspaceCompilationOverrides)
  },
  "labels": {
    string: string,
    ...
  },
  "setAuthenticatedUserAdmin": boolean,
  "serviceAccount": string,
  "kmsKeyName": string,
  "dataEncryptionState": {
    object (DataEncryptionState)
  },

  // Union field _containing_folder can be only one of the following:
  "containingFolder": string
  // End of list of possible types for union field _containing_folder.

  // Union field _team_folder_name can be only one of the following:
  "teamFolderName": string
  // End of list of possible types for union field _team_folder_name.

  // Union field _internal_metadata can be only one of the following:
  "internalMetadata": string
  // End of list of possible types for union field _internal_metadata.
}
Fields
name

string

Identifier. The repository's name.
createTime

string (Timestamp format)

Output only. The timestamp of when the repository was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
displayName

string

Optional. The repository's user-friendly name.
gitRemoteSettings

object (GitRemoteSettings)

Optional. If set, configures this repository to be linked to a Git remote.
npmrcEnvironmentVariablesSecretVersion

string

Optional. The name of the Secret Manager secret version to be used to interpolate variables into the .npmrc file for package installation operations. Must be in the format projects/*/secrets/*/versions/*. The file itself must be in a JSON format.
workspaceCompilationOverrides

object (WorkspaceCompilationOverrides)

Optional. If set, fields of workspace_compilation_overrides override the default compilation settings that are specified in dataform.json when creating workspace-scoped compilation results. See documentation for WorkspaceCompilationOverrides for more information.
labels

map (key: string, value: string)

Optional. Repository user labels.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
setAuthenticatedUserAdmin

boolean

Optional. Input only. If set to true, the authenticated user will be granted the roles/dataform.admin role on the created repository. To modify access to the created repository later apply setIamPolicy from https://cloud.google.com/dataform/reference/rest#rest-resource:-v1beta1.projects.locations.repositories
serviceAccount

string

Optional. The service account to run workflow invocations under.
kmsKeyName

string

Optional. The reference to a KMS encryption key. If provided, it will be used to encrypt user data in the repository and all child resources. It is not possible to add or update the encryption key after the repository is created. Example: projects/{kms_project}/locations/{location}/keyRings/{key_location}/cryptoKeys/{key}
dataEncryptionState

object (DataEncryptionState)

Output only. A data encryption state of a Git repository if this Repository is protected by a KMS key.

Union field _containing_folder.

_containing_folder can be only one of the following:
containingFolder

string

Optional. The name of the containing folder of the repository. The field is immutable and it can be modified via a MoveRepository operation. Format: projects/*/locations/*/folders/*. or projects/*/locations/*/teamFolders/*.

Union field _team_folder_name.

_team_folder_name can be only one of the following:
teamFolderName

string

Output only. The resource name of the TeamFolder that this Repository is associated with. This should take the format: projects/{project}/locations/{location}/teamFolders/{teamFolder}. If this is not set, the Repository is not associated with a TeamFolder.

Union field _internal_metadata.

_internal_metadata can be only one of the following:
internalMetadata

string

Output only. All the metadata information that is used internally to serve the resource. For example: timestamps, flags, status fields, etc. The format of this field is a JSON string.

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

GitRemoteSettings

JSON representation 
{
  "url": string,
  "defaultBranch": string,
  "effectiveDefaultBranch": string,
  "authenticationTokenSecretVersion": string,
  "sshAuthenticationConfig": {
    object (SshAuthenticationConfig)
  },
  "tokenStatus": enum (TokenStatus),

  // Union field _git_repository_link can be only one of the following:
  "gitRepositoryLink": string
  // End of list of possible types for union field _git_repository_link.
}
Fields
url

string

Required. The Git remote's URL.
defaultBranch

string

Optional. The Git remote's default branch name. If not set, main will be used.
effectiveDefaultBranch

string

Output only. The Git remote's effective default branch name. This is the default branch name of the Git remote if it is set, otherwise it is main.
authenticationTokenSecretVersion

string

Optional. The name of the Secret Manager secret version to use as an authentication token for Git operations. Must be in the format projects/*/secrets/*/versions/*.
sshAuthenticationConfig

object (SshAuthenticationConfig)

Optional. Authentication fields for remote uris using SSH protocol.
tokenStatus
(deprecated)

enum (TokenStatus)

Output only. Deprecated: The field does not contain any token status information. Instead use https://cloud.google.com/dataform/reference/rest/v1beta1/projects.locations.repositories/computeAccessTokenStatus

Union field _git_repository_link.

_git_repository_link can be only one of the following:
gitRepositoryLink

string

Optional. Resource name for the GitRepositoryLink used for machine credentials. Must be in the format projects/*/locations/*/connections/*/gitRepositoryLinks/*

SshAuthenticationConfig

JSON representation 
{
  "userPrivateKeySecretVersion": string,
  "hostPublicKey": string
}
Fields
userPrivateKeySecretVersion

string

Required. The name of the Secret Manager secret version to use as a ssh private key for Git operations. Must be in the format projects/*/secrets/*/versions/*.
hostPublicKey

string

Required. Content of a public SSH key to verify an identity of a remote Git host.

WorkspaceCompilationOverrides

JSON representation 
{
  "defaultDatabase": string,
  "schemaSuffix": string,
  "tablePrefix": string
}
Fields
defaultDatabase

string

Optional. The default database (Google Cloud project ID).
schemaSuffix

string

Optional. The suffix that should be appended to all schema (BigQuery dataset ID) names.
tablePrefix

string

Optional. The prefix that should be prepended to all table names.

LabelsEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string

DataEncryptionState

JSON representation 
{
  "kmsKeyVersionName": string
}
Fields
kmsKeyVersionName

string

Required. The KMS key version name with which data of a resource is encrypted.

TokenStatus

The status of the authentication token.

Enums
TOKEN_STATUS_UNSPECIFIED Default value. This value is unused.
NOT_FOUND The token could not be found in Secret Manager (or the Dataform Service Account did not have permission to access it).
INVALID The token could not be used to authenticate against the Git remote.
VALID The token was used successfully to authenticate against the Git remote.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌