MCP Tools Reference: developerconnect.googleapis.com

Tool: create-connection

Creates a new Connection in a given project and location.

The following code sample shows how to use curl to call the create-connection MCP tool.

Curl Request 
curl --location 'https://developerconnect.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "create-connection",
    "arguments": {
      // Provide these details according to the MCP tool specification.
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Message for creating a Connection

CreateConnectionRequest

JSON representation 
{
  "parent": string,
  "connectionId": string,
  "connection": {
    object (Connection)
  },
  "requestId": string,
  "validateOnly": boolean
}
Fields
parent

string

Required. Value for parent.
connectionId

string

Required. The ID to use for the connection, which becomes the final component of the connection's resource name.
connection

object (Connection)

Required. The resource being created
requestId

string

Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
validateOnly

boolean

Optional. If set, validate the request, but do not actually post it.

Connection

JSON representation 
{
  "name": string,
  "createTime": string,
  "updateTime": string,
  "deleteTime": string,
  "labels": {
    string: string,
    ...
  },
  "installationState": {
    object (InstallationState)
  },
  "disabled": boolean,
  "reconciling": boolean,
  "annotations": {
    string: string,
    ...
  },
  "etag": string,
  "uid": string,
  "cryptoKeyConfig": {
    object (CryptoKeyConfig)
  },
  "gitProxyConfig": {
    object (GitProxyConfig)
  },

  // Union field connection_config can be only one of the following:
  "githubConfig": {
    object (GitHubConfig)
  },
  "githubEnterpriseConfig": {
    object (GitHubEnterpriseConfig)
  },
  "gitlabConfig": {
    object (GitLabConfig)
  },
  "gitlabEnterpriseConfig": {
    object (GitLabEnterpriseConfig)
  },
  "bitbucketDataCenterConfig": {
    object (BitbucketDataCenterConfig)
  },
  "bitbucketCloudConfig": {
    object (BitbucketCloudConfig)
  },
  "secureSourceManagerInstanceConfig": {
    object (SecureSourceManagerInstanceConfig)
  },
  "httpConfig": {
    object (GenericHTTPEndpointConfig)
  }
  // End of list of possible types for union field connection_config.
}
Fields
name

string

Identifier. The resource name of the connection, in the format projects/{project}/locations/{location}/connections/{connection_id}.
createTime

string (Timestamp format)

Output only. Create timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. Update timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
deleteTime

string (Timestamp format)

Output only. Delete timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
labels

map (key: string, value: string)

Optional. Labels as key value pairs

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
installationState

object (InstallationState)

Output only. Installation state of the Connection.
disabled

boolean

Optional. If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled.
reconciling

boolean

Output only. Set to true when the connection is being set up or updated in the background.
annotations

map (key: string, value: string)

Optional. Allows clients to store small amounts of arbitrary data.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
etag

string

Optional. This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
uid

string

Output only. A system-assigned unique identifier for the Connection.
cryptoKeyConfig

object (CryptoKeyConfig)

Optional. The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature.
gitProxyConfig

object (GitProxyConfig)

Optional. Configuration for the Git proxy feature. Enabling the Git proxy allows clients to perform Git operations on the repositories linked in the connection. Learn more.
Union field connection_config. Configuration for the connection depending on the type of provider. connection_config can be only one of the following:
githubConfig

object (GitHubConfig)

Configuration for connections to github.com.
githubEnterpriseConfig

object (GitHubEnterpriseConfig)

Configuration for connections to an instance of GitHub Enterprise.
gitlabConfig

object (GitLabConfig)

Configuration for connections to gitlab.com.
gitlabEnterpriseConfig

object (GitLabEnterpriseConfig)

Configuration for connections to an instance of GitLab Enterprise.
bitbucketDataCenterConfig

object (BitbucketDataCenterConfig)

Configuration for connections to an instance of Bitbucket Data Center.
bitbucketCloudConfig

object (BitbucketCloudConfig)

Configuration for connections to an instance of Bitbucket Clouds.
secureSourceManagerInstanceConfig

object (SecureSourceManagerInstanceConfig)

Configuration for connections to an instance of Secure Source Manager.
httpConfig

object (GenericHTTPEndpointConfig)

Optional. Configuration for connections to an HTTP service provider.

GitHubConfig

JSON representation 
{
  "githubApp": enum (GitHubApp),
  "authorizerCredential": {
    object (OAuthCredential)
  },
  "appInstallationId": string,
  "installationUri": string
}
Fields
githubApp

enum (GitHubApp)

Required. Immutable. The GitHub Application that was installed to the GitHub user or organization.
authorizerCredential

object (OAuthCredential)

Optional. OAuth credential of the account that authorized the GitHub App. It is recommended to use a robot account instead of a human user account. The OAuth token must be tied to the GitHub App of this config.
appInstallationId

string (int64 format)

Optional. GitHub App installation id.
installationUri

string

Output only. The URI to navigate to in order to manage the installation associated with this GitHubConfig.

OAuthCredential

JSON representation 
{
  "oauthTokenSecretVersion": string,
  "username": string
}
Fields
oauthTokenSecretVersion

string

Required. A SecretManager resource containing the OAuth token that authorizes the connection. Format: projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location).
username

string

Output only. The username associated with this token.

GitHubEnterpriseConfig

JSON representation 
{
  "hostUri": string,
  "appId": string,
  "appSlug": string,
  "privateKeySecretVersion": string,
  "webhookSecretSecretVersion": string,
  "appInstallationId": string,
  "installationUri": string,
  "serviceDirectoryConfig": {
    object (ServiceDirectoryConfig)
  },
  "serverVersion": string,
  "sslCaCertificate": string,
  "organization": string
}
Fields
hostUri

string

Required. The URI of the GitHub Enterprise host this connection is for.
appId

string (int64 format)

Optional. ID of the GitHub App created from the manifest.
appSlug

string

Output only. The URL-friendly name of the GitHub App.
privateKeySecretVersion

string

Optional. SecretManager resource containing the private key of the GitHub App, formatted as projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location).
webhookSecretSecretVersion

string

Optional. SecretManager resource containing the webhook secret of the GitHub App, formatted as projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location).
appInstallationId

string (int64 format)

Optional. ID of the installation of the GitHub App.
installationUri

string

Output only. The URI to navigate to in order to manage the installation associated with this GitHubEnterpriseConfig.
serviceDirectoryConfig

object (ServiceDirectoryConfig)

Optional. Configuration for using Service Directory to privately connect to a GitHub Enterprise server. This should only be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, calls to the GitHub Enterprise server will be made over the public internet.
serverVersion

string

Output only. GitHub Enterprise version installed at the host_uri.
sslCaCertificate

string

Optional. SSL certificate to use for requests to GitHub Enterprise.
organization

string

Optional. Immutable. GitHub Enterprise organization in which the GitHub App is created.

ServiceDirectoryConfig

JSON representation 
{
  "service": string
}
Fields
service

string

Required. The Service Directory service name. Format: projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}.

GitLabConfig

JSON representation 
{
  "webhookSecretSecretVersion": string,
  "readAuthorizerCredential": {
    object (UserCredential)
  },
  "authorizerCredential": {
    object (UserCredential)
  }
}
Fields
webhookSecretSecretVersion

string

Required. Immutable. SecretManager resource containing the webhook secret of a GitLab project, formatted as projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location). This is used to validate webhooks.
readAuthorizerCredential

object (UserCredential)

Required. A GitLab personal access token with the minimum read_api scope access and a minimum role of reporter. The GitLab Projects visible to this Personal Access Token will control which Projects Developer Connect has access to.
authorizerCredential

object (UserCredential)

Required. A GitLab personal access token with the minimum api scope access and a minimum role of maintainer. The GitLab Projects visible to this Personal Access Token will control which Projects Developer Connect has access to.

UserCredential

JSON representation 
{
  "userTokenSecretVersion": string,
  "username": string
}
Fields
userTokenSecretVersion

string

Required. A SecretManager resource containing the user token that authorizes the Developer Connect connection. Format: projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location).
username

string

Output only. The username associated with this token.

GitLabEnterpriseConfig

JSON representation 
{
  "hostUri": string,
  "webhookSecretSecretVersion": string,
  "readAuthorizerCredential": {
    object (UserCredential)
  },
  "authorizerCredential": {
    object (UserCredential)
  },
  "serviceDirectoryConfig": {
    object (ServiceDirectoryConfig)
  },
  "sslCaCertificate": string,
  "serverVersion": string
}
Fields
hostUri

string

Required. The URI of the GitLab Enterprise host this connection is for.
webhookSecretSecretVersion

string

Required. Immutable. SecretManager resource containing the webhook secret of a GitLab project, formatted as projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location). This is used to validate webhooks.
readAuthorizerCredential

object (UserCredential)

Required. A GitLab personal access token with the minimum read_api scope access and a minimum role of reporter. The GitLab Projects visible to this Personal Access Token will control which Projects Developer Connect has access to.
authorizerCredential

object (UserCredential)

Required. A GitLab personal access token with the minimum api scope access and a minimum role of maintainer. The GitLab Projects visible to this Personal Access Token will control which Projects Developer Connect has access to.
serviceDirectoryConfig

object (ServiceDirectoryConfig)

Optional. Configuration for using Service Directory to privately connect to a GitLab Enterprise instance. This should only be set if the GitLab Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, calls to the GitLab Enterprise server will be made over the public internet.
sslCaCertificate

string

Optional. SSL Certificate Authority certificate to use for requests to GitLab Enterprise instance.
serverVersion

string

Output only. Version of the GitLab Enterprise server running on the host_uri.

BitbucketDataCenterConfig

JSON representation 
{
  "hostUri": string,
  "webhookSecretSecretVersion": string,
  "readAuthorizerCredential": {
    object (UserCredential)
  },
  "authorizerCredential": {
    object (UserCredential)
  },
  "serviceDirectoryConfig": {
    object (ServiceDirectoryConfig)
  },
  "sslCaCertificate": string,
  "serverVersion": string
}
Fields
hostUri

string

Required. The URI of the Bitbucket Data Center host this connection is for.
webhookSecretSecretVersion

string

Required. Immutable. SecretManager resource containing the webhook secret used to verify webhook events, formatted as projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location). This is used to validate webhooks.
readAuthorizerCredential

object (UserCredential)

Required. An http access token with the minimum Repository read access. It's recommended to use a system account to generate the credentials.
authorizerCredential

object (UserCredential)

Required. An http access token with the minimum Repository admin scope access. This is needed to create webhooks. It's recommended to use a system account to generate these credentials.
serviceDirectoryConfig

object (ServiceDirectoryConfig)

Optional. Configuration for using Service Directory to privately connect to a Bitbucket Data Center instance. This should only be set if the Bitbucket Data Center is hosted on-premises and not reachable by public internet. If this field is left empty, calls to the Bitbucket Data Center will be made over the public internet.
sslCaCertificate

string

Optional. SSL certificate authority to trust when making requests to Bitbucket Data Center.
serverVersion

string

Output only. Version of the Bitbucket Data Center server running on the host_uri.

BitbucketCloudConfig

JSON representation 
{
  "workspace": string,
  "webhookSecretSecretVersion": string,
  "readAuthorizerCredential": {
    object (UserCredential)
  },
  "authorizerCredential": {
    object (UserCredential)
  }
}
Fields
workspace

string

Required. The Bitbucket Cloud Workspace ID to be connected to Google Cloud Platform.
webhookSecretSecretVersion

string

Required. Immutable. SecretManager resource containing the webhook secret used to verify webhook events, formatted as projects/*/secrets/*/versions/* or projects/*/locations/*/secrets/*/versions/* (if regional secrets are supported in that location). This is used to validate and create webhooks.
readAuthorizerCredential

object (UserCredential)

Required. An access token with the minimum repository access. It can either be a workspace, project or repository access token. It's recommended to use a system account to generate the credentials.
authorizerCredential

object (UserCredential)

Required. An access token with the minimum repository, pullrequest and webhook scope access. It can either be a workspace, project or repository access token. This is needed to create webhooks. It's recommended to use a system account to generate these credentials.

SecureSourceManagerInstanceConfig

JSON representation 
{
  "instance": string
}
Fields
instance

string

Required. Immutable. Secure Source Manager instance resource, formatted as projects/*/locations/*/instances/*

GenericHTTPEndpointConfig

JSON representation 
{
  "hostUri": string,
  "serviceDirectoryConfig": {
    object (ServiceDirectoryConfig)
  },
  "sslCaCertificate": string,

  // Union field authentication can be only one of the following:
  "basicAuthentication": {
    object (BasicAuthentication)
  },
  "bearerTokenAuthentication": {
    object (BearerTokenAuthentication)
  }
  // End of list of possible types for union field authentication.
}
Fields
hostUri

string

Required. Immutable. The service provider's https endpoint.
serviceDirectoryConfig

object (ServiceDirectoryConfig)

Optional. Configuration for using Service Directory to privately connect to a HTTP service provider. This should only be set if the Http service provider is hosted on-premises and not reachable by public internet. If this field is left empty, calls to the HTTP service provider will be made over the public internet.
sslCaCertificate

string

Optional. The SSL certificate to use for requests to the HTTP service provider.
Union field authentication. The authentication mechanism to use for requests to the HTTP service provider. authentication can be only one of the following:
basicAuthentication

object (BasicAuthentication)

Optional. Basic authentication with username and password.
bearerTokenAuthentication

object (BearerTokenAuthentication)

Optional. Bearer token authentication with a token.

BasicAuthentication

JSON representation 
{
  "username": string,

  // Union field password can be only one of the following:
  "passwordSecretVersion": string
  // End of list of possible types for union field password.
}
Fields
username

string

Required. The username to authenticate as.
Union field password. The password to authenticate as. password can be only one of the following:
passwordSecretVersion

string

The password SecretManager secret version to authenticate as.

BearerTokenAuthentication

JSON representation 
{

  // Union field token can be only one of the following:
  "tokenSecretVersion": string
  // End of list of possible types for union field token.
}
Fields
Union field token. The token to authenticate as. token can be only one of the following:
tokenSecretVersion

string

Optional. The token SecretManager secret version to authenticate as.

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

LabelsEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string

InstallationState

JSON representation 
{
  "stage": enum (Stage),
  "message": string,
  "actionUri": string
}
Fields
stage

enum (Stage)

Output only. Current step of the installation process.
message

string

Output only. Message of what the user should do next to continue the installation. Empty string if the installation is already complete.
actionUri

string

Output only. Link to follow for next action. Empty string if the installation is already complete.

AnnotationsEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string

CryptoKeyConfig

JSON representation 
{
  "keyReference": string
}
Fields
keyReference

string

Required. The name of the key which is used to encrypt/decrypt customer data. For key in Cloud KMS, the key should be in the format of projects/*/locations/*/keyRings/*/cryptoKeys/*.

GitProxyConfig

JSON representation 
{
  "enabled": boolean,
  "httpProxyBaseUri": string
}
Fields
enabled

boolean

Optional. Setting this to true allows the Git proxy to be used for performing Git operations on the repositories linked in the connection.
httpProxyBaseUri

string

Output only. The base URI for the HTTP proxy endpoint. Has the format https://{generatedID}-c-h-{shortRegion}.developerconnect.dev Populated only when enabled is set to true. This endpoint is used by other Google services that integrate with Developer Connect.

GitHubApp

Represents the various GitHub Applications that can be installed to a GitHub user or organization and used with Developer Connect.

Enums
GIT_HUB_APP_UNSPECIFIED GitHub App not specified.
DEVELOPER_CONNECT The Developer Connect GitHub Application.
FIREBASE The Firebase GitHub Application.
GEMINI_CODE_ASSIST The Gemini Code Assist Application.
DATAFORM The Dataform GitHub Application.

Stage

Stage of the installation process.

Enums
STAGE_UNSPECIFIED No stage specified.
PENDING_CREATE_APP Only for GitHub Enterprise. An App creation has been requested. The user needs to confirm the creation in their GitHub enterprise host.
PENDING_USER_OAUTH User needs to authorize the GitHub (or Enterprise) App via OAuth.
PENDING_INSTALL_APP User needs to follow the link to install the GitHub (or Enterprise) App.
COMPLETE Installation process has been completed.

Output Schema

This resource represents a long-running operation that is the result of a network API call.

Operation

JSON representation 
{
  "name": string,
  "metadata": {
    "@type": string,
    field1: ...,
    ...
  },
  "done": boolean,

  // Union field result can be only one of the following:
  "error": {
    object (Status)
  },
  "response": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field result.
}
Fields
name

string

The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the name should be a resource name ending with operations/{unique_id}.
metadata

object

Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.
done

boolean

If the value is false, it means the operation is still in progress. If true, the operation is completed, and either error or response is available.
Union field result. The operation result, which can be either an error or a valid response. If done == false, neither error nor response is set. If done == true, exactly one of error or response can be set. Some services might not provide the result. result can be only one of the following:
error

object (Status)

The error result of the operation in case of failure or cancellation.
response

object

The normal, successful response of the operation. If the original method returns no data on success, such as Delete, the response is google.protobuf.Empty. If the original method is standard Get/Create/Update, the response should be the resource. For other methods, the response should have the type XxxResponse, where Xxx is the original method name. For example, if the original method name is TakeSnapshot(), the inferred response type is TakeSnapshotResponse.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Any

JSON representation 
{
  "typeUrl": string,
  "value": string
}
Fields
typeUrl

string

Identifies the type of the serialized Protobuf message with a URI reference consisting of a prefix ending in a slash and the fully-qualified type name.

Example: type.googleapis.com/google.protobuf.StringValue

This string must contain at least one / character, and the content after the last / must be the fully-qualified name of the type in canonical form, without a leading dot. Do not write a scheme on these URI references so that clients do not attempt to contact them.

The prefix is arbitrary and Protobuf implementations are expected to simply strip off everything up to and including the last / to identify the type. type.googleapis.com/ is a common default prefix that some legacy implementations require. This prefix does not indicate the origin of the type, and URIs containing it are not expected to respond to any requests.

All type URL strings must be legal URI references with the additional restriction (for the text format) that the content of the reference must consist only of alphanumeric characters, percent-encoded escapes, and characters in the following set (not including the outer backticks): /-.~_!$&()*+,;=. Despite our allowing percent encodings, implementations should not unescape them to prevent confusion with existing parsers. For example, type.googleapis.com%2FFoo should be rejected.

In the original design of Any, the possibility of launching a type resolution service at these type URLs was considered but Protobuf never implemented one and considers contacting these URLs to be problematic and a potential security issue. Do not attempt to contact type URLs.
value

string (bytes format)

Holds a Protobuf serialization of the type described by type_url.

A base64-encoded string.

Status

JSON representation 
{
  "code": integer,
  "message": string,
  "details": [
    {
      "@type": string,
      field1: ...,
      ...
    }
  ]
}
Fields
code

integer

The status code, which should be an enum value of google.rpc.Code.
message

string

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
details[]

object

A list of messages that carry the error details. There is a common set of message types for APIs to use.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌