Prevent read-write MCP tool use

Because LLMs and AI agents are by their nature dynamic, AI application responses and actions for the same prompt can vary each time you send it. If you or an MCP server provider add tools or functionality, the agent's behavior can change significantly.

Model Context Protocol (MCP) tools can modify or delete resources that they access on your behalf. When you're using MCP tools through your AI application, protect important resources by preventing MCP tools from changing them.

To prevent unintended or unauthorized changes by MCP tools to production resources, use a deny policy and Identity and Access Management (IAM) attributes. These attributes control which agent identities and tool types can access a resource. You can create deny policies at the Google Cloud organization, folder, or project level. This document describes using IAM attributes to control MCP tool use.

Control MCP use with IAM attributes

To support fine-grained authorization and enhanced security controls for MCP servers using Identity and Access Management deny policies, use the following attributes:

  • tool.isReadOnly: a resource attribute indicating the invoked tool only reads data if set to true.
  • OAuthClientID: the client ID used for the tool call.

These attributes are only supported in IAM deny policies and can't be combined with other permissions in IAM deny policies. IAM allow policies don't support these attributes.

The following IAM deny policy prevents use of any tool that isn't read-only. Tools that create, modify, or delete resources aren't permitted.

{
  "rules": [
    {
      "denyRule": {
        "deniedPrincipals": [
          "principalSet://goog/public:all"
        ],
        "deniedPermissions": [
          "mcp.googleapis.com/tools.call"
        ],
        "denialCondition": {
          "title":  "Deny read-write tools",
          "expression": "api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false",
        }
      }
    }
  ]
}

To apply this policy to a Google Cloud project, add it to a file named policy.json, and then run the following command:

gcloud iam policies create deny-read-write-tool-access-policy \
  --attachment-point=cloudresourcemanager.googleapis.com/projects/PROJECT_ID \
  --kind=denypolicies \
  --policy-file=policy.json

If an MCP client makes a tool call to a tool that isn't annotated as read-only, then the request fails and an HTTP client error is returned. For information on how to attach a deny policy to an organization or folder, see Attachment point.

For more information, see Deny policies.

What's next