Model Armor integration with Google Cloud MCP servers

This document shows you how to configure Model Armor to help protect your data and secure content when sending requests to Google Cloud services that expose Model Context Protocol (MCP) tools and servers.

Model Armor helps secure your agentic AI applications by sanitizing MCP tool calls and responses. This process mitigates risks such as prompt injection and sensitive data disclosure.

Before you begin

Enable the MCP servers that you want to use. For more information, see Enable or disable MCP servers.
Enable the Model Armor API in your project. For more information, see Enable APIs.
If you have data residency requirements, you must configure a log sink to route logs to a compliant storage location before you enable Cloud Logging in the next procedure. Configuring a log sink helps ensure that Model Armor logs are stored in the appropriate regional buckets. For more information, see Regionalize your logs.

Configure protection for Google and Google Cloud remote MCP servers

To protect your MCP tool calls and responses, you create a Model Armor floor setting and then enable MCP content security for your project. A floor setting defines the minimum security filters that apply across the project. This configuration applies a consistent set of filters to all MCP tool calls and responses within the project.

Set up a Model Armor floor setting with MCP sanitization enabled. For more information, see Configure Model Armor floor settings.

Note: If the agent and the MCP server are in different projects, you can create floor settings in both projects (the client project and the resource project). In this case, Model Armor is invoked twice, once for each project.

See the following example command:
```
gcloud model-armor floorsettings update \
--full-uri='projects/PROJECT_ID/locations/global/floorSetting' \
--enable-floor-setting-enforcement=TRUE \
--add-integrated-services=GOOGLE_MCP_SERVER \
--google-mcp-server-enforcement-type=INSPECT_AND_BLOCK \
--enable-google-mcp-server-cloud-logging \
--malicious-uri-filter-settings-enforcement=ENABLED \
--add-rai-settings-filters='[{"confidenceLevel": "HIGH", "filterType": "DANGEROUS"}]'
```
Replace PROJECT_ID with your Google Cloud project ID.

Note the following settings:
- INSPECT_AND_BLOCK: The enforcement type that inspects content for the Google MCP server and blocks prompts and responses that match the filters.
- ENABLED: The setting that enables a filter or enforcement.
- HIGH: The confidence level for the Responsible AI - Dangerous filter settings. You can modify this setting, though lower values might result in more false positives. For more information, see Configure floor settings.
For your project, enable Model Armor protection for remote MCP servers.
```
gcloud beta services mcp content-security add modelarmor.googleapis.com --project=PROJECT_ID
```
Replace PROJECT_ID with your Google Cloud project ID. After you run this command, Model Armor sanitizes all MCP tool calls and responses from the project, regardless of where the calls and responses originate.
To confirm that Google MCP traffic is sent to Model Armor, run the following command:
```
gcloud beta services mcp content-security get --project=PROJECT_ID
```
Replace PROJECT_ID with the Google Cloud project ID.

Disable Model Armor in a project

To disable Model Armor on a Google Cloud project, run the following command:

gcloud beta services mcp content-security remove modelarmor.googleapis.com \
    --project=PROJECT_ID

Replace PROJECT_ID with the Google Cloud project ID.

Google MCP traffic won't be scanned by Model Armor for the specified project.

Disable scanning MCP traffic with Model Armor

If you want to use Model Armor in a project, and you want to stop scanning Google MCP traffic with Model Armor, run the following command:

gcloud model-armor floorsettings update \
  --full-uri='projects/PROJECT_ID/locations/global/floorSetting' \
  --remove-integrated-services=GOOGLE_MCP_SERVER