Google Cloud API Gateway becomes an MCP server

Google Cloud API Gateway can now act as a remote MCP server in Public Preview. Instead of standing up a separate MCP server that reimplements the routing, authentication and quota logic a gateway already handles, teams annotate the OpenAPI spec they already deploy, and its existing REST operations become agent-ready MCP tools on a single endpoint. The stated benefit is no additional server to build, host or maintain.

What’s actually new

• One endpoint, one policy path. The gateway accepts MCP JSON-RPC requests, transcodes each tools/call into the corresponding REST request, and translates the response back. Because the request is indistinguishable from a normal REST call, existing JWT or API-key authentication, quota and logging keep working, and an operation draws on one quota allocation however it is invoked.
• Opt-in via the spec. Document-level x-google-api-management.mcp exposes a spec’s operations, and x-google-mcp-tool customizes or skips individual ones. OpenAPI 3.0.x or 3.1.x is required; 2.0 is not supported.
• Automatic discovery. Connect the gateway to API hub and the MCP server is published with MCP-specific metadata and appears in Agent Registry.
• A security detail worth reading before enabling it. By default tools/list is unauthenticated, which publishes tool names and input schemas to anyone who asks. Production deployments need a JWT, and API keys cannot secure that method.

Why it matters

This is consolidation rather than a new capability. The duplicated MCP server is exactly the kind of component teams end up maintaining twice, and folding it into an existing gateway means MCP and REST traffic cannot drift apart. The caveats are documented rather than hidden: operations returning empty bodies such as HTTP 204 are not exposed, deeply nested object schemas may not render fully in tools/list, a gateway serves up to 1,000 tools, and MCP and model routing cannot be enabled in the same config. MCP resources and prompts, response streaming and Model Armor payload inspection are on the roadmap.

(Original source: Google Developers Blog)