MCP Tools Reference

Complete reference for all 74 Cloud Guardian MCP tools. Auto-generated from the MCP server source code.

Regenerate with: npx tsx scripts/generate-mcp-docs.ts

Auth

cg_login

Sign in to Cloud Guardian via Google OAuth. Opens browser for authentication.

cg_whoami

Show current authenticated user info: email, UID, and org memberships.

Organizations

cg_list_organizations

List all organizations the current user belongs to, with member counts.

cg_create_organization

Create a new organization. Caller becomes the owner.

ParameterTypeRequiredDescription
namestringyesOrganization name

cg_delete_organization

Delete an organization and all its data (projects, members, invitations). Requires owner or admin role.

ParameterTypeRequiredDescription
org_idstringyesOrganization ID to delete

cg_get_organization

Get organization details by ID.

ParameterTypeRequiredDescription
org_idstringyesOrganization ID

Members

cg_list_members

List org members with roles and pending invitations.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_invite_member

Invite a user to the organization by email with a specified role.

ParameterTypeRequiredDescription
emailstringyesEmail address to invite
rolestringnoRole: viewer (default), member, admin, owner
org_idstringnoOrganization ID (uses default org if not specified)

cg_update_member_role

Change a member's role in the organization.

ParameterTypeRequiredDescription
membership_idstringyesMembership ID (from cg_list_members)
rolestringyesNew role: viewer, member, admin, owner
org_idstringnoOrganization ID (uses default org if not specified)

cg_remove_member

Remove a member from the organization.

ParameterTypeRequiredDescription
membership_idstringyesMembership ID to remove
org_idstringnoOrganization ID (uses default org if not specified)

Projects & Connectors

cg_get_project_status

Get project status summary for the current org. Optionally filter by GCP project ID.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
gcp_project_idstringnoOptional GCP project ID filter

cg_list_connectors

List all connectors (GCP service account connections) with their status.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_test_connector

Test a connector's connectivity and return verified permissions.

ParameterTypeRequiredDescription
connector_idstringyesConnector ID to test
org_idstringnoOrganization ID (uses default org if not specified)

cg_onboard_gcp_project

Fully automate GCP project onboarding: create service account, grant roles, generate key, create connector, test connectivity, and link to org. Requires gcloud CLI.

ParameterTypeRequiredDescription
gcp_project_idstringyesGCP project ID to onboard
org_idstringyesOrganization ID to link the project to
display_namestringnoDisplay name for the project (defaults to project ID)
gcloud_accountstringnogcloud account to use (for --account flag). Omit to use default.
remediation_scopesstringnoComma-separated remediation scopes to enable. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup, billing:alerts
auto_remediation_scopesstringnoComma-separated scopes that auto-execute after each scan cycle. Must be a subset of remediation_scopes.

cg_create_connector

Create a new GCP connector with service account credentials.

ParameterTypeRequiredDescription
namestringyesDisplay name for the connector
project_idstringyesGCP project ID
regionstringnoGCP region
credentials_blobstringnoRaw service account key JSON
remediation_scopesstringnoComma-separated scopes. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup
auto_remediation_scopesstringnoComma-separated auto-execute scopes (subset of remediation_scopes)
org_idstringnoOrganization ID (uses default org if not specified)

cg_delete_connector

Delete a connector and its stored credentials.

ParameterTypeRequiredDescription
connector_idstringyesConnector ID to delete
org_idstringnoOrganization ID (uses default org if not specified)

cg_clone_credentials

Clone encrypted credentials from one connector to another without decrypting.

ParameterTypeRequiredDescription
source_connector_idstringyesSource connector ID
target_connector_idstringyesTarget connector ID
org_idstringnoOrganization ID (uses default org if not specified)

cg_list_org_projects

List all org projects with their IDs, GCP project mappings, GitHub repos, and auto-remediation scopes.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_update_org_project

Update an org project's settings: display name, auto-remediation scopes, GitHub repo, or connector.

ParameterTypeRequiredDescription
idstringyesOrg project ID (use cg_list_org_projects to find it)
auto_remediation_scopesstringnoComma-separated scopes to enable. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup
display_namestringnoNew display name
github_repostringnoGitHub repo in owner/repo format
connector_idstringnoConnector ID to associate
org_idstringnoOrganization ID (uses default org if not specified)

Infrastructure

cg_get_infrastructure_status

Full infrastructure scan: Cloud Run services, Secrets Manager, Artifact Registry, costs, and violations.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_list_guardian_rules

List all enforcement rules configured for the organization.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_create_guardian_rule

Create a CEL enforcement rule for automated policy checks.

ParameterTypeRequiredDescription
namestringyesRule name
match_expressionstringyesCEL expression to evaluate
descriptionstringnoRule description
resource_typestringnoResource type: cloud_run, artifact_registry, secret_manager
action_typestringnoAction to take on match: alert, remediate
severitystringnoRule severity: critical, high, medium, low
schedulestringnoCron schedule for rule evaluation
org_idstringnoOrganization ID (uses default org if not specified)

cg_update_guardian_rule

Update a guardian rule's expression, severity, or settings.

ParameterTypeRequiredDescription
rule_idstringyesGuardian rule ID to update
namestringnoNew rule name
descriptionstringnoNew description
match_expressionstringnoNew CEL expression
action_typestringnoNew action type
severitystringnoNew severity
enabledstringnoSet to 'true' or 'false'
schedulestringnoNew cron schedule
org_idstringnoOrganization ID (uses default org if not specified)

cg_delete_guardian_rule

Delete a guardian enforcement rule.

ParameterTypeRequiredDescription
rule_idstringyesGuardian rule ID to delete
org_idstringnoOrganization ID (uses default org if not specified)

cg_validate_rule_expression

Validate a CEL rule expression without creating a rule. Checks syntax and returns parsed representation.

ParameterTypeRequiredDescription
expressionstringyesCEL expression to validate
resource_typestringnoResource type context for validation
org_idstringnoOrganization ID (uses default org if not specified)

cg_get_cost_trend

Get cost trend data for monitored projects.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
projectstringnoOptional GCP project ID to filter by
daysnumbernoNumber of days of history (default 30)

cg_get_resource_cost_history

Get per-resource cost and utilization history over time. Shows CPU, memory, requests, and instance metrics alongside cost.

ParameterTypeRequiredDescription
resource_namestringyesName of the resource (e.g., Cloud Run service name)
projectstringnoOptional GCP project ID filter
snapshot_typestringnoFilter by type: cloud_run, secret_manager, artifact_registry
org_idstringnoOrganization ID (uses default org if not specified)
daysnumbernoNumber of days of history (default 30)

cg_get_cost_breakdown

Get a ranked breakdown of all resources by cost, with change percentages and utilization metrics. Great for finding the most expensive or over-provisioned resources.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
projectstringnoOptional GCP project ID filter
snapshot_typestringnoFilter by type: cloud_run, secret_manager, artifact_registry
sort_bystringnoSort by: cost (default), cost_change
daysnumbernoComparison window in days (default 30)
top_nnumbernoNumber of top resources to return (default 20, max 100)

cg_list_service_metrics

Get per-service utilization metrics over time: CPU, memory, request count, RPS, active/idle instances, and cost. Use for traffic pattern analysis and identifying idle or over-utilized services.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
service_namestringnoFilter to a specific Cloud Run service name
projectstringnoFilter to a specific GCP project
daysnumbernoLookback window in days (default 7)

cg_get_service_metrics_summary

Get the latest utilization snapshot for all Cloud Run services: CPU, memory, requests, instance counts, and costs. Best for a quick overview of service health.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_get_savings_summary

Get verified savings summary: estimated vs actual savings from completed remediations.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
projectstringnoOptional GCP project ID filter
daysnumbernoLookback window in days (default 90)

Checks

cg_list_checks

List all available checks with their thresholds, categories, and override status.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
resource_typestringnoFilter by resource type: cloud_run, artifact_registry, secret_manager
categorystringnoFilter by category: cost_optimization, cleanup, security

cg_update_check_override

Customize a check's threshold, severity, or enabled status for your org.

ParameterTypeRequiredDescription
check_idstringyesCheck ID to override (from cg_list_checks)
enabledstringnoSet to 'true' or 'false'
severitystringnoCustom severity: critical, high, medium, low
org_idstringnoOrganization ID (uses default org if not specified)
thresholdnumbernoCustom threshold value

cg_delete_check_override

Reset a check to its default threshold and settings.

ParameterTypeRequiredDescription
check_idstringyesCheck ID to reset
org_idstringnoOrganization ID (uses default org if not specified)

Operations

cg_trigger_scan

Trigger an immediate infrastructure scan across all connected projects. Refreshes cached data used by GetInfrastructureStatus.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_update_connector

Update a connector's settings: name, region, remediation scopes, or auto-remediation scopes.

ParameterTypeRequiredDescription
connector_idstringyesConnector ID to update
namestringnoNew display name
regionstringnoGCP region
remediation_scopesstringnoComma-separated scopes. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup
auto_remediation_scopesstringnoComma-separated scopes that auto-execute after each scan. Must be subset of remediation_scopes.
org_idstringnoOrganization ID (uses default org if not specified)

cg_get_operational_health

Get platform operational health: last scan cycle, connector health, alert/remediation stats, and cost summary.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_list_scan_logs

List scan cycle history with per-project drill-down results.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
limitnumbernoNumber of scan cycles to return (default 10)

cg_auto_discover_projects

Discover unlinked GCP projects accessible by a connector's service account.

ParameterTypeRequiredDescription
connector_idstringyesConnector whose credentials to use for discovery
org_idstringnoOrganization ID (uses default org if not specified)

cg_system_diagnostics

Get system diagnostics: connectivity status for Firestore, KMS, email, GitHub, Firebase Auth, Vertex AI, and scanner health.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_send_test_email

Send a test email to the currently logged-in user to verify email delivery.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_send_test_daily_report

Send a test daily cost report email to the currently logged-in user. Shows the full daily cost summary with trends, top resources, alerts, and savings.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

Remediation

cg_plan_remediation

Scan infrastructure for violations and create pending remediation actions based on enabled scopes. Shows estimated savings.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
gcp_project_idstringnoOptional GCP project ID to filter by
resource_namestringnoOptional resource name to filter to a single resource

cg_execute_remediation

Execute a specific pending remediation action. Use dry_run=true to validate without executing.

ParameterTypeRequiredDescription
action_idstringyesRemediation action ID to execute
dry_runstringnoSet to 'true' to validate without executing
force_directstringnoSet to 'true' to bypass github_pr mode and execute directly via GCP APIs
org_idstringnoOrganization ID (uses default org if not specified)

cg_batch_execute_remediation

Execute multiple pending remediation actions in one call. Returns per-action results.

ParameterTypeRequiredDescription
action_idsstringyesComma-separated action IDs to execute
dry_runstringnoSet to 'true' to validate without executing
force_directstringnoSet to 'true' to bypass github_pr mode and execute directly via GCP APIs
org_idstringnoOrganization ID (uses default org if not specified)

cg_delete_remediation_action

Delete a pending remediation action. Only pending actions can be deleted.

ParameterTypeRequiredDescription
action_idstringyesRemediation action ID to delete
org_idstringnoOrganization ID (uses default org if not specified)

cg_list_remediation_actions

List remediation actions with their status. Filter by project or status.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
gcp_project_idstringnoOptional GCP project ID to filter by
statusstringnoFilter by status: pending, executing, completed, failed

Alerts

cg_list_cost_alerts

List cost alerts with spend spikes, idle resources, and recommendations.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
statusstringnoFilter: active, acknowledged, resolved
severitystringnoFilter: critical, high, medium, low

cg_acknowledge_cost_alert

Acknowledge a cost alert to mark it as reviewed.

ParameterTypeRequiredDescription
alert_idstringyesCost alert ID to acknowledge
org_idstringnoOrganization ID (uses default org if not specified)

cg_get_cost_alert_counts

Get quick counts of active and acknowledged cost alerts.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

API Keys

cg_create_api_key

Create a programmatic API key. Returns the raw key (shown only once).

ParameterTypeRequiredDescription
namestringyesName for the API key
rolestringnoRole: viewer, member, admin (default: viewer). Capped at your role level.
org_idstringnoOrganization ID (uses default org if not specified)
expires_in_daysnumbernoDays until expiry (0 = no expiry)

cg_list_api_keys

List all API keys for the current user.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_revoke_api_key

Revoke (delete) an API key.

ParameterTypeRequiredDescription
key_idstringyesAPI key ID to revoke
org_idstringnoOrganization ID (uses default org if not specified)

Webhooks

cg_list_webhook_endpoints

List webhook endpoints for an organization. Shows URL, event subscriptions, status, and failure count.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_create_webhook_endpoint

Create a webhook endpoint. Returns a signing secret (HMAC-SHA256) for verifying payloads. Save it immediately — it cannot be retrieved later.

ParameterTypeRequiredDescription
urlstringyesWebhook URL to POST events to
descriptionstringnoHuman-readable description
event_typesstringnoComma-separated event types: scan.completed, alert.created, remediation.completed, etc. Empty = all events
org_idstringnoOrganization ID (uses default org if not specified)

cg_update_webhook_endpoint

Update a webhook endpoint's URL, description, event types, or enabled status.

ParameterTypeRequiredDescription
idstringyesWebhook endpoint ID
urlstringnoNew webhook URL
descriptionstringnoNew description
event_typesstringnoComma-separated event types to subscribe to
enabledstringnotrue or false
org_idstringnoOrganization ID (uses default org if not specified)

cg_delete_webhook_endpoint

Delete a webhook endpoint and all its delivery history.

ParameterTypeRequiredDescription
idstringyesWebhook endpoint ID
org_idstringnoOrganization ID (uses default org if not specified)

cg_list_webhook_deliveries

List recent delivery attempts for a webhook endpoint. Shows status, HTTP code, duration, and errors.

ParameterTypeRequiredDescription
endpoint_idstringyesWebhook endpoint ID
org_idstringnoOrganization ID (uses default org if not specified)

cg_test_webhook_endpoint

Send a test event to a webhook endpoint to verify connectivity.

ParameterTypeRequiredDescription
idstringyesWebhook endpoint ID
org_idstringnoOrganization ID (uses default org if not specified)

Teams

cg_list_teams

List all teams in an organization with their allocation rules.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_create_team

Create a new team for cost allocation. Add allocation rules to match resources.

ParameterTypeRequiredDescription
namestringyesTeam name
descriptionstringnoTeam description
colorstringnoHex color for display (e.g. #3b82f6)
org_idstringnoOrganization ID (uses default org if not specified)

cg_update_team

Update a team's name, description, color, or allocation rules.

ParameterTypeRequiredDescription
idstringyesTeam ID
namestringnoNew team name
descriptionstringnoNew description
colorstringnoNew hex color
org_idstringnoOrganization ID (uses default org if not specified)

cg_delete_team

Delete a team. Cost allocations will become unallocated.

ParameterTypeRequiredDescription
idstringyesTeam ID
org_idstringnoOrganization ID (uses default org if not specified)

cg_get_team_cost_report

Get cost attribution report showing how costs are distributed across teams.

ParameterTypeRequiredDescription
team_idstringnoFilter to a specific team (optional)
org_idstringnoOrganization ID (uses default org if not specified)
daysnumbernoLookback period in days (default 30)

cg_export_team_cost_csv

Export team cost allocation as CSV for finance teams.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
daysnumbernoLookback period in days (default 30)

Billing

cg_setup_billing_budget

Create a GCP billing budget with automated Pub/Sub alerts forwarded to Cloud Guardian.

ParameterTypeRequiredDescription
org_idstringyesOrganization ID
gcp_project_idstringyesGCP project ID to monitor
billing_account_idstringyesGCP billing account ID (e.g. XXXXXX-XXXXXX-XXXXXX or billingAccounts/XXXXXX-XXXXXX-XXXXXX)
currency_codestringnoBudget currency — MUST match billing account currency (e.g. USD, AUD). Run 'gcloud billing accounts describe BILLING_ACCOUNT_ID' to check.
display_namestringnoBudget display name (default: 'Cloud Guardian - <project>')
thresholdsstringnoComma-separated threshold percents as decimals (default: 0.5,0.8,1.0)
amount_centsnumbernoMonthly budget in cents (default 10000 = $100)

cg_list_billing_budgets

List all GCP billing budgets managed by Cloud Guardian for an organization.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_delete_billing_budget

Delete a billing budget. Removes the GCP budget, Pub/Sub topic, and push subscription.

ParameterTypeRequiredDescription
idstringyesBilling budget ID
org_idstringnoOrganization ID (uses default org if not specified)

cg_list_billing_webhook_events

List recent billing webhook events received from GCP Pub/Sub. Shows processed, unmatched, and error events for debugging the billing alert pipeline.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
limitnumbernoMax events to return (default 20)

cg_send_test_billing_webhook

Send a mock GCP Pub/Sub billing alert to the webhook endpoint for testing. Simulates a budget threshold exceeded notification.

ParameterTypeRequiredDescription
budget_idstringnoBudget ID to simulate (default: test-budget-001)
budget_namestringnoBudget display name (default: Cloud Guardian Test Budget)
thresholdnumbernoThreshold exceeded as decimal (default: 0.5 = 50%)
cost_amountnumbernoCurrent cost in dollars (default: 50.0)
budget_amountnumbernoBudget amount in dollars (default: 100.0)

cg_setup_billing_export

Set up BigQuery billing export for actual GCP cost tracking. Creates/verifies BQ dataset, detects export table, grants IAM, and runs test query — fully managed one-click setup.

ParameterTypeRequiredDescription
connector_idstringyesConnector ID with GCP credentials (SA needs BigQuery Data Viewer on the dataset)
bq_project_idstringyesGCP project ID where the BQ billing export dataset lives
billing_account_idstringyesGCP billing account ID (e.g. 01ABCD-234567-89EFGH)
org_idstringnoOrganization ID (uses default org if not specified)
dataset_idstringnoBQ dataset ID (default: cloud_billing_export)

cg_bq_export_status

Check the status of BigQuery billing export configuration for an organization.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)

cg_query_actual_costs

Query actual GCP costs from BigQuery billing export data. Returns cached cost data by service and project. Use 'date' for single-day detail or 'days' for multi-day trend.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID (uses default org if not specified)
datestringnoSpecific date to query (YYYY-MM-DD format)
daysstringnoNumber of days to query (default: 7, max: 90)

Demo

cg_seed_demo_data

Populate an organization with realistic fake GCP projects, resource snapshots, cost history, teams, alerts, and remediation actions for demo/testing.

ParameterTypeRequiredDescription
org_idstringnoOrganization ID to seed (uses default org if not specified)
project_countnumbernoNumber of fake projects (1-4, default 3)
cost_history_daysnumbernoDays of cost history to generate (default 30)