Google explains MCP Apps deployment in Gemini Enterprise

What changed

Cloud Run IAM controls service access; application OAuth identifies users. Both are required.

Source: Google Cloud MCP Apps implementation guide

Our analysis

Builder’s view: start with a read-only workflow. Before enabling write tools, check that the backend rejects an unauthorized user even when the interface displays an approval control.

Keep in mind

Imported actions start disabled and require explicit enablement.

Source: Google Cloud MCP Apps implementation guide