Custom MCP server connections have arrived in Gemini Enterprise – Business edition, and the practical meaning is blunt: a team administrator can now point Google’s assistant at systems Google has never heard of. Private databases. Internal ticketing. A pricing engine somebody wrote in 2014 that nobody dares replace. If it speaks the Model Context Protocol over HTTPS, it can become a tool inside Gemini.
The story surfaced on 5 September 2026, when Crypto Briefing reported that Google had extended Business edition to allow administrator-configured connections of exactly this kind. Google’s own documentation is the better read, and it is unusually specific about what it will and will not accept — down to the transport, the certificate authority, and the number of actions you are allowed to switch on at once.
That specificity is the reason this article exists. Plenty of coverage will tell you Google “added MCP support” and stop there. What matters to anyone actually running a Google Workspace estate is the shape of the requirements, because they are strict enough to disqualify a lot of existing internal tooling on day one. Self-signed certificates are out. Server-Sent Events transport is out. Anything that is not reachable from the public internet is out.
What follows is a documentation-first walkthrough, checked page by page on 6 September 2026: what Google shipped, the two different routes to configure it, every stated requirement and limit, the security exposure it creates, and where it sits against the rest of a market that has spent two years standardising on this protocol. If you already track our AI models and tools coverage, this is the enterprise-plumbing companion to it — less spectacle, more consequence. Where a claim comes from a news report rather than Google’s documentation, this article says so.
Table of contents
- What a Custom MCP Server Connection Actually Is
- The Custom MCP Server Requirements Google Will Not Bend On
- Setting Up a Custom MCP Server in Gemini Business
- The Google Cloud Route: Custom MCP Server Data Stores
- Custom MCP Server Limits, Quotas and the 100-Action Cap
- What a Custom MCP Server Exposes, and How to Contain It
- Where Gemini Business Sits Against the Rest of the MCP Market
- What UK Businesses Should Do About This Now
- Frequently Asked Questions
- References
What a Custom MCP Server Connection Actually Is
The Model Context Protocol is the reason this feature can exist at all. Anthropic published it in late 2024 as an open standard for connecting AI applications to external systems, and it has since become the default answer to a question every vendor was solving privately.
The protocol in one paragraph
MCP standardises how a model discovers and calls tools that live outside it. A server advertises what it can do; a client asks it to do one of those things; the results come back in a shape the model can reason over. The value is not technical elegance, it is arithmetic — one protocol replaces a matrix of bespoke integrations. Google’s Gemini Enterprise documentation describes MCP as “an open standard that enables AI models to securely use tools provided by remote servers,” which is about as plain as a specification gets.
What “custom” adds
Google already shipped managed MCP support. On 11 December 2025 it announced four fully managed, remote MCP servers — Google Maps, BigQuery, Compute Engine and Google Kubernetes Engine — alongside Apigee-based exposure of an organisation’s own APIs. Those are Google’s servers, running Google’s services. A custom MCP server connection is the inverse: your server, your endpoint, your data, registered into Gemini so that its tools appear alongside the built-in ones.
Why Business edition specifically matters
Business edition is the entry tier that most mid-sized organisations land on. Extending custom MCP server support down to it means the capability is no longer confined to the largest Google Cloud estates with a platform team attached. A team administrator working in a normal admin console can now do what previously implied a Google Cloud project, an IAM discussion, and a willing engineer.
The status caveat nobody should skip
Google’s Business edition help page labels the feature Pre-GA with limited support. That is not a footnote to wave past. Pre-GA means the interface, the field names and the behaviour can change, and it means support commitments are narrower than for a generally available product. Build a custom MCP server integration on it if the value is real, but do not put it on the critical path of anything that has to work at 3am.
The Custom MCP Server Requirements Google Will Not Bend On
This is the section that decides whether your existing internal tool qualifies. Google’s requirements are short, and every one of them is a hard gate rather than a recommendation.
StreamableHTTP transport only
The connector supports the Streamable HTTP transport exclusively. Google’s Cloud documentation is explicit: “The old SSE transport is not supported. The connector exclusively supports the new StreamableHTTP transport.” This tracks the protocol itself — the MCP specification replaced the HTTP+SSE transport from protocol version 2024-11-05 with Streamable HTTP, which serves a single endpoint path handling both POST and GET. If your custom MCP server was built in the first year of the protocol’s life, this is the requirement most likely to fail.
Publicly trusted TLS certificates, no exceptions
Both public and private MCP servers must present a TLS certificate signed by a publicly trusted certificate authority. Google states plainly that self-signed certificates are not supported. Internal certificate authorities — the kind almost every enterprise runs for internal services — do not qualify either, because the trust anchor has to be public.
A public internet endpoint
Your custom MCP server must be exposed to the public internet on a secure HTTPS endpoint to receive requests routed from Gemini. So must your identity provider, if you use OAuth. That is a genuine architectural demand: a tool sitting safely inside a private subnet has to be given a front door before Gemini can knock on it.
The URL shape
The MCP Server URL must be HTTPS, and Google’s example follows the protocol convention of ending the path with /mcp — https://mcp.example.com/mcp. Cloud Run deployments carry an extra rule: use the default service URL ending in .run.app so that automatic ID token authentication works.
| Requirement | What Google demands | Common reason it fails |
|---|---|---|
| Transport | StreamableHTTP only | Server built on the legacy SSE transport |
| Certificate | Signed by a publicly trusted CA | Internal CA or self-signed certificate |
| Reachability | Public internet HTTPS endpoint | Tool lives only on a private network |
| Identity provider | Accessible from the public internet | Internal-only SSO with no public endpoint |
| Authorization URL | Base URL only, no query parameters | Pasting a full URL copied from a browser |
| Enabled actions | 100 at a time, maximum | A large tool surface enabled wholesale |
Authentication: none or OAuth 2.0
Google documents two options. A custom MCP server with no authentication needs only the server URL. OAuth 2.0 needs an authorization URL, token URL, client ID, client secret and scopes, with optional PKCE support and optional authorization URL parameters. The “no authentication” option exists, is documented, and should be treated as a demonstration setting rather than a deployment one.
Setting Up a Custom MCP Server in Gemini Business
The Business edition path is the shorter of the two, and it is the one the news coverage is describing. Everything happens in the team administration interface.
Where the setting lives
The navigation is Settings & help → select your team → Manage team → Connected apps → Add MCP Server. Only a team administrator can do this. That is the entire access-control story at this tier, which is worth pausing on: the person who can add a custom MCP server connection is the same person who manages the team.
The MCP Info fields
Three fields describe the server itself — MCP Server URL, Name and Description. The name and description are not cosmetic. They are what the model reads when deciding whether this custom MCP server is relevant to a user’s request, so a vague description produces a tool that never gets called, and an over-broad one produces a tool that gets called constantly.
The Authentication Settings fields
For OAuth you supply an Authorization URL, a Token URL, an optional set of Authorization URL Parameters, a Client ID, a Client Secret, and Scopes as a space-separated list. Google notes that it appends the standard OAuth parameters — client_id, redirect_uri and scope — to the authorization URL itself, which is why the field must contain a base URL with no query string of its own.
Scopes are the real permission boundary
Google’s own wording is the clearest statement of the security model: scopes define “what actions Gemini Enterprise is allowed to perform on behalf of a user.” Not on behalf of the organisation. On behalf of the individual, using that individual’s granted permissions. Scope design is therefore the single highest-leverage decision in the whole configuration, and the temptation to request a broad scope because it makes testing easier is the mistake to avoid.
Disabled by default, and permanently deletable
Two behaviours worth knowing before you start. New custom MCP servers are disabled by default, so adding one does not expose it — someone still has to switch it on. And deletion is permanent, though nothing stops you reconfiguring the same server afterwards from scratch.
The Google Cloud Route: Custom MCP Server Data Stores
The second path registers the connection as a data store inside a Google Cloud project. It is more work, it demands more privilege, and it is the route the Standard and Plus editions and the Workspace connector codelabs assume.
The organisation policy you have to unblock first
Before anything else, an administrator has to override the organisation policy constraint that blocks custom MCP data store creation, and explicitly allow the fully qualified domain names for the MCP server URL, the authorization URL and the token URL. If project enforcement is on, or the project sits behind VPC Service Controls, custom_mcp also has to be added to the allowed data sources. Google is clear that this enforcement happens through organisation policy constraints rather than runtime traffic inspection.
The IAM roles involved
The person creating the data store needs Discovery Engine Editor (roles/discoveryengine.editor). If the custom MCP server runs on Cloud Run with authentication enabled, the Discovery Engine service agent — service-PROJECT_NUMBER@gcp-sa-discoveryengine.iam.gserviceaccount.com — needs Cloud Run Invoker (roles/run.invoker). Gemini Enterprise also has to be registered as an OAuth client application with your identity provider, with the authorization redirect URL set to https://vertexaisearch.cloud.google.com/oauth-redirect.
The creation sequence
From the Data stores page: create a data store, search for and select Custom MCP Server, choose the authentication method and supply credentials, click Verify Auth, continue, select a multi-region data connector location, name the store, and create it. Then watch the state until it reads Active. Nothing is callable before that point.
Enabling actions is a separate, deliberate step
Once the store is Active you click Reload custom actions, select the actions you want, and enable them. This is not automatic, and the separation is a feature: discovering what a custom MCP server can do is distinct from authorising Gemini to do it.
You cannot retrofit an existing data store
Google states that connecting to an existing data store is not supported — you must create and register a new custom MCP server data store. Anyone hoping to bolt this onto an existing search corpus should plan for a new object instead.
| Factor | Business edition (Connected apps) | Google Cloud (data store) |
|---|---|---|
| Who configures it | Team administrator | Discovery Engine Editor in a Cloud project |
| Prerequisite policy work | None documented | Org policy override plus FQDN allow-listing |
| Where it appears | Connected apps for the team | A data store in the project |
| Action management | Server disabled by default | Reload, select, then enable actions |
| VPC Service Controls | Not part of the flow | Supported via org policy constraints |
| Typical time to first call | Minutes, if the server already qualifies | Longer — policy and IAM sit in front of it |
Custom MCP Server Limits, Quotas and the 100-Action Cap
Every constraint below is published by Google, and together they define the realistic ceiling of a rollout.
The hundred-action rule
Google’s instruction is to limit the number of enabled actions in a custom MCP server data store to 100 at a time. That number sounds generous until you meet a mature internal API. It is also, read carefully, a governance instruction rather than a hard technical ceiling — which means the discipline of choosing which hundred actions matter is yours to impose.
Project-level ceilings
A Google Cloud project allows 100 data stores by default, with Google noting that a technical limitation puts the maximum quota at 500 per project. Engines are quota’d at 150 per project, again with a 500 technical maximum. Both are also counted per location across Global, US and EU. Regional document capacity is 10,000,000 documents per project per location.
Request rate
Query traffic is capped at 300 complete query requests per minute per project, with regional search requests capped at the same 300 per minute per project per location. For an assistant that fans out to a custom MCP server on many user turns, that is the number to model against, not the seat count.
Read the four published ceilings side by side and the shape of a sensible rollout becomes obvious — the action cap, not the platform, is what you will hit first.
What the edition tier constrains
Business edition supports 1 to 500 users and 25 GiB of pooled storage. Standard allows 1 or more users on 30 GiB, Plus on 75 GiB, Frontline requires a minimum of 150 users on 2 GiB, and Pay-as-you-go starts at a single seat with variable storage costs. Business, Standard and Plus are the three editions that reach the full data connector ecosystem; every other edition sees only what Google calls “select, segment-relevant connectors.”
A note on price
Google’s Cloud documentation covers the Standard, Plus, Pay-as-you-go and Frontline editions and points Business-edition readers at a separate Help Center instead, and it does not publish a Business rate card in the pages examined here. Per-seat figures circulate widely in comparison articles; treat them as unverified until you see them on a Google page or in a quote.
| Edition | Users | Pooled storage | Full connector ecosystem | Build no-code agents |
|---|---|---|---|---|
| Business | 1–500 | 25 GiB | Yes | Yes |
| Standard | 1+ | 30 GiB | Yes | Yes |
| Plus | 1+ | 75 GiB | Yes | Yes |
| Pay-as-you-go | 1 seat minimum | Variable cost | Select connectors | Use only |
| Frontline | 150+ minimum | 2 GiB | Select connectors | Use only |
What a Custom MCP Server Exposes, and How to Contain It
The uncomfortable truth of this feature is that its convenience and its risk are the same property. You are giving a language model a callable interface to a system that previously required a human and a login.
The public endpoint is the new attack surface
Requiring a public HTTPS endpoint means the custom MCP server itself becomes internet-facing infrastructure, and whoever owns cybersecurity in your organisation has to treat it as such: rate limiting, logging, WAF coverage, patching, the lot. The MCP specification’s own security guidance reinforces the point — servers must validate the Origin header on incoming connections to prevent DNS rebinding attacks, should bind only to localhost when running locally, and should implement proper authentication on all connections.
Prompt injection travels through tools
Once a model can call a tool, anything the model reads can try to influence what it calls. Google’s broader MCP work acknowledges this directly: its December 2025 managed-server announcement lists Model Armor as a defence against agentic threats including indirect prompt injection. Nothing equivalent is documented as automatic for a custom MCP server you register yourself, which means the input validation and output constraints on your own server are load-bearing.
Least privilege, expressed as scopes and actions
Two dials control blast radius, and both default to the safe position. Scopes limit what Gemini may do on a user’s behalf. The enabled-actions list limits which of the server’s tools are callable at all. A custom MCP server that publishes 60 tools but has 6 enabled is a much smaller problem than one where somebody clicked select-all. Approach it the way you would approach any managed IT services access review — start from nothing and justify each addition.
Auditability is not free at the Business tier
The Cloud route inherits Google Cloud IAM and audit logging. The Business edition path is a team-administration screen, so the governance evidence you can produce for an auditor is thinner. If your organisation has compliance obligations that require a record of who granted a system access to what, factor that difference into which route you take.
The credential you are storing
An OAuth client secret sits in that configuration form. Rotate it on the same schedule as any other production secret, and record where it lives, because a Pre-GA admin screen is not a secrets manager. Organisations that have already tightened enterprise-managed authentication for MCP connectors elsewhere in their stack will recognise the pattern.
Where Gemini Business Sits Against the Rest of the MCP Market
Two years after the protocol’s publication, supporting MCP is no longer a differentiator. What differentiates vendors now is how much governance they wrap around it.
Google’s managed servers versus your own
Google’s December 2025 launch put four fully managed remote servers into the market — Maps, BigQuery, Compute Engine and GKE — with IAM, audit logging, Model Armor and a Cloud API Registry around them. Anthropic’s David Soria Parra, a co-creator of the protocol, was quoted in that announcement saying Google’s breadth of support “will help more developers build agentic AI applications.” The custom route trades that managed safety net for reach into systems Google will never build a connector for.
The Workspace connector path
There is a middle option worth knowing about. Google publishes a codelab for connecting Gemini Enterprise apps to Google Workspace through MCP without writing code, covering Gmail, Drive, Docs, Sheets, Slides, Calendar, Chat and the People API across eight distinct MCP server endpoints. It targets Standard and Plus editions in a Cloud project and requires Developer Preview Program enrolment plus the Organization Policy Administrator role, so it is not a Business-edition shortcut — but it shows the direction of travel.
Cluster context
This lands in the middle of a busy few weeks for Google. It has been prototyping Rooms for Gemini Enterprise with goals and playbooks, and separately testing desktop-side integrations including Obsidian connections and Finder support. Read together, the pattern is a company assembling both ends of the same story — a place for work to happen, and pipes into everything that work touches. Cloud computing platforms have been converging on that shape for a while; MCP is what finally made the pipes interchangeable.
The honest competitive read
Nothing here is technically novel. Every major assistant vendor now accepts a remote MCP endpoint. What Google has done is push the capability down a tier, into the hands of administrators who do not have a Cloud project to work in — and it has done so while keeping requirements strict enough that a badly built server cannot quietly connect.
What UK Businesses Should Do About This Now
The gap between “this is available” and “this is safe to use” is where most organisations lose time. Here is how to close it deliberately.
Audit what would actually qualify
Before designing anything, take the list of internal systems you would want a custom MCP server to reach and test them against the four hard gates: Streamable HTTP transport, publicly trusted certificate, public HTTPS endpoint, publicly reachable identity provider. In most estates that list shortens dramatically, and knowing which systems survive is worth more than a proof of concept.
Pick the route before you pick the tool
The Business edition console and the Cloud data store are not two ways to do the same job — they carry different privilege models, different governance evidence, and different setup effort. Choose based on your audit obligations, not on which screen you happened to open first.
Start with read-only actions
The first custom MCP server you connect should be able to look things up and nothing else. Read-only tools produce most of the demonstrable value with almost none of the risk, and they let you observe how often the model actually reaches for the tool before you let it change anything.
Write the scope decision down
Because scopes govern what Gemini may do on behalf of each user, the reasoning behind each requested scope belongs in a document somebody can review. This is standard practice in a mature AI strategy and it costs an hour now against a difficult conversation later.
Treat Pre-GA as Pre-GA
Pilot it, budget for the interface changing, and keep a manual fallback for anything the business depends on. A custom MCP server connection that disappears during a Pre-GA iteration should be an inconvenience, not an incident.
Frequently Asked Questions
Does this need a Google Cloud project?
Not on the Business edition path — a team administrator configures a custom MCP server under Connected apps in the team management screens. The data store route does need a Cloud project, along with an organisation policy override and the Discovery Engine Editor role.
Can I connect a server that only runs on our internal network?
No. Google requires the MCP server to be exposed to the public internet on a secure HTTPS endpoint, and requires the identity provider to be publicly accessible too. A private-network-only tool has to be fronted before it can be registered.
Will a certificate from our internal CA work?
No. Google requires a TLS certificate signed by a publicly trusted certificate authority for both public and private MCP servers, and states that self-signed certificates are not supported.
How many tools can one custom MCP server expose?
The server can publish as many as it likes, but Google instructs you to limit enabled actions to 100 at a time in a custom MCP server data store. Enabling actions is a separate step after the store reaches the Active state.
Is anything switched on automatically when I add a server?
No. Custom MCP servers are disabled by default, and on the Cloud path actions have to be reloaded, selected and explicitly enabled. Both defaults are deliberately closed.
What happens if I delete the connection?
Deletion is permanent. You can reconfigure the same custom MCP server afterwards, but you will be entering the configuration again from the beginning rather than restoring it.
Is the feature generally available?
Not yet. Google’s Business edition help page marks it Pre-GA with limited support, so treat field names, behaviour and support expectations as subject to change.
References
Set up your custom MCP server connection — Gemini Enterprise – Business Edition Help
Set up your custom MCP server data store — Gemini Enterprise, Google Cloud Documentation
Compare editions of Gemini Enterprise — Google Cloud Documentation
Quotas and system limits — Gemini Enterprise, Google Cloud Documentation
Google Workspace MCP server connectors in Gemini Enterprise apps — Google Codelabs
Announcing official MCP support for Google services — Google Cloud Blog
Transports — Model Context Protocol Specification
Google’s Gemini Business adds support for custom MCP server connections — Crypto Briefing
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.