Connect Gemini Enterprise to Agent Authority
Add SecureAuth Agent Authority to Google's Gemini Enterprise as a Custom MCP Server so every tool call is audited
When you finish, every MCP tool call Gemini Enterprise makes is checked against your policies and recorded in the audit log. Google's Gemini Enterprise reaches your approved tools through SecureAuth Agent Authority, added as a data store in the Google Cloud console, and each user signs in as themselves.
Before you start
Unlike the coding agents, Gemini Enterprise's Custom MCP Server connector supports neither Dynamic Client Registration nor OAuth discovery, so it can't self-register on first connect. Instead, you create an OAuth client in Agent Authority and paste its values into the Google Cloud console, so keep both tabs open. The gateway registers the client for you and shows the client secret only once.
Create the OAuth client
-
Open the connect flow. In Agent Authority, go to Agents & NHIs, click Connect, then choose Gemini Enterprise.
-
Name it and create. Enter a name for the connection and click Create client. The redirect URI is fixed by Google (
https://vertexaisearch.cloud.google.com/oauth-redirect) and can't be changed. The gateway registers the OAuth client and reveals its credentials. -
Copy the values now. Copy each field before you leave the page; the client secret is shown only once. If you lose it, delete the agent and reconnect to issue a new client.
Paste into Google Cloud
In the Google Cloud console, go to Gemini Enterprise → Data stores → Create data store, choose Custom MCP Server, and click Add MCP server. Copy each value from Agent Authority into the matching field, in order:
| Connector field | Value from Agent Authority |
|---|---|
| MCP Server URL | the MCP Server URL |
| Authorization URL | the Authorization URL |
| Authorization URL Parameters | &access_type=offline&prompt=consent (for refresh tokens) |
| Token URL | the Token URL |
| Client ID / Client Secret | the generated credentials |
| Scopes | the listed scopes |
The connector requires an HTTPS URL and the StreamableHTTP transport. Leave Enable PKCE off: the gateway issues a client secret.
Authorize and enable tools
- Click Verify Auth and sign in through SecureAuth to authorize the connection.
- Once the data store shows Active, open Actions → Reload custom actions, pick the tools to expose, and click Enable actions.
On first use, Gemini Enterprise signs the user in through SecureAuth; the agent then appears in your Agent Instances list.
Connecting to just one MCP? To stay under an agent's tool limit, point the URL at a single MCP —
/gateway/mcp/{slug}instead of/gateway/mcp. Grab the exact URL from the resource's detail page; see Scope a connection.
Next steps
- Create a policy – control which tools Gemini Enterprise can call.
- Monitor activity – watch its tool calls appear in the dashboard and audit log.