{"slug": "developers-guide-to-implementing-mcp-apps-in-gemini", "title": "Developer’s guide to implementing MCP apps in Gemini", "summary": "Google published a developer guide for building MCP Apps (SEP-1865) in Gemini Enterprise, an open Model Context Protocol extension that pairs a tool with a live UI rendered in a sandboxed iframe inside the chat flow. The guide describes a three-tier architecture — the client browser, Gemini Enterprise (Default Assistant, AppBridge proxy, OAuth connector), and the developer's MCP server hosted on a private Cloud Run service exposing a single JSON-RPC endpoint at /mcp — with two required auth layers: Cloud Run IAM returning HTTP 403 for unauthorized service callers and in-app OAuth 2.0 returning HTTP 401 for failed user verification. Google says the approach lets adjustments happen in the widget without a model turn while the assistant stays in sync, with automatic text fallback and portability across compatible hosts.", "body_md": "Enterprise assistants still respond mostly in text. However, that can break down for visual, multi-step work, where every adjustment costs another slow chat turn.\n\n[MCP Apps](https://github.com/modelcontextprotocol/ext-apps) (SEP-1865) solves this. This open Model Context Protocol (MCP) extension pairs a tool with a live UI. In [Gemini Enterprise](https://business.gemini.google/?utm_source=cloud.google.com/blog), that UI renders directly in the chat flow inside a sandboxed iframe, and can expand to fullscreen or a side panel. Edits run locally while the workspace and assistant stay synchronized.\n\nYou also avoid rebuilding core foundations: Gemini provides workforce sign-in, governed data access, and the Default Assistant, while you host your MCP server on a private [Cloud Run](https://cloud.google.com/run) service.\n\nEnterprise assistants have evolved through three generations:\n\n**Generation 1 (Text chatbots):** Returns static markdown with no interactive controls.\n\n**Generation 2 (Standard MCP tools):** Invokes live APIs, but outputs static text. Every change requires another model turn.\n\n**Generation 3 (Interactive MCP Apps):** Pairs each tool with a live workspace. Adjustments happen in the widget without a model turn, while the assistant stays in sync.\n\n**Responsive user experience:** Single-click actions execute directly in the panel without round-tripping through the chat.\n\n**Purpose-built workflows:** Deliver visual redaction views for legal review, 3D viewers for CAD, or sensitivity models for finance.\n\n**Enterprise security:** Workforce OAuth sign-in, private Cloud Run ingress, and a sandboxed iframe protect every layer.\n\n**Human-in-the-loop governance:** Experts inspect and approve high-stakes actions before execution.\n\n**Open standard:** Portable across compatible hosts, with automatic text fallback.\n\n**Broad connectivity:** Connect to BigQuery, Agent Platform, Cloud Storage, or internal ERP and CRM systems.\n\nThree decoupled tiers work together:\n\n**Client browser:** Shows the chat alongside the MCP App widget in the side panel.\n\n**Gemini Enterprise:** The default assistant calls tools, the AppBridge proxy relays widget messages, and the connector manages OAuth.\n\n**Google Cloud (your project):** You deploy and host the MCP server on Cloud Run, which exposes one JSON-RPC endpoint (/mcp), runs background jobs, and serves the single-file HTML widget.\n\nEach tier talks only to its neighbor, letting Gemini Enterprise enforce security and routing.\n\nEach user signs in through OAuth 2.0. On every call, Gemini Enterprise sends its service agent token alongside the user's OAuth token:\n\n**Layer 1 (Cloud Run IAM):** Enforced at Google's edge, this answers \"which service may call?\" Public access is disabled; unauthorized callers receive HTTP 403.\n\n**Layer 2 (In-App OAuth):** Enforced inside the application, this answers \"which user is calling?\" Failed verification returns HTTP 401, prompting the user to sign in again.\n\nCloud Run IAM cannot distinguish end users, so both layers are required. Outbound calls use a least-privilege service account.\n\n**First,** build your custom MCP server (exposing POST /mcp and a bundled ui:// HTML widget) using the [MCP Apps SDK](https://github.com/modelcontextprotocol/ext-apps), or use [Google Antigravity](https://antigravity.google/)  to scaffold and deploy your MCP App with this starter prompt:\n\nBuild an MCP App for Gemini Enterprise using the create-mcp-app skill (https://github.com/modelcontextprotocol/ext-apps/tree/main/plugins/mcp-apps/skills/create-mcp-app).\n\nWorkflow: [describe your input data, side-panel UI controls, and approval or export actions].\n\nGenerate a single-file HTML widget, a Streamable HTTP backend (POST /mcp) with <2s async tool responses and get_app_state polling, and Cloud Run deployment commands (--no-allow-unauthenticated, --no-cpu-throttling, --min-instances=1).\n\nOnce your MCP server code is ready, deploy it to Cloud Run and connect it to Gemini Enterprise:\n\n**Step 1: Enable APIs** for Cloud Run, Discovery Engine, Agent Platform, and Organization Policy.\n\n**Step 2: Deploy your MCP server container to Cloud Run from source** `(gcloud run deploy <service> --source .`) with `--no-allow-unauthenticated, --no-cpu-throttling` so background work does not freeze between polls, and --min-instances=1.\n\n**Step 3: Grant the invoker role** (`roles/run.invoker`) to your Discovery Engine service agent (Layer 1).\n\n`https://vertexaisearch.cloud.google.com/oauth-redirect`(Layer 2).\n**Step 5:** Override the `discoveryengine.managed.disableCustomMcpServerConnector` constraint and complete the [Before you begin](https://cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/set-up-custom-mcp-server#before-you-begin) prerequisites `(roles/discoveryengine.editor` for the admin, allowedEgressFqdns for your server and OAuth hosts, and `custom_mcp` in `allowedDataSources` if enforced). Then, in the Google Cloud Console under Gemini Enterprise > Data stores > Create data store, select Custom MCP Server and register the connector:\n\n| **Configuration field** | **Value** | \n|---|---|\n| **MCP Server URL** | `https://<your-cloud-run-service>.run.app/mcp` | \n| **Authorization URL** | `https://accounts.google.com/o/oauth2/v2/auth` | \n| **Token URL** | `https://oauth2.googleapis.com/token` | \n| **Client ID and Secret** | Your Web OAuth 2.0 Client ID and Secret | \n| **Scopes** | `openid email profile` | \n| **Enable PKCE Support** | **Checked (recommended)** | \n| **Use HTTP Basic Auth** | **Unchecked** (avoids`invalid_client` errors) | \n\n**Step 6:** [**Enable actions**](https://cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/set-up-custom-mcp-server#enable-actions) on your data store. Gemini Enterprise imports your MCP server's tools as actions and disables them by default. In the Cloud Console, open Gemini Enterprise > Data stores > [Your MCP Data Store] > Actions, click Reload custom actions (which calls `tools/list` on your server), select your model-visible tools, and click Enable actions.\n\nAn MCP App pairs backend tools with a live workspace in Gemini Enterprise. You do not build a chat frontend or identity pipeline; you deploy one Cloud Run container and attach it as a Data Store, making Gemini Enterprise where enterprise work gets done.\n\n**Try Gemini** **here**\n\n**Co-build with Google Antigravity** **here**\n\n**Build on Google Cloud:** [MCP Apps Specification (SEP-1865)](https://github.com/modelcontextprotocol/ext-apps), [Cloud Run](https://cloud.google.com/run), and [Google Cloud AI](https://cloud.google.com/ai)**.**", "url": "https://wpnews.pro/news/developers-guide-to-implementing-mcp-apps-in-gemini", "canonical_source": "https://cloud.google.com/blog/topics/developers-practitioners/devs-guide-to-mcp-apps-in-gemini/", "published_at": "2026-10-19 16:00:00+00:00", "updated_at": "2026-10-19 16:18:34.935890+00:00", "lang": "en", "topics": ["agent-protocols", "ai-agents", "ai-tools", "developer-tools", "ai-products"], "entities": ["Google", "Gemini Enterprise", "Model Context Protocol", "MCP Apps", "Cloud Run", "Google Antigravity", "BigQuery", "Agent Platform"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/developers-guide-to-implementing-mcp-apps-in-gemini", "markdown": "https://wpnews.pro/news/developers-guide-to-implementing-mcp-apps-in-gemini.md", "text": "https://wpnews.pro/news/developers-guide-to-implementing-mcp-apps-in-gemini.txt", "jsonld": "https://wpnews.pro/news/developers-guide-to-implementing-mcp-apps-in-gemini.jsonld"}}