Connectors · MSP & PSA

Google Cloud Identity MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Google Cloud Identity and the rest of your systems. It gives your agent 70 Google Cloud Identity actions (35 reads, 19 writes and 16 that wait for a confirmation) and holds the Google Cloud Identity credential itself, so the agent never does. It paces Google Cloud Identity's limits and records every call. Connecting Google Cloud Identity needs your own Google Cloud Identity OAuth app and one admin sign-in.

Connect Google Cloud Identity free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

70actionsin one signed file
35readlook, never change
19writecreate and update
16wait for a yesdestructive, confirmed first

Set up

Connect Google Cloud Identity in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Google Cloud Identity.
OAuth 2.0, authorization code with PKCE. You register your own OAuth app with Google Cloud Identity, an admin signs in once, and you paste the app's client id and secret and the tokens from that sign-in; actionlake renews the access token from then on. actionlake stores what you paste write-only, sealed under your tenant's key.
Before the first sign-in, Google Cloud Identity needs an OAuth app of your own, registered in its developer portal. actionlake has no Google Cloud Identity app to lend you.
- access_tokenAccess token from one sign-in with your own OAuth app
- refresh_tokenRefresh token from the same sign-in; the access token is renewed from it
- client_idGoogle OAuth client id (Google Cloud console > APIs & Services > Credentials; enable the Cloud Identity API on the…
- client_secretGoogle OAuth client secret
```
account { op: "connections.requirements", service: "google_cloud_identity" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "google_cloud_identity.devices.list" }# devices: list · read · 1 upstream callcheck { action: "google_cloud_identity.groups.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Google Cloud Identity at a glance

Sign-in: OAuth 2.0, authorization code with PKCE. You register your own OAuth app with Google Cloud Identity, an admin signs in once, and you paste the app's client id and secret and the tokens from that sign-in; actionlake renews the access token from then on.
You provide: access_tokenrefresh_tokenclient_idclient_secret
Limits we pace to: 600 calls a minute, per connection
API covered: Google Cloud Identity API (groups, memberships, devices, SSO profiles, policies, user invitations) API cloudidentity v1 (Discovery revision 20261019)cloudidentity.googleapis.com
Built from: Google Cloud Identity's documentation, read 23 October 2026cloudidentity.googleapis.com cloud.google.com
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 33 of 35 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 3, so ask can line Google Cloud Identity up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Google Cloud Identity.

70 actions in 12 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

35readlook, never change
19writecreate and update
16destructivewait for a confirmation

Groups memberships
11
8 read · 2 write · 1 destructive
Groups memberships: list · Groups memberships: modify membership roles · Groups memberships: get · Groups memberships: create
Groups
9
5 read · 3 write · 1 destructive
Groups: list · Groups: create · Groups: get · Groups: patch
Devices device users
8
3 read · 1 write · 4 destructive
Devices device users: list · Devices device users: get · Devices device users: approve · Devices device users: lookup
Devices
6
2 read · 1 write · 3 destructive
Devices: list · Devices: get · Devices: create · Devices: delete
Inbound oidc SSO profiles
5
2 read · 2 write · 1 destructive
Inbound oidc sso profiles: create · Inbound oidc sso profiles: list · Inbound oidc sso profiles: get · Inbound oidc sso profiles: delete
Inbound saml SSO profiles
5
2 read · 2 write · 1 destructive
Inbound saml sso profiles: create · Inbound saml sso profiles: list · Inbound saml sso profiles: get · Inbound saml sso profiles: delete
Inbound SSO assignments
5
2 read · 2 write · 1 destructive
Inbound sso assignments: create · Inbound sso assignments: list · Inbound sso assignments: get · Inbound sso assignments: delete
Policies
5
2 read · 2 write · 1 destructive
Policies: list · Policies: create · Policies: patch · Policies: get

4 more areas · 16 actions

User invitations 5
Allowlisted domains 4
Inbound saml SSO profiles idp credentials 4
Devices device users client states 3

Top actions

The Google Cloud Identity API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 30 of Google Cloud Identity's 31 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`google_cloud_identity.groups.list`Groups: list	Lists the `Group` resources under a customer or namespace.	read	`identity.group.list`262 connectors
`google_cloud_identity.groups_memberships.list`Groups memberships: list	Lists the `Membership`s within a `Group`.	read	`identity.group_member.list`103 connectors
`google_cloud_identity.groups.create`Groups: create	Creates a Group.	write	`identity.group.create`205 connectors
`google_cloud_identity.devices.list`Devices: list	Lists/Searches devices.	read	`device.endpoint.list`65 connectors
`google_cloud_identity.groups.delete`Groups: delete	Deletes a `Group`.	destructive	`identity.group.delete`181 connectors
`google_cloud_identity.groups_memberships.modify_membership_roles`Groups memberships: modify membership roles	Modifies the `MembershipRole`s of a `Membership`.	write	`identity.group_member.update`34 connectors
`google_cloud_identity.devices.get`Devices: get	Retrieves the specified device.	read	`device.endpoint.get`57 connectors
`google_cloud_identity.user_invitations.list`Customers userinvitations: list	Retrieves a list of UserInvitation resources.	read	`identity.invitation.list`33 connectors
`google_cloud_identity.user_invitations.send`Customers userinvitations: send	Sends a UserInvitation to email.	write	`identity.invitation.send`15 connectors
`google_cloud_identity.allowlisted_domains.create`Allowlisted domains: create	Adds a domain to the allowlist.	write	`identity.domain.create`17 connectors
`google_cloud_identity.allowlisted_domains.list`Allowlisted domains: list	Lists the domains in the allowlist.	read	`identity.domain.list`15 connectors
`google_cloud_identity.policies.create`Policies: create	Create a policy.	write	`identity.access_policy.create`12 connectors

Try it

Prompts to paste into Claude.

Each one names the Google Cloud Identity actions it will call, so you know what it reads and what it changes before you send it.

Readread
Which Google Cloud Identity devices have not checked in for a week?
callsgoogle_cloud_identity.devices.list
Writewrite
Groups: create in Google Cloud Identity. Show me exactly what you will send before you save it.
callsgoogle_cloud_identity.groups.create

Governance for Google Cloud Identity

Destructive actions wait for a yes.

16 Google Cloud Identity actions are destructive. These are all of them:

Groups: deletegoogle_cloud_identity.groups.delete
Groups memberships: deletegoogle_cloud_identity.groups_memberships.delete
Devices: deletegoogle_cloud_identity.devices.delete
Devices: wipegoogle_cloud_identity.devices.wipe
Customers userinvitations: cancelgoogle_cloud_identity.user_invitations.cancel
Policies: deletegoogle_cloud_identity.policies.delete
Allowlisted domains: deletegoogle_cloud_identity.allowlisted_domains.delete
Devices: cancel wipegoogle_cloud_identity.devices.cancel_wipe
Devices device users: wipegoogle_cloud_identity.devices_device_users.wipe
Devices device users: blockgoogle_cloud_identity.devices_device_users.block
Devices device users: deletegoogle_cloud_identity.devices_device_users.delete
Devices device users: cancel wipegoogle_cloud_identity.devices_device_users.cancel_wipe
Inbound sso assignments: deletegoogle_cloud_identity.inbound_sso_assignments.delete
Inbound oidc sso profiles: deletegoogle_cloud_identity.inbound_oidc_sso_profiles.delete
Inbound saml sso profiles: deletegoogle_cloud_identity.inbound_saml_sso_profiles.delete
Inbound saml sso profiles idp credentials: deletegoogle_cloud_identity.inbound_saml_sso_profiles_idp_credentials.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dogoogle_cloud_identity.groups.deleteconfirm_policy: human

Groups: delete?

intent: the user asked me to groups: delete

run suspended · waiting for a named person · key google-cloud-identity-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "google-cloud-identity-agent",  allowed_actions: ["google_cloud_identity.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "google_cloud_identity.groups.delete", approver: "[email protected]" },    { match: "google_cloud_identity.groups_memberships.delete", approver: "[email protected]" },    { match: "google_cloud_identity.devices.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Google Cloud Identity only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Google Cloud Identity costs on actionlake.

Every Google Cloud Identity action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Google Cloud Identity refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 70 Google Cloud Identity actions
17actions pageeach page of a long list is one call
33reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Google Cloud Identity action.

70 actions by area: the id your agent calls, what it does, and its effect.

Groups memberships11

google_cloud_identity.groups_memberships.check_transitive_membershipGroups memberships: check transitive membershipread
google_cloud_identity.groups_memberships.createGroups memberships: createwrite
google_cloud_identity.groups_memberships.deleteGroups memberships: deletedestructive
google_cloud_identity.groups_memberships.getGroups memberships: getread
google_cloud_identity.groups_memberships.get_membership_graphGroups memberships: get membership graphread
google_cloud_identity.groups_memberships.listGroups memberships: listread
google_cloud_identity.groups_memberships.lookupGroups memberships: lookupread
google_cloud_identity.groups_memberships.modify_membership_rolesGroups memberships: modify membership roleswrite
google_cloud_identity.groups_memberships.search_direct_groupsGroups memberships: search direct groupsread
google_cloud_identity.groups_memberships.search_transitive_groupsGroups memberships: search transitive groupsread
google_cloud_identity.groups_memberships.search_transitive_membershipsGroups memberships: search transitive membershipsread

Groups9

google_cloud_identity.groups.createGroups: createwrite
google_cloud_identity.groups.deleteGroups: deletedestructive
google_cloud_identity.groups.getGroups: getread
google_cloud_identity.groups.get_security_settingsGroups: get security settingsread
google_cloud_identity.groups.listGroups: listread
google_cloud_identity.groups.lookupGroups: lookupread
google_cloud_identity.groups.patchGroups: patchwrite
google_cloud_identity.groups.searchGroups: searchread
google_cloud_identity.groups.update_security_settingsGroups: update security settingswrite

Devices device users8

google_cloud_identity.devices_device_users.approveDevices device users: approvewrite
google_cloud_identity.devices_device_users.blockDevices device users: blockdestructive
google_cloud_identity.devices_device_users.cancel_wipeDevices device users: cancel wipedestructive
google_cloud_identity.devices_device_users.deleteDevices device users: deletedestructive
google_cloud_identity.devices_device_users.getDevices device users: getread
google_cloud_identity.devices_device_users.listDevices device users: listread
google_cloud_identity.devices_device_users.lookupDevices device users: lookupread
google_cloud_identity.devices_device_users.wipeDevices device users: wipedestructive

Devices6

google_cloud_identity.devices.cancel_wipeDevices: cancel wipedestructive
google_cloud_identity.devices.createDevices: createwrite
google_cloud_identity.devices.deleteDevices: deletedestructive
google_cloud_identity.devices.getDevices: getread
google_cloud_identity.devices.listDevices: listread
google_cloud_identity.devices.wipeDevices: wipedestructive

Inbound oidc SSO profiles5

google_cloud_identity.inbound_oidc_sso_profiles.createInbound oidc sso profiles: createwrite
google_cloud_identity.inbound_oidc_sso_profiles.deleteInbound oidc sso profiles: deletedestructive
google_cloud_identity.inbound_oidc_sso_profiles.getInbound oidc sso profiles: getread
google_cloud_identity.inbound_oidc_sso_profiles.listInbound oidc sso profiles: listread
google_cloud_identity.inbound_oidc_sso_profiles.patchInbound oidc sso profiles: patchwrite

Inbound saml SSO profiles5

google_cloud_identity.inbound_saml_sso_profiles.createInbound saml sso profiles: createwrite
google_cloud_identity.inbound_saml_sso_profiles.deleteInbound saml sso profiles: deletedestructive
google_cloud_identity.inbound_saml_sso_profiles.getInbound saml sso profiles: getread
google_cloud_identity.inbound_saml_sso_profiles.listInbound saml sso profiles: listread
google_cloud_identity.inbound_saml_sso_profiles.patchInbound saml sso profiles: patchwrite

Inbound SSO assignments5

google_cloud_identity.inbound_sso_assignments.createInbound sso assignments: createwrite
google_cloud_identity.inbound_sso_assignments.deleteInbound sso assignments: deletedestructive
google_cloud_identity.inbound_sso_assignments.getInbound sso assignments: getread
google_cloud_identity.inbound_sso_assignments.listInbound sso assignments: listread
google_cloud_identity.inbound_sso_assignments.patchInbound sso assignments: patchwrite

Policies5

google_cloud_identity.policies.createPolicies: createwrite
google_cloud_identity.policies.deletePolicies: deletedestructive
google_cloud_identity.policies.getPolicies: getread
google_cloud_identity.policies.listPolicies: listread
google_cloud_identity.policies.patchPolicies: patchwrite

User invitations5

google_cloud_identity.user_invitations.cancelCustomers userinvitations: canceldestructive
google_cloud_identity.user_invitations.getCustomers userinvitations: getread
google_cloud_identity.user_invitations.is_invitable_userCustomers userinvitations: is invitable userread
google_cloud_identity.user_invitations.listCustomers userinvitations: listread
google_cloud_identity.user_invitations.sendCustomers userinvitations: sendwrite

Allowlisted domains4

google_cloud_identity.allowlisted_domains.createAllowlisted domains: createwrite
google_cloud_identity.allowlisted_domains.deleteAllowlisted domains: deletedestructive
google_cloud_identity.allowlisted_domains.getAllowlisted domains: getread
google_cloud_identity.allowlisted_domains.listAllowlisted domains: listread

Inbound saml SSO profiles idp credentials4

google_cloud_identity.inbound_saml_sso_profiles_idp_credentials.addInbound saml sso profiles idp credentials: addwrite
google_cloud_identity.inbound_saml_sso_profiles_idp_credentials.deleteInbound saml sso profiles idp credentials: deletedestructive
google_cloud_identity.inbound_saml_sso_profiles_idp_credentials.getInbound saml sso profiles idp credentials: getread
google_cloud_identity.inbound_saml_sso_profiles_idp_credentials.listInbound saml sso profiles idp credentials: listread

Devices device users client states3

google_cloud_identity.devices_device_users_client_states.getDevices device users client states: getread
google_cloud_identity.devices_device_users_client_states.listDevices device users client states: listread
google_cloud_identity.devices_device_users_client_states.patchDevices device users client states: patchwrite

Questions

The Google Cloud Identity MCP server, answered.

Is there a Google Cloud Identity MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 70 Google Cloud Identity actions across groups memberships, groups, devices device users and devices, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Google Cloud Identity.

What do I need to connect Google Cloud Identity?

Your own Google Cloud Identity OAuth app, registered with Google Cloud Identity (its client id and client secret), and the access and refresh tokens from one admin sign-in. actionlake has no Google Cloud Identity app of its own, so this is not a one-step consent. actionlake renews the access token as it expires. The free call account { op: "connections.requirements", service: "google_cloud_identity" } lists exactly what to paste.

Can an AI agent delete or change things in Google Cloud Identity?

Only if its key allows it, and only with an explicit confirmation. 16 Google Cloud Identity actions are destructive, including groups: delete, groups memberships: delete and devices: delete. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Google Cloud Identity API limit?

actionlake paces every call to the limits in the Google Cloud Identity service file: 600 calls a minute per connection. Repeated reads are answered from cache (33 Google Cloud Identity actions can be), which never reaches Google Cloud Identity.

What does a Google Cloud Identity action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (17 Google Cloud Identity actions page). Cache hits, searches, dry runs and calls Google Cloud Identity refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Google Cloud Identity API does it cover?

The Google Cloud Identity API (groups, memberships, devices, SSO profiles, policies, user invitations) API cloudidentity v1 (Discovery revision 20261019) at cloudidentity.googleapis.com. It is built from Google Cloud Identity's documentation as read on 23 October 2026. 70 actions in 12 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Google Cloud Identity data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Google Cloud Identity credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Google Cloud Identity today.

Connect Google Cloud Identity free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Google Cloud Identity MCP server for AI agents.

Connect Google Cloud Identity in three steps.

Add actionlake to Claude.

Connect Google Cloud Identity.

Make the first call. Check before a write.

What an AI agent can do in Google Cloud Identity.

Groups memberships

Groups

Devices device users

Devices

Inbound oidc SSO profiles

Inbound saml SSO profiles

Inbound SSO assignments

Policies