Google API Gateway adds a key check before an assistant sees its tools

An assistant asks which deployment tools are available. The list includes “look up version” and “roll back.” Reading both descriptions should not give it permission to do both jobs. Google Cloud API Gateway’s September 30 update adds API-key authentication to the MCP tools/list discovery request, as an alternative to JWT authentication. MCP remains in Preview; this change protects discovery, not every action it reveals.

Model Context Protocol, or MCP, lets a client retrieve tool descriptions and input formats, then request an operation. For an incident assistant, seeing how to ask for a rollback and being allowed to perform one are separate steps.

Getting the list is one request; using a tool is another

Imagine following that assistant’s first request for the list. Under the configuration documentation, tools/list is unauthenticated by default. An operator can protect it by naming one API-key security scheme in tools-list.security. The client then sends its key in x-api-key, not a query parameter. An invalid or missing key produces a JSON-RPC error and no list. The request has not reached a deployment lookup yet.

Connection initialization remains unauthenticated here. Once a valid key retrieves the list, the assistant can learn the lookup’s input format. Invoking it is a separate request, checked against the underlying OpenAPI operation’s authentication rules. The discovery key got the description; it did not settle whether this client may use the operation.

Let the assistant finish the read-only job

Suppose this hypothetical assistant has credentials to read a deployment version, but not roll it back. Discovery may reveal both tools, while the separately authorized lookup returns the current version. The neighboring rollback description adds no rollback access. The automated-remediation guidance places permission at the action and its current target, rather than treating a visible form as approval.

For a read-only assistant, the rollback description may not belong on the list at all. Configuring MCP as an object enables it globally for eligible operations; x-google-mcp-tool: false excludes a particular operation. Choosing what to expose, authenticating discovery and enforcing invocation rules are different decisions. One does not replace the others.

A proposed test keeps those outcomes separate: an invalid discovery key yields no list; a valid key yields the intended descriptions; lookup and rollback still obey their own invocation rules. No live gateway test is reported here. Existing API-key users gain that credential option for discovery, but Preview neither establishes named-user authorization nor makes MCP production-supported.

The assistant can report the current deployment version and finish the useful read-only job. It does not need rollback access to do that. The list helped it find the lookup; the operation’s policy kept looking separate from changing.