A2 · Tool workflow · technology, financial services, healthcare, public sector, professional services

Enterprise MCP tool hub

Company tools for Claude and every other agent, behind one door with scopes and a log.

Customer job: Let employees use Claude, coding agents and internal agents against company systems without handing out API keys.
Today: Teams paste API tokens into local configs; nobody can say which agent called which system with whose authority.
Accepted result: An agent action that the security team can attribute to a person, a client and a scope, and that the tool owner approved.

Domain teams publish typed MCP servers for their systems. Agent clients reach them only through an authorization server and a policy gateway that binds tokens to an audience, enforces per-tool scopes and rate limits, brokers backend credentials and records every call.

Google Cloud / primary provider

What carries each step.

Apigee enforces OAuth, quotas and policies; servers run on Cloud Run with workload identity; BigQuery holds the audit trail.

Data and model estate in one place: Gemini on Agent Platform, Agent Search and RAG Engine, AlloyDB and BigQuery, Cloud Run for everything else.

Component	Service	Evidence
	Person
	Cloud Run	prior, ga
	Identity Platform	prior, ga
	Cloud Armor + Load Balancing	prior, ga
	Apigee (AI gateway policies)	prior, ga
	Model Armor	prior, ga
	MCP server on Cloud Run	prior, ga
	Secret Manager	prior, ga
	External system
	Firestore	prior, ga
	BigQuery + Looker Studio	prior, ga
	Review console on Cloud Run	prior, ga
	Cloud Logging, Monitoring, Trace	prior, ga
	Evaluation service (Agent Platform)	confirm

Customer view / judgement, not benchmark

Weigh what this customer values.

Remove providers that fail a hard constraint first: residency, data rights, identity estate, latency, operating owner, budget. Then weigh the rest. Scores are architect judgement on a 1-5 scale for the pattern as specified, recorded with a rationale. They are not benchmarks. A provider's consumption opportunity never changes a customer score.

Performance×1Does the default path meet the latency and quality budget for this workload?Time to value×1How quickly does a team reach a first accepted result with managed parts?Speed to execution×1How much undifferentiated wiring stands between the design and a running slice?Cost per accepted result×1How predictable and low is the all-attempt cost at the stated volume?Exit cost×1How cheaply can the workload move models, data or runtime later?Governance fit×1Do identity, residency, audit and policy controls exist without custom building?

Performance 5Time to value 4Speed to execution 4Cost per accepted result 5Exit cost 4Governance fit 4
Strong edge controls and low cost per call; credential brokering to legacy systems is custom.
Performance 4Time to value 4Speed to execution 5Cost per accepted result 4Exit cost 4Governance fit 3
Fast for product teams; enterprise authorization and credential brokering come from partners.
Performance 4Time to value 4Speed to execution 4Cost per accepted result 3Exit cost 3Governance fit 5
Purpose-built managed path on AWS.
Performance 4Time to value 4Speed to execution 4Cost per accepted result 3Exit cost 3Governance fit 5
Natural for Entra estates; confirm MCP feature support for the API Management tier.
Performance 4Time to value 3Speed to execution 3Cost per accepted result 3Exit cost 4Governance fit 5
Enterprise API governance already in place for many estates; MCP-specific policy is configuration work.
Performance 3Time to value 3Speed to execution 3Cost per accepted result 4Exit cost 5Governance fit 2
Control without managed security services.

Provider ledger / shown after the choice

What grows on Google Cloud.

These meters are the provider team’s consumption view. They explain the cloud workload; they never raise a customer score.

Gemini input and output tokens
Cloud Run vCPU-seconds and requests
Agent Search queries and index storage
AlloyDB or Cloud SQL instance hours
BigQuery slots or bytes scanned

Take it with you / generated from one specification

Exact views, and a running start.

Google Cloud views

SVG diagram for decks and documents
diagrams.net file editable, shared IDs
React Flow JSON for your own canvas
Mermaid flowchart

Every provider

Structurizr workspace C4 containers, one deployment view per provider
Journey sequence (Mermaid)

One-click template

No Google Cloud template yet.

The same answer contract runs on these runtimes today; its conformance suite is the porting checklist.

Vercel: anthropic/claude-sonnet-5.5 with gateway fallbacks
Cloudflare: @cf/meta/llama-3.3-70b-instruct-fp8-fast
Google Cloud: gemini-3.8-flash on the global endpoint

Customer ledger / assumptions you can move

Cost per accepted result.

Every attempt is charged, so failed runs count. Value comes only from accepted results. Illustrative assumption; value counted per agent task that completes using a governed tool instead of manual lookup.

Primary metric: Governed tool calls. Share of agent-to-system calls that pass through the hub with a bound token, scope check and audit record.

Monthly value: €38,080
Monthly cost: €2,548
Net: €35,532
Cost per accepted result: €0.62

Eligible tasks per month8,000Share attempted with the system60 in 100Attempts accepted without rework85 in 100Minutes saved per accepted result7 minValue of an hour of that work€80.00Run cost per attempt€0.01Fixed monthly cost (hosting, review, support)€2,500

Experience / drawn from the specification

What the person sees, including no.

Screens are rendered from structured blocks in the catalog, so a refusal or an exception is designed before it happens. Values marked fixture are illustrations, not measurements.

Tool	Owner	Scopes	State
crm.account.read	Sales Ops	crm:read	Approved
tickets.create	Support	tickets:write	Approved
hr.directory.read	People	hr:read	Review

Request access

Tool catalogdesktop · default

Claude wants to use 2 company tools

Read CRM accounts you can see
Create support tickets as you

Allow for 8 hoursDeny

Consentmobile · approval

Time	Person	Client	Tool	Result
fixture	fixture	fixture	tickets.create	allowed
fixture	fixture	fixture	hr.directory.read	denied: scope

Audit viewdesktop · default

Team workflow / who carries what

Every lane leaves evidence.

Lane	Responsibility	Evidence it leaves
Customer	Employee grants scopes to a client and uses tools through it	Consent record
AI	Agent calls tools; never sees backend credentials	Call record with scope
System	Gateway enforces scopes, quotas and the kill switch	Denied-call log
Reviewer	Tool owners approve tools and scope changes	Registry approval history
Operator	Security reviews anomalies and revokes tokens	Revocation log

Release evaluations

What must pass before anyone ships.

Unauthorized calls
0 calls succeed without the required scope
Scope-matrix tests per tool and client.
Token audience binding
100 percent of foreign-audience tokens rejected
Replay tokens minted for other servers.
Schema conformance
100 percent of published tools pass contract tests
Generated cases from each tool's input schema.
Gateway overhead
p95 added latency <= 50 ms
Synthetic load in staging.

Risks and controls

What would go wrong first.

A server acts with its own broad credentials instead of the user's.
Token exchange per call; no static backend keys in servers.
Tool output carries instructions into the agent.
Output scanning and labelling of tool results as data.
Unreviewed servers bypass the hub.
Network policy allows backend access only from registered servers.

Image recipes / concept art only

When to generate, and when never to.

16:9 · gpt-image-2 or a current Gemini image model

Customer moment for a proposal cover or portal hero.

Cinematic editorial photograph, late afternoon light, shallow depth of field. Let employees use Claude, coding agents and internal agents against company systems without handing out API keys. The moment just after the accepted result: An agent action that the security team can attribute to a person, a client and a scope, and that the tool owner approved. Real workplace, restrained palette of deep navy, warm paper and one cobalt accent. Natural expressions, no screens facing the camera. Concept art only. Do not render product logos, cloud icons, UI text or architecture labels; compose exact labels from the specification in code.

3:2 · gpt-image-2 (consistent characters across panels)

Team workflow storyboard for a workshop or executive briefing.

Five-panel storyboard, clean ink line with flat colour, consistent characters across panels. Panels follow the lanes customer, ai, system, reviewer, operator: (1) Employee grants scopes to a client and uses tools through it (2) Agent calls tools; never sees backend credentials (3) Gateway enforces scopes, quotas and the kill switch (4) Tool owners approve tools and scope changes (5) Security reviews anomalies and revokes tokens Each panel shows hands and decisions, not screens. Concept art only. Do not render product logos, cloud icons, UI text or architecture labels; compose exact labels from the specification in code.

Do not generate

Any image a customer will read for component names, data classes or provider services.

Do not generate. Export the compiled view for the chosen provider. A generated architecture image can invent services, misspell names and draw icons the vendor never published.

A design, not a deployment: no realization on this page carries a provider receipt. Generated from the pattern source at revision c43825efda38. Apache-2.0 for catalog content and exports; provider names are trademarks of their owners; Google Cloud icons retain Google rights.

Next pattern: Grounded research desk