{
  "schema": "ai-architect-reactflow/v1",
  "pattern": "enterprise-mcp-tool-hub",
  "provider": "gcp",
  "nodes": [
    {
      "id": "clients",
      "type": "architecture",
      "position": {
        "x": 40,
        "y": 220
      },
      "data": {
        "label": "Agent clients",
        "role": "user",
        "layer": "people",
        "detail": "Claude, coding agents, internal agents acting for a person.",
        "dataClass": "internal",
        "service": "Person",
        "serviceId": null,
        "docs": null,
        "officialIcon": null
      }
    },
    {
      "id": "catalog-ui",
      "type": "architecture",
      "position": {
        "x": 340,
        "y": 400
      },
      "data": {
        "label": "Tool catalog and consent",
        "role": "experience",
        "layer": "people",
        "detail": "Browse tools, see scopes, grant or revoke access.",
        "dataClass": "internal",
        "service": "Cloud Run",
        "serviceId": "gcp.cloud-run",
        "docs": "https://cloud.google.com/run",
        "officialIcon": "cloud_run"
      }
    },
    {
      "id": "authz",
      "type": "architecture",
      "position": {
        "x": 340,
        "y": 40
      },
      "data": {
        "label": "Authorization server",
        "role": "identity",
        "layer": "control",
        "detail": "OAuth 2.1 with audience-bound tokens and short lifetimes.",
        "dataClass": "identity",
        "service": "Identity Platform",
        "serviceId": "gcp.identity-platform",
        "docs": "https://cloud.google.com/security/products/identity-platform",
        "officialIcon": null
      }
    },
    {
      "id": "edge",
      "type": "architecture",
      "position": {
        "x": 340,
        "y": 220
      },
      "data": {
        "label": "Edge protection",
        "role": "edge",
        "layer": "control",
        "detail": "TLS, rate limits, anomaly blocking.",
        "dataClass": "operational",
        "service": "Cloud Armor + Load Balancing",
        "serviceId": "gcp.cloud-armor",
        "docs": "https://cloud.google.com/security/products/armor",
        "officialIcon": null
      }
    },
    {
      "id": "mcp-gateway",
      "type": "architecture",
      "position": {
        "x": 640,
        "y": 220
      },
      "data": {
        "label": "MCP policy gateway",
        "role": "gateway",
        "layer": "control",
        "detail": "Per-tool scopes, input schema checks, quotas, kill switch.",
        "dataClass": "confidential",
        "service": "Apigee (AI gateway policies)",
        "serviceId": "gcp.apigee",
        "docs": "https://cloud.google.com/apigee",
        "officialIcon": null
      }
    },
    {
      "id": "guardrail",
      "type": "architecture",
      "position": {
        "x": 640,
        "y": 40
      },
      "data": {
        "label": "Content guardrail",
        "role": "guardrail",
        "layer": "control",
        "detail": "Detects secrets and injection text in tool inputs and outputs.",
        "dataClass": "confidential",
        "service": "Model Armor",
        "serviceId": "gcp.model-armor",
        "docs": "https://cloud.google.com/security/products/model-armor",
        "officialIcon": null
      }
    },
    {
      "id": "servers",
      "type": "architecture",
      "position": {
        "x": 940,
        "y": 220
      },
      "data": {
        "label": "Domain MCP servers",
        "role": "tools",
        "layer": "intelligence",
        "detail": "CRM, tickets, docs, HR read-only; owned by domain teams.",
        "dataClass": "confidential",
        "service": "MCP server on Cloud Run",
        "serviceId": "gcp.cloud-run-mcp",
        "docs": "https://cloud.google.com/run/docs/host-mcp-servers",
        "officialIcon": "cloud_run"
      }
    },
    {
      "id": "broker",
      "type": "architecture",
      "position": {
        "x": 940,
        "y": 40
      },
      "data": {
        "label": "Credential broker",
        "role": "secrets",
        "layer": "control",
        "detail": "Exchanges the user token for a short-lived backend credential.",
        "dataClass": "secret",
        "service": "Secret Manager",
        "serviceId": "gcp.secret-manager",
        "docs": "https://cloud.google.com/security/products/secret-manager",
        "officialIcon": null
      }
    },
    {
      "id": "systems",
      "type": "architecture",
      "position": {
        "x": 1240,
        "y": 220
      },
      "data": {
        "label": "Systems of record",
        "role": "system",
        "layer": "people",
        "detail": "Unchanged backends with their own permissions.",
        "dataClass": "confidential",
        "service": "External system",
        "serviceId": null,
        "docs": null,
        "officialIcon": null
      }
    },
    {
      "id": "registry",
      "type": "architecture",
      "position": {
        "x": 640,
        "y": 400
      },
      "data": {
        "label": "Tool registry",
        "role": "store",
        "layer": "knowledge",
        "detail": "Tool versions, owners, scopes, approval state.",
        "dataClass": "internal",
        "service": "Firestore",
        "serviceId": "gcp.firestore",
        "docs": "https://cloud.google.com/firestore",
        "officialIcon": null
      }
    },
    {
      "id": "audit",
      "type": "architecture",
      "position": {
        "x": 1240,
        "y": 400
      },
      "data": {
        "label": "Audit ledger",
        "role": "analytics",
        "layer": "knowledge",
        "detail": "Who, which client, which tool, which scope, result.",
        "dataClass": "confidential",
        "service": "BigQuery + Looker Studio",
        "serviceId": "gcp.bigquery",
        "docs": "https://cloud.google.com/bigquery",
        "officialIcon": null
      }
    },
    {
      "id": "owners",
      "type": "architecture",
      "position": {
        "x": 940,
        "y": 400
      },
      "data": {
        "label": "Tool owners",
        "role": "review",
        "layer": "assurance",
        "detail": "Approve new tools and scope changes.",
        "dataClass": "internal",
        "service": "Review console on Cloud Run",
        "serviceId": "gcp.review-console",
        "docs": "https://cloud.google.com/run",
        "officialIcon": "cloud_run"
      }
    },
    {
      "id": "traces",
      "type": "architecture",
      "position": {
        "x": 1240,
        "y": 40
      },
      "data": {
        "label": "Traces and alerts",
        "role": "observability",
        "layer": "assurance",
        "detail": "Latency, errors, unusual call patterns.",
        "dataClass": "operational",
        "service": "Cloud Logging, Monitoring, Trace",
        "serviceId": "gcp.observability",
        "docs": "https://cloud.google.com/products/observability",
        "officialIcon": null
      }
    },
    {
      "id": "contracts",
      "type": "architecture",
      "position": {
        "x": 1540,
        "y": 220
      },
      "data": {
        "label": "Tool contract tests",
        "role": "evals",
        "layer": "assurance",
        "detail": "Schema, permission and denial tests per tool version.",
        "dataClass": "internal",
        "service": "Evaluation service (Agent Platform)",
        "serviceId": "gcp.evaluation",
        "docs": "https://docs.cloud.google.com/gemini-enterprise-agent-platform",
        "officialIcon": "vertexai"
      }
    }
  ],
  "edges": [
    {
      "id": "discover",
      "source": "clients",
      "target": "mcp-gateway",
      "label": "List tools",
      "type": "smoothstep",
      "animated": true,
      "data": {
        "kind": "data",
        "dataClass": "internal"
      }
    },
    {
      "id": "authorize",
      "source": "clients",
      "target": "authz",
      "label": "OAuth consent, audience-bound token",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "identity"
      }
    },
    {
      "id": "consent",
      "source": "catalog-ui",
      "target": "authz",
      "label": "Grant or revoke scopes",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "identity"
      }
    },
    {
      "id": "call",
      "source": "clients",
      "target": "edge",
      "label": "Tool call with token",
      "type": "smoothstep",
      "animated": true,
      "data": {
        "kind": "data",
        "dataClass": "confidential"
      }
    },
    {
      "id": "admit",
      "source": "edge",
      "target": "mcp-gateway",
      "label": "Rate-checked call",
      "type": "smoothstep",
      "animated": true,
      "data": {
        "kind": "data",
        "dataClass": "confidential"
      }
    },
    {
      "id": "inspect",
      "source": "mcp-gateway",
      "target": "guardrail",
      "label": "Input and output scan",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "confidential"
      }
    },
    {
      "id": "policy",
      "source": "mcp-gateway",
      "target": "registry",
      "label": "Scope and version lookup",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "internal"
      }
    },
    {
      "id": "forward",
      "source": "mcp-gateway",
      "target": "servers",
      "label": "Authorized call",
      "type": "smoothstep",
      "animated": true,
      "data": {
        "kind": "data",
        "dataClass": "confidential"
      }
    },
    {
      "id": "exchange",
      "source": "servers",
      "target": "broker",
      "label": "Token exchange",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "secret"
      }
    },
    {
      "id": "execute",
      "source": "servers",
      "target": "systems",
      "label": "Backend call as the user",
      "type": "smoothstep",
      "animated": true,
      "data": {
        "kind": "data",
        "dataClass": "confidential"
      }
    },
    {
      "id": "log",
      "source": "mcp-gateway",
      "target": "audit",
      "label": "Call record",
      "type": "smoothstep",
      "animated": true,
      "data": {
        "kind": "data",
        "dataClass": "confidential"
      }
    },
    {
      "id": "approve",
      "source": "owners",
      "target": "registry",
      "label": "Approve tool or scope change",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "internal"
      }
    },
    {
      "id": "telemetry",
      "source": "mcp-gateway",
      "target": "traces",
      "label": "Latency and errors",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "telemetry",
        "dataClass": "operational"
      }
    },
    {
      "id": "verify",
      "source": "contracts",
      "target": "servers",
      "label": "Contract tests per version",
      "type": "smoothstep",
      "animated": false,
      "data": {
        "kind": "control",
        "dataClass": "internal"
      }
    }
  ],
  "viewport": {
    "x": 0,
    "y": 0,
    "zoom": 1
  }
}