Skip to main content

Set up the Cloud Logging MCP server

Google's Cloud Logging MCP server lets AI agents search log entries, discover log names, and inspect the log buckets and views that store them. This guide walks through enabling the Cloud Logging API, granting IAM roles to users, creating an OAuth client in Google Cloud, and connecting the server to MintMCP.

Prerequisites​

Enable the Cloud Logging API​

  1. Go to console.cloud.google.com/apis/enableflow?apiid=logging and select your project.
  2. On Confirm project, check that the correct project is selected and click Next.
  3. On Enable API, click Enable. Enabling the Cloud Logging API also enables its MCP server.

Grant IAM roles​

Each user who connects to Cloud Logging through MintMCP needs IAM roles on the Google Cloud project.

  1. Go to console.cloud.google.com/iam-admin/iam and select your project.
  2. To add roles to a user already listed, click the edit (pencil) icon on their row. To add a new user, click Grant access and enter their email address or a Google Group.
  3. Add both roles, clicking + Add another role for the second:
    • MCP Tool User (roles/mcp.toolUser) to make MCP tool calls
    • Logging Admin (roles/logging.admin) to use the Cloud Logging MCP tools
  4. Click Save.

Users without both roles get an authorization error when they call a tool.

Create an OAuth client​

The OAuth client gives MintMCP a Client ID and secret to broker each user's Google sign-in. Create one Web application client and point its redirect URI at MintMCP's callback.

  1. Go to console.cloud.google.com/auth/clients and select your project.

  2. If prompted to configure the OAuth consent screen, set the user type to Internal (Google Workspace organizations only). This restricts access to users in your org and skips Google app verification, which is otherwise required for the Cloud Logging scopes.

  3. Click Create client.

  4. Set Application type to Web application and give it a name (for example, MintMCP OAuth).

    Create OAuth client ID form with application type set to Web application and a name field

  5. Under Authorized redirect URIs, click Add URI and enter:

    https://app.mintmcp.com/oauth/callback

    Leave Authorized JavaScript origins empty. This URI must match the Redirect URL in the connector's OAuth settings exactly, or sign-in fails with redirect_uri_mismatch.

    Authorized redirect URIs field set to the MintMCP OAuth callback URL

  6. Click Create. Google shows the Client ID and Client secret once, so copy both now: you can't view the secret again after closing the dialog.

Reopen the client anytime from the Clients list to edit its redirect URIs or rotate the secret.

Add Cloud Logging to MintMCP​

  1. In MintMCP, go to MCP store → Manage store.
  2. Find Google Cloud Logging in the recommended servers list and click Install.
  3. Open the connector's OAuth settings and enter the Client ID and Client secret from the OAuth client you created.
  4. Confirm the Redirect URL shown in the connector's OAuth settings matches the URI you added to the OAuth client (https://app.mintmcp.com/oauth/callback). They must be identical, or sign-in fails with redirect_uri_mismatch.
  5. Click Save.

The first time a user calls a tool, MintMCP directs them to sign in with Google and consent to the Cloud Logging scope. MintMCP stores and refreshes their token automatically on every subsequent call.

Choose the OAuth scope​

The connector requests https://www.googleapis.com/auth/logging.admin by default. Change it in the connector's OAuth settings to one of the scopes Cloud Logging supports:

ScopeConsent prompt shown to the user
https://www.googleapis.com/auth/logging.adminAdminister log data for your Google Cloud project
https://www.googleapis.com/auth/logging.readView log data for your Google Cloud project
https://www.googleapis.com/auth/logging.writeSubmit log data for your Google Cloud project

The scope only caps what a token may attempt; IAM decides what it can do. Consent always succeeds, so a user with read-only roles who consents to logging.admin still gets PERMISSION_DENIED at call time.

Security considerations​

  • Access is controlled by Google Cloud IAM: users without MCP Tool User and Logging Admin receive an authorization error when connecting.
  • Each user authenticates individually with their own Google account, so all operations run under their identity and appear in Cloud Audit Logs.
  • Logs frequently contain sensitive data (request payloads, user identifiers, tokens written by mistake). Anyone with access to this connector can read every log the project stores, so limit it to users who already have that access.
  • Narrow what the connector exposes with the logging.read scope, with tool customization in MintMCP, or with IAM deny policies, see Control MCP use with IAM.
  • Restrict access to individual log buckets with log views rather than granting project-wide log access.

Next steps​