Verified Agent Skill record

API Gateway MCP Server

Configures Google Cloud API Gateway (Public Preview) to act as a remote MCP server that exposes REST APIs as agent tools over HTTP POST /mcp, covering OpenAPI 2.0-to-3.x migration, x-google-api-management.mcp and x-google-mcp-tool annotation, tools/list security, ADK/API hub integration, and JSON-RPC troubleshooting.

Tasks

Migrate an OpenAPI 2.0 specification to OpenAPI 3.x and annotate it with x-google-api-management.mcp, backends, and x-google-mcp-tool
Run scripts/validate_mcp_openapi.py on a candidate spec and fix all errors until it exits with code 0
Create the API, API config, and gateway with gcloud and enable the managed service
Verify the MCP JSON-RPC 2.0 lifecycle (initialize, notifications/initialized, tools/list, tools/call) against https://{default_hostname}/mcp
Connect Google ADK McpToolset and verify discovery in Apigee API hub and Agent Registry

Inputs

Candidate OpenAPI 3.x specification file (candidate_openapi_spec)
Google Cloud project ID with an active billing account
Gateway service account and (optionally) a caller service account for test ID tokens

Outputs

Annotated OpenAPI 3.x specification with MCP extensions
A deployed API Gateway acting as a remote MCP server at POST https://{default_hostname}/mcp
Verified JSON-RPC 2.0 lifecycle responses and tool discovery in API hub and Agent Registry

Limitations and checks

MCP is not supported for OpenAPI 2.0 specifications
Only GET, POST, PUT, PATCH, and DELETE operations can be tools; a gateway serves at most 1,000 tools
Tools cannot return HTTP 204; MCP is stateless with UTF-8 text responses only
API Gateway rejects complex nested schemas and OpenAPI 3.1 type lists such as type: ["string", "null"]
x-google-api-management.mcp cannot be combined with x-google-model-router in one config
If an API config has several documents, API Gateway serves the MCP tools of only one of them
Not for Apigee X proxy bundles, outbound LLM model routing, or GKE Gateway API
tools/list is unauthenticated by default; exactly one JWT or API key scheme is accepted (no OR requirements with an API key)