Connect GWC Bridge to Gemini

Connect GWC Bridge to Gemini so Gemini can work with the files and commands you permit on your own PC.

Menu names may differ from the examples below. GWC Bridge lets Gemini work with permitted files and commands on your own PC, where GWC for VS Code or GWC Studio is running.

1. Who can use this route

Gemini: An administrator can add a Custom MCP Server data store in a Google Cloud project. The project must allow Custom MCP data stores. Changing the relevant managed policy requires the Organization Policy Administrator role. The administrator who creates the data store also needs the Discovery Engine Editor role.^[1]^[2]

Gemini CLI: GWC Bridge does not support this route yet. Do not configure a static Gemini CLI OAuth client.

Consumer Gemini custom apps: Google offers custom apps only to eligible consumer users and only in English at present. Setup starts in the Gemini web app.^[4] GWC Bridge is not yet supported for this consumer flow. Google’s current help page does not publish the exact OAuth callback URI that GWC Bridge would need to allow. Do not reuse the Enterprise or CLI client ID.

2. Before you start

Have your GWC account ready, an active Connect Pass, and GWC for VS Code or GWC Studio running and connected on the PC you want Gemini to use.
Sign in to the same GWC account when the OAuth window opens. Adding the MCP URL does not install or start the PC component.
Review the files, folders, and command permissions shared from that PC. Start with the smallest access you need.
GWC Bridge still enforces its own account, grant, folder, and command permissions.

3. Server address and OAuth

Use this MCP server address:

https://mcp.gwc-corp.com/mcp

Use these OAuth endpoints:

Authorization URL: https://api.gwc-corp.com/oauth/authorize
Token URL:         https://api.gwc-corp.com/oauth/token
Issuer:            https://api.gwc-corp.com

The supported Gemini path uses Authorization Code with PKCE S256. Its static client ID is a public identifier bound to Google's exact hosted callback. GWC Bridge does not currently register an OAuth client for Gemini CLI.

4. Set up Gemini as an administrator

In Google Cloud, select the project where you will create the Gemini data store.
Open Organization Policies. Find Disable custom MCP server connector for Gemini Enterprise. Open it, click Manage Policy, select Override parent's policy, add a rule, set enforcement to Off, and click Set Policy.^[2]
If the project is protected by VPC Service Controls, or if the related connector policies are enforced for the project, also:

- add custom_mcp to Restrict allowed data sources for data connectors; and - add mcp.gwc-corp.com and api.gwc-corp.com to Restrict egress domains for data connectors.^[1]^[5]

Grant the administrator who will create the data store Discovery Engine Editor (roles/discoveryengine.editor).^[1]
Open Gemini Enterprise → Data stores → Create data store.
Search for Custom MCP Server, then click Add MCP server.
Under Authentication settings, choose OAuth 2.0.
Enter these values:

Field	Value
MCP Server URL	`https://mcp.gwc-corp.com/mcp`
Authorization URL	`https://api.gwc-corp.com/oauth/authorize`
Authorization URL Parameters	Leave blank
Token URL	`https://api.gwc-corp.com/oauth/token`
Client ID	`gwc-google-gemini-v1`
Enable PKCE Support	On
Client Secret	`none`
Scopes	`files:read files:write commands:run`

If your form also shows Use HTTP Basic Auth, leave it Off.^[7]

Google documents the Gemini redirect URI as exactly:

https://vertexaisearch.cloud.google.com/oauth-redirect

GWC Bridge accepts that exact callback for gwc-google-gemini-v1.^[1]

The Client Secret value none is only a form placeholder for this Enterprise public client. It is not a real secret. Google’s Looker MCP example uses the same literal value for a PKCE public client because the Gemini form requires a Client Secret value.^[6]

Click Verify Auth. Sign in to GWC and approve the requested access only if the account is correct.
Click Continue.
Under Configure your data connector, choose the required Multi-region value.
In Your data connector name, enter the name you want to use for this data store.
Click Create.
Wait for the data store state to become Active.
Open the data store, choose Actions → Reload custom actions, select only the GWC Bridge actions you need, then click Enable actions. Google disables custom MCP actions by default.^[1]
Connect the data store to the intended Gemini app if it is not already connected.
Run a read-only first check: Use GWC Bridge to show which of my computers and shared folders are available. Do not change files or run commands.

5. Gemini CLI

Gemini CLI can connect to remote MCP servers, but GWC Bridge does not currently enable a Gemini CLI OAuth client. Do not add a GWC Bridge OAuth profile to Gemini CLI yet. This route remains unavailable until GWC supports a separate client identity for Gemini CLI.

6. Consumer Gemini custom apps

Google’s current Gemini Apps help says eligible users can add a custom app in the Gemini web app from Settings → Connected Apps. Under Custom apps, enter the MCP server URL. If the server does not support Dynamic Client Registration, Advanced features can be expanded to enter credentials.^[4]

Do not enter either GWC client ID there. GWC Bridge does not yet have a consumer Gemini client profile because Google’s current help page does not publish the exact OAuth callback URI for that flow.

For now, use Gemini with the profile in this guide.

7. What Gemini can see and how to disconnect

When Gemini invokes a GWC Bridge tool, the tool result can include filenames, file contents, command output, device labels, or other data returned by that tool. That content is processed by the Gemini surface you chose. Google says third-party custom MCP servers are outside Google’s control and recommends connecting only servers you trust.^[4]

GWC Bridge permissions still apply:

File reads are limited to folders shared with the active GWC Bridge connection.
File changes require the connection and folder to allow changes.
Commands require the connection to allow commands and can still require approval.
A different PC, account, or revoked grant is not interchangeable with the one you authorised.

To disconnect:

Gemini: disable actions, disconnect the data store from the app, or remove the custom MCP data store as allowed by your organisation’s policy.
In GWC, revoking the underlying Bridge grant invalidates access independently of the Gemini-side settings.

8. Troubleshooting

Symptom	What to check
Gemini says Custom MCP Server is blocked	Confirm that Disable custom MCP server connector for Gemini Enterprise is overridden to Off for the project. If VPC Service Controls or connector-policy enforcement applies, also allow `custom_mcp` and the two required egress domains.
Verify Auth reports an invalid redirect	Confirm Client ID is exactly `gwc-google-gemini-v1`. GWC accepts only `https://vertexaisearch.cloud.google.com/oauth-redirect` for that client.
Verify Auth reports an invalid client secret	Enter exactly `none`, keep Enable PKCE Support on, and keep Use HTTP Basic Auth off if that control is shown.
Authorisation fails immediately	Confirm that Gemini manual OAuth is available for your GWC account and environment.
Gemini cannot reach the server or OAuth endpoints	If egress controls apply, allow `mcp.gwc-corp.com` and `api.gwc-corp.com`. Recheck the HTTPS URLs exactly.
Data store is Active but Gemini does not call tools	Open Actions, reload the custom actions if needed, enable the intended actions, and make sure the data store is connected to the intended app.
Gemini CLI OAuth is attempted	Stop. GWC Bridge does not currently support Gemini CLI OAuth.
Sign-in succeeds but GWC refuses access	Verify the GWC account and active Connect Pass, then check the Bridge grant and PC permissions.
PC or folder is unavailable	Confirm the intended PC is online, GWC Studio or GWC for VS Code is running and connected, and the folder is shared to this connection.
Reads work but edits or commands fail	Review the GWC Bridge file-change and command permissions and any approval prompt. A refusal is a permission boundary, not an authentication failure.
Consumer Gemini custom app asks for credentials	Do not use the Enterprise or CLI client IDs. GWC Bridge does not yet support that consumer flow.

When contacting GWC support, include the Gemini surface, the setup step, and the exact error message. Never send passwords, bearer tokens, private file contents, or a real client secret.

9. Official references

For Google’s setup instructions, see these official guides: