Google shows how to build interactive MCP Apps inside Gemini Enterprise

Google Cloud has published a developer guide for putting live, clickable apps inside Gemini Enterprise, its business AI assistant. Instead of answering in plain text, the assistant can open a small working panel in the chat. Users can adjust things there without sending another message. The guide was written by Dave Wang, a Forward Deployed Engineer at Google Cloud.

What changed

The feature is called MCP Apps. It is an open extension to the Model Context Protocol (MCP), a standard way for AI assistants to connect to outside tools. An MCP App pairs a tool with a live screen. In Gemini Enterprise, that screen appears in the chat inside a sandboxed frame, which keeps it walled off from the rest of the page. It can expand to fullscreen or a side panel. The guide describes three stages of assistants:

• Text chatbots return fixed text with no controls.
• Standard MCP tools call live systems but still return text, so each change needs another model turn.
• MCP Apps add a live workspace, so edits happen in the widget while the assistant stays in sync.

How it works

Gemini Enterprise handles workforce sign-in, governed data access and the Default Assistant. The business hosts one server on a private Google Cloud Run service. That server answers on a single address (/mcp), runs background jobs and serves the app screen as one HTML file. The guide says teams do not need to build a chat front end or an identity system. It lists uses such as redaction views for legal review, 3D viewers for CAD and sensitivity models for finance.

Security

Two checks run on every call. The first is Cloud Run IAM, which decides which service may call the server. Callers without permission get an HTTP 403 error. The second is in-app OAuth sign-in, which decides which user is calling. A failed check returns a 401 error and prompts the user to sign in again. The guide says both are needed because Cloud Run IAM cannot tell individual users apart. Outbound calls use a service account with minimal permissions.

Setting it up

The guide walks through enabling several Google Cloud services, deploying the server and connecting it in the Cloud Console as a Custom MCP Server data store. Key deploy settings include:

• --no-allow-unauthenticated keeps the service private.
• --no-cpu-throttling stops background work from freezing between polls.
• --min-instances=1 keeps one copy running.

Admins must also grant roles, override one organization policy and enable the server's tools as actions, since they are off by default. The guide also offers a starter prompt for Google Antigravity to scaffold the app.

What is not covered

The guide does not give pricing or a launch date. It is aimed at developers, not general users. For companies already on Google Workspace and Gemini Enterprise, it points to a possible way to place a CRM or portal workflow inside the assistant. Whether that fits a given business will depend on the workflow and the setup effort.