InsideOut (Riley)

Inspect GCP Infrastructure

gcpinspect

Read-only

INSPECTION: Inspect GCP infrastructure for a deployed project ⚠️ PREREQUISITE: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources.

Inspect deployed GCP resources after a deployment attempt. Use this tool when the user asks about the status or details of their deployed GCP infrastructure. It fetches temporary read-only credentials securely and queries the GCP API directly.

RESPONSE TIERS (default is summary for token efficiency):

Summary (default): Key fields only (~500 tokens). Set detail=false, raw=false or omit both.
Detail: Full metadata for a specific resource. Set detail=true + resource filter.
Raw: Complete unprocessed API response. Set raw=true.

REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: apigateway, bastion, billing, certificatemanager, cloudarmor, cloudbuild, cloudcdn, clouddeploy, clouddns, cloudfunctions, cloudkms, cloudlogging, cloudmonitoring, cloudrun, cloudsql, compute, firestore, gcs, gke, iam, identityplatform, loadbalancer, memorystore, pubsub, secretmanager, vertexai, vpc For a specific service's actions, call with action="list-actions".

METRICS: Use list-metrics to see available Cloud Monitoring metrics for any service (no credentials needed — progressive disclosure). Use get-metrics to retrieve time-series data. Optional filters JSON: {"hours":6,"period":300}. Label breakdowns: Cloud Functions (by status), Load Balancer/API Gateway (by response_code_class), Cloud CDN (by cache_result). Secret Manager get-metrics returns operational health (version count, replication, create time) — no time-series. Bastion is an alias for Compute Engine metrics (SSH connection count not available as a GCP metric). BILLING: Use service=billing to inspect GCP billing. Actions: get-billing-info (check if billing enabled, which billing account), get-budgets (list budget alerts for the project — auto-fetches billing account). Requires roles/billing.viewer IAM role. Required IAM roles: Monitoring Viewer (roles/monitoring.viewer) for metrics, Secret Manager Viewer (roles/secretmanager.viewer) for secret health, Billing Viewer (roles/billing.viewer) for billing.

EXAMPLES:

gcpinspect(session_id=..., service="compute", action="list-instances")
gcpinspect(session_id=..., service="gke", action="list-clusters")
gcpinspect(session_id=..., service="cloudsql", action="get-metrics", filters="{"hours":6}")
gcpinspect(session_id=..., service="billing", action="get-billing-info")

Input Schema

Name	Required	Description
`raw`	Yes	When true, returns the unprocessed GCP API response. Escape hatch for fields the summarized response doesn't surface.
`action`	Yes	Operation on the service. Examples: 'list-instances' (compute), 'list-buckets' (storage), 'list-clusters' (gke), 'list-actions' (discovery), 'list-metrics' / 'get-metrics' (Cloud Monitoring).
`detail`	Yes	When true, returns full metadata for a single resource. When false (default), returns a summary.
`filters`	Yes	Optional JSON-encoded filter object passed through to the underlying GCP API. Examples: '{"hours":6}' for metric windows, '{"zone":"us-central1-a"}' for zone-scoped queries.
`service`	Yes	GCP service to query. Examples: 'compute', 'storage', 'cloudsql', 'gke', 'cloudrun', 'pubsub', 'firestore'. Use action='list-actions' to discover supported actions for a service.
`session_id`	Yes	Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_?token=). The suffix is part of the session credential; never strip it when summarizing. The session must have a GCP deploy attempt before inspect probes will succeed.

Output Schema

Name	Required	Description
`hints`	No	Guidance for the calling agent: what to do next and which tools relate to this result.
`result`	No	The GCP inspect result. A list action returns a summary object (count plus the listed items) when summarized is true; detail and raw actions return the backend result unchanged.
`summarized`	No	True when result is a compact summary instead of the full backend response.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 20, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "hints": {
+      "description": "Guidance for the calling agent: what to do next and which tools relate to this result.",
+      "properties": {
+        "next_actions": {
+          "description": "Suggested next steps, in order, often as ready-to-run tool calls.",
+          "items": {
+            "description": "One suggested next step.",
+            "type": "string"
+          },
+          "type": [
+            "null",
+            "array"
+          ]
+        },
+        "related_tools": {
+          "description": "Names of tools that are useful after this result.",
+          "items": {
+            "description": "A tool name.",
+            "type": "string"
+          },
+          "type": [
+            "null",
+            "array"
+          ]
+        }
+      },
+      "type": [
+        "null",
+        "object"
+      ]
+    },
+    "result": {
+      "description": "The GCP inspect result. A list action returns a summary object (count plus the listed items) when summarized is true; detail and raw actions return the backend result unchanged."
+    },
+    "summarized": {
+      "description": "True when result is a compact summary instead of the full backend response.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

Changed1 schema field changedMay 23, 2026

changedInput schema / properties / service / enum

Previous value: -[
-  "apigateway",
-  "bastion",
-  "billing",
-  "cloudarmor",
-  "cloudbuild",
-  "cloudcdn",
-  "cloudfunctions",
-  "cloudkms",
-  "cloudlogging",
-  "cloudmonitoring",
-  "cloudrun",
-  "cloudsql",
-  "compute",
-  "firestore",
-  "gcs",
-  "gke",
-  "identityplatform",
-  "loadbalancer",
-  "memorystore",
-  "pubsub",
-  "secretmanager",
-  "vertexai",
-  "vpc"
-]New value: +[
+  "apigateway",
+  "bastion",
+  "billing",
+  "certificatemanager",
+  "cloudarmor",
+  "cloudbuild",
+  "cloudcdn",
+  "clouddeploy",
+  "clouddns",
+  "cloudfunctions",
+  "cloudkms",
+  "cloudlogging",
+  "cloudmonitoring",
+  "cloudrun",
+  "cloudsql",
+  "compute",
+  "firestore",
+  "gcs",
+  "gke",
+  "iam",
+  "identityplatform",
+  "loadbalancer",
+  "memorystore",
+  "pubsub",
+  "secretmanager",
+  "vertexai",
+  "vpc"
+]

Changed8 schema fields changedMay 7, 2026

addedInput schema / properties / action / description

Added value: +"Operation on the service. Examples: 'list-instances' (compute), 'list-buckets' (storage), 'list-clusters' (gke), 'list-actions' (discovery), 'list-metrics' / 'get-metrics' (Cloud Monitoring)."

addedInput schema / properties / detail / description

Added value: +"When true, returns full metadata for a single resource. When false (default), returns a summary."

addedInput schema / properties / filters / description

Added value: +"Optional JSON-encoded filter object passed through to the underlying GCP API. Examples: '{\"hours\":6}' for metric windows, '{\"zone\":\"us-central1-a\"}' for zone-scoped queries."

addedInput schema / properties / raw / description

Added value: +"When true, returns the unprocessed GCP API response. Escape hatch for fields the summarized response doesn't surface."

addedInput schema / properties / service / description

Added value: +"GCP service to query. Examples: 'compute', 'storage', 'cloudsql', 'gke', 'cloudrun', 'pubsub', 'firestore'. Use action='list-actions' to discover supported actions for a service."

addedInput schema / properties / service / enum

Added value: +[
+  "apigateway",
+  "bastion",
+  "billing",
+  "cloudarmor",
+  "cloudbuild",
+  "cloudcdn",
+  "cloudfunctions",
+  "cloudkms",
+  "cloudlogging",
+  "cloudmonitoring",
+  "cloudrun",
+  "cloudsql",
+  "compute",
+  "firestore",
+  "gcs",
+  "gke",
+  "identityplatform",
+  "loadbalancer",
+  "memorystore",
+  "pubsub",
+  "secretmanager",
+  "vertexai",
+  "vpc"
+]

addedInput schema / properties / session_id / description

Added value: +"Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. The session must have a GCP deploy attempt before inspect probes will succeed."

addedInput schema / properties / session_id / pattern

Added value: +"^sess_v2_[0-9A-Za-z]+\\?token=[0-9a-f]+$"

First observedMay 5, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, yet the description adds real context beyond them: it fetches temporary read-only credentials and queries the GCP API directly, it works after failed deploys to surface orphaned resources, and it names the token cost of each response tier (~500 tokens for summary). It also enumerates the IAM roles required for metrics, secret health, and billing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded and well sectioned (PREREQUISITE, RESPONSE TIERS, REQUIRES, METRICS, BILLING, EXAMPLES), so an agent can skim to the tier defaults. It loses a point for redundancy: the 27-service list repeats the schema enum verbatim, and 'Inspect deployed GCP resources after a deployment attempt' restates the header and the following usage sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and everything else an agent needs is present: credential prerequisites, IAM roles, tier selection with defaults, service/action discovery, and worked examples. Nothing required to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema descriptions: how detail/raw interact with resource filters to select a tier, a concrete filters JSON with a 'period' key the schema omits, the session_id format and the deploy-attempt requirement tied to it, and per-service metric label breakdowns. It stops short of documenting every service/action combination.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Inspect GCP infrastructure for a deployed project') and scopes it to resources created by a prior deployment attempt. The GCP focus plus the deploy-attempt precondition cleanly separates it from awsinspect and from gcpinspect_batch without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use this tool when the user asks about the status or details of their deployed GCP infrastructure'), an explicit precondition ('requires a prior deployment ATTEMPT... Check convostatus for hasDeployAttempt=true'), and routes between sub-actions (action="list-actions" for discovery, list-metrics vs get-metrics, service=billing for billing). When, when-not, and alternatives are all present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All InsideOut (Riley) tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?