Chrome Enterprise Premium MCP Server

A Model Context Protocol (MCP) server for Chrome Enterprise Premium (CEP). CEP extends Chrome's built-in security with Data Loss Prevention (DLP), real-time threat protection (phishing and malware scanning), and Context-Aware Access controls. This server exposes CEP's DLP rules, content detectors, connector policies, browser telemetry, and license management as MCP tools, so any MCP-compatible AI agent can inspect and configure a Chrome Enterprise environment.

Prerequisites

Before setting up the MCP server, ensure you have the following:

1. Node.js & npm: Node.js version 20.0.0 or higher installed locally.

2. Google Workspace Account:

   • Any Workspace edition with a Chrome Enterprise Premium license.

   • An administrator role in the Admin Console (Super Admin or delegated with Chrome Management and DLP permissions). Standard Workspace accounts (or Google Cloud IAM permissions alone) do not grant access and will return 403 Permission Denied errors with no indication that a Workspace role is missing.

3. OAuth App Trust (if required): If your organization restricts third-party app access, a Super Admin must trust the OAuth client in the Admin Console before you can authenticate.

4. MCP Client: A compatible MCP host application (such as Gemini CLI, Claude Desktop, Cursor, Windsurf, or VS Code).

Quick start

Get up and running in less than 2 minutes using the bundled Google-managed OAuth client. No repository cloning required!

1. Sign in

Run the authentication CLI once before you connect your MCP client:

npx @google/chrome-enterprise-premium-mcp auth login

A browser tab opens on Google's consent screen. Sign in with your Google Workspace administrator account and approve the requested permissions.

Once approved, the CLI retrieves an access token and saves it securely to ~/.config/cep-mcp/tokens.json (file mode 0600). The MCP server reads this file on every tool call, so you only need to sign in once.

2. Connect your MCP client

The server uses stdio transport; your MCP client launches it as a child process. Depending on your client, connect the server using one of the following methods:

If you are using the Gemini CLI, you can install this repository directly as an extension with a single command. This automatically configures the MCP connection and loads the built-in AI guidance rules:

gemini extensions install https://github.com/google/chrome-enterprise-premium-mcp

For all other MCP-compatible clients (such as Claude Desktop, Cursor, Windsurf, or VSCode), add this configuration block to your client's settings file (e.g., claude_desktop_config.json or ~/.gemini/settings.json):

{
  "mcpServers": {
    "cep": {
      "command": "npx",
      "args": ["-y", "@google/chrome-enterprise-premium-mcp@latest"],
      "env": { "GCP_STDIO": "true" }
    }
  }
}

3. Verify

Restart your MCP client, then ask the agent:

"What Chrome Enterprise Premium tools do you have access to?"

You should see the available tools listed in the response. If they don't appear, see Troubleshooting.

Related MCP server: MCP Google Workspace Server

Security & Blast Radius Warning

Workspace Scopes & Permissions

The scope set requested during the "Sign in" consent flow maps directly to the underlying Google APIs needed for the server's tools:

Advanced Authentication Options

For production environments, headless systems, or customized configurations, the server supports alternative auth pathways:

• Custom OAuth Client: To run under your own Google Cloud project instead of the default managed one (enabling you to manage your own consent screen and credentials), see Use a Custom OAuth Client.

• Headless / SSH Sessions: To authenticate on remote hosts or CI runners without a web browser, see Sign In from a Host Without a Browser.

• Hosted Deployments: For Cloud Run, Vertex AI Agent Engine, or service-account automation, see the Authentication Setup Matrix.

Configuration

For environment variables and stdio vs. HTTP transport, see docs/configuration.md.

Available tools and prompts

Prompts

Tools

The server exposes tools for reading and managing Chrome Enterprise resources:

• Discovery: get customer ID, list org units, count browser versions, list customer profiles

• Licensing: check CEP subscription status, check per-user license assignment

• DLP: list/create DLP rules, list/create detectors (regex, word list, URL list), create default rule sets

• Connectors: get connector policy status, enable Chrome Enterprise connectors

• Extensions: check SEB extension status, install SEB extension

• Security: get Chrome activity logs, check and enable required APIs

• Knowledge: retrieve documentation from the built-in Chrome Enterprise Premium knowledge base

Architecture

The codebase has three layers: API clients in lib/api/ (one interface + real implementation per Google API), MCP tools and prompts in tools/ and prompts/, and the server entry point in mcp-server.js. Integration tests redirect the real API clients at an in-process Express fake under test/helpers/. For the directory layout, design patterns, and how the test backends are wired, see docs/architecture.md.

Troubleshooting

For known issues with auth, permissions, Node.js setup, and MCP client integration (including the /mcp reload tip when CEP tools do not show up right after restart), see docs/troubleshooting.md.

FAQ

For license requirements, Workspace edition, service-account auth, experimental features, and other recurring questions, see docs/faq.md.

Reporting bugs

If something isn't working:

1. In Gemini CLI, run /bug to capture session diagnostics. Attach the generated file to your issue.

2. Run npm run presubmit and paste the output; this lets maintainers tell environmental problems from real code bugs.

3. Describe what you expected vs. what actually happened, including the exact error message.

Contributing

Contributions are welcome! For local development setup, building, testing, and contributor guidelines, please see CONTRIBUTING.md.

Legal

This repository is provided as a reference implementation that customers can explore and adapt under the Apache 2.0 license. It is not an officially supported Google product.

• License: Apache License 2.0

• Terms of Service: Terms of Service

• Privacy Policy: Privacy Policy

• Security: Security Policy