Connect Lucius to Gemini Enterprise

• A Gemini Enterprise app. Google documents custom MCP servers for the Standard, Plus, Pay-as-you-go and Frontline editions.
• In its Google Cloud project, the Discovery Engine Editor role, which Google asks for to create the data store, and someone who can change the organization policy (step 2).
• A Lucius workspace where you are an owner or admin, with your email address confirmed. You make the client there.

1. Open Settings, Agent API and find the Gemini Enterprise card.
2. Give the client a name if you like, for example the name of your Gemini Enterprise app, and click Create client.
3. Copy the client ID and the client secret. The secret is shown once. If you lose it, revoke the client and make a new one.

The client only accepts Google's redirect URI, https://vertexaisearch.cloud.google.com/oauth-redirect, so there is nothing else to register.

Google blocks custom MCP data stores by default. Before you add Lucius, in the Google Cloud project of your Gemini Enterprise app:

• Override the organization policy constraint that blocks creating a custom MCP data store.
• Allow the domain api.ailucius.com for egress, with the allowedEgressFqdns constraint. The MCP server, the authorization URL and the token URL are all on that domain. Give the domain name only, not the full URL.
• If project enforcement is on, or the project is protected by VPC Service Controls, add custom_mcp to the allowed data sources.

Google's page has the details: Set up a custom MCP server data store.

1. In the Google Cloud console, open Gemini Enterprise, then Data stores, then Create data store.
2. Search for Custom MCP Server and click Add MCP server.
3. Under Authentication settings, choose OAuth 2.0 and fill in the fields below.
4. Click Verify Auth. Gemini Enterprise opens the Lucius sign-in: sign in with your Lucius account and click Allow. Then click Continue.
5. Choose the location, give the data store a name, and click Create.
6. In the new data store, open Actions, click Reload custom actions, select the Lucius tools and click Enable actions.

index:read

Search the Lucius index of public tenders, read one notice, find similar notices, and read your workspace's stored analyses of them.

packs:analyze

Start the analysis of a tender pack and read the result. Each analysis uses one of your workspace's monthly analyses. Leave it out for search only.

offline_access

Asks for a refresh token, so Gemini Enterprise can renew its one-hour access without asking the person to sign in again.

For search only, paste index:read offline_access. The tools and their inputs are on the Agent API page.

• Gemini Enterprise asks each person to sign in to Lucius the first time they use it. Owners, admins and editors of the Lucius workspace that made the client can connect. Viewers cannot, because the client can start analyses. An account of another Lucius workspace cannot sign in through it.
• A connection reads and analyses through the Lucius tools only. It cannot change workspace settings, members, keys or billing.
• Everyone's requests count against the workspace's allowance, whoever connected.
• Google's page says Gemini Enterprise asks the person to confirm an action that is not marked read-only. In Lucius, only starting a pack analysis is not read-only.
• On a paid plan or during a trial, its requests are part of the plan, up to 5,000 a month for the workspace. Past that, and on the Free plan, they count like an API key's: the free requests first, then credit.

Steps 1 to 3 add Lucius to the app directly. If your organization sends agent traffic through Agent Gateway, Google imports the MCP server from Agent Registry instead, and the regions have to line up:

• For an app in the eu multi-region, the gateway is in europe-west1, and the registry is in europe-west1 or eu.
• Agent Registry does not take a manually registered MCP server in the eu or us multi-region, so register Lucius in europe-west1: in Agent Registry, open MCP servers, click Add MCP server, and give the endpoint URL https://api.ailucius.com/api/v1/mcp. Lucius lists its tools only after sign-in, so if Import tools cannot read them, write the tool specification from the tools on the Agent API page.
• Then, in Gemini Enterprise, open the app, then Connected data stores, then New data store. Under MCP servers click Show all, click Add tool for Lucius, choose OAuth 2.0 and fill in the same fields as in step 3. The MCP server URL must be the same as the one in the registry entry.

Google's pages: Import MCP servers from Agent Registry and Register MCP servers.

• Revoke the client in Settings, Agent API. Everyone who signed in through it loses access at once.
• To disconnect one person, find their connection in the API keys list there, named after the client with "(connected app)", and click Disconnect.