Deploying MCP Servers to Google Cloud Run: A Complete Guide

Google Cloud Run is a fully managed container platform that runs your code without you managing servers — and it's an excellent fit for MCP server deployment. Cloud Run scales to zero when idle (no idle cost), scales up instantly under load, and integrates natively with Google Cloud's security, secrets, and observability stack.

If your infrastructure already lives on GCP — BigQuery, Cloud SQL, GCS, Vertex AI — deploying your MCP server to Cloud Run keeps everything in one network perimeter and avoids cross-cloud latency.

Why Cloud Run for MCP Servers

Cloud Run hits a sweet spot for MCP workloads:

• Scale to zero — Unlike always-on VMs, Cloud Run only costs money when processing requests. Light-use MCP servers (personal, dev team) can run nearly free.
• No cold start problem for MCP — Unlike AWS Lambda's tight timeout limits, Cloud Run supports minimum instance configuration to keep at least one container warm, eliminating cold starts for production workloads.
• Native GCP integrations — Secret Manager for credentials, Cloud Logging for structured logs, IAM for access control, and VPC connectors for private Cloud SQL/BigQuery access.
• HTTP/SSE transport ready — Cloud Run serves HTTP natively, making it perfect for MCP's streamable HTTP and SSE transport modes.

Step 1: Create Your MCP Server

Create a simple MCP server with HTTP transport. Cloud Run expects an HTTP server, so we'll use the SSE or streamable HTTP transport rather than stdio:

// src/server.ts
import { Server } from '@modelcontextprotocol/sdk/server/index.js'
import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js'
import express from 'express'

const app = express()
const PORT = parseInt(process.env.PORT || '8080') // Cloud Run injects PORT

const server = new Server(
  { name: 'my-mcp-server', version: '1.0.0' },
  { capabilities: { tools: {} } }
)

server.setRequestHandler('tools/list', async () => ({
  tools: [
    {
      name: 'hello_world',
      description: 'A simple test tool',
      inputSchema: {
        type: 'object',
        properties: {
          name: { type: 'string', description: 'Name to greet' }
        },
        required: ['name']
      }
    }
  ]
}))

server.setRequestHandler('tools/call', async (request) => {
  if (request.params.name === 'hello_world') {
    const { name } = request.params.arguments as { name: string }
    return {
      content: [{ type: 'text', text: `Hello, ${name}! From Cloud Run.` }]
    }
  }
  throw new Error(`Unknown tool: ${request.params.name}`)
})

// SSE endpoint for MCP clients
app.get('/sse', async (req, res) => {
  const transport = new SSEServerTransport('/messages', res)
  await server.connect(transport)
})

app.post('/messages', express.json(), async (req, res) => {
  // Handle incoming messages from SSE transport
  res.json({ ok: true })
})

// Health check for Cloud Run
app.get('/health', (req, res) => res.json({ status: 'ok' }))

app.listen(PORT, () => {
  console.log(`MCP server running on port ${PORT}`)
})

Step 2: Containerize with Docker

Create a Dockerfile in your project root:

FROM node:20-slim

WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY dist/ ./dist/

# Cloud Run runs as non-root by default
USER node

# Cloud Run injects PORT — your app must listen on it
ENV PORT=8080
EXPOSE 8080

CMD ["node", "dist/server.js"]

Build and test locally:

npm run build
docker build -t mcp-server .
docker run -p 8080:8080 mcp-server
# Test: curl http://localhost:8080/health

Step 3: Push to Artifact Registry

Google Cloud Run pulls images from Artifact Registry (Google's container registry):

# Authenticate Docker with GCP
gcloud auth configure-docker us-central1-docker.pkg.dev

# Create a repository (one-time)
gcloud artifacts repositories create mcp-servers   --repository-format=docker   --location=us-central1   --description="MCP server images"

# Tag and push
docker tag mcp-server   us-central1-docker.pkg.dev/YOUR_PROJECT_ID/mcp-servers/my-mcp-server:latest

docker push   us-central1-docker.pkg.dev/YOUR_PROJECT_ID/mcp-servers/my-mcp-server:latest

Step 4: Store Secrets in Secret Manager

Never bake credentials into your container image. Use Google Cloud Secret Manager:

# Create a secret
echo -n "your-api-key-value" | gcloud secrets create MY_API_KEY   --data-file=-

# Grant Cloud Run's service account access
gcloud secrets add-iam-policy-binding MY_API_KEY   --member="serviceAccount:YOUR_PROJECT_NUMBER-compute@developer.gserviceaccount.com"   --role="roles/secretmanager.secretAccessor"

Your MCP server reads the secret at runtime via the Secret Manager API or by mounting it as an environment variable in the Cloud Run configuration.

Step 5: Deploy to Cloud Run

gcloud run deploy my-mcp-server   --image us-central1-docker.pkg.dev/YOUR_PROJECT_ID/mcp-servers/my-mcp-server:latest   --region us-central1   --platform managed   --port 8080   --memory 512Mi   --cpu 1   --min-instances 1   --max-instances 10   --set-secrets "MY_API_KEY=MY_API_KEY:latest"   --no-allow-unauthenticated

Key flags explained:

• --min-instances 1 — Keep one instance warm to eliminate cold starts. Set to 0 for dev/staging to save cost.
• --no-allow-unauthenticated — Require Google IAM authentication. Remove this only if you implement your own auth in the MCP server.
• --set-secrets — Mounts the secret as an environment variable in the container.

Step 6: Configure IAM Authentication

With --no-allow-unauthenticated, callers need a valid Google identity token. Generate one for testing:

# Get the service URL
gcloud run services describe my-mcp-server   --region us-central1   --format 'value(status.url)'

# Get an identity token for testing
TOKEN=$(gcloud auth print-identity-token)

# Test the health endpoint
curl -H "Authorization: Bearer $TOKEN"   https://MY-SERVICE-URL.run.app/health

For MCP clients connecting to your server, you'll need to configure them to include the identity token as a bearer token in the Authorization header. Alternatively, grant specific service accounts the roles/run.invoker role for server-to-server authentication.

Step 7: Connect Private GCP Services

If your MCP server needs to access Cloud SQL, Cloud Memorystore, or other private GCP resources, connect to your VPC:

gcloud run services update my-mcp-server   --region us-central1   --vpc-connector my-vpc-connector   --vpc-egress all-traffic

This routes all egress from your MCP server through your VPC, giving it access to private Cloud SQL instances via their internal IP addresses without exposing them to the public internet.

Monitoring and Logging

Cloud Run automatically forwards stdout/stderr to Cloud Logging. Use structured JSON logging to make queries easier:

// Structured logging for Cloud Run
function log(severity: 'INFO' | 'WARNING' | 'ERROR', message: string, data?: object) {
  console.log(JSON.stringify({
    severity,
    message,
    timestamp: new Date().toISOString(),
    ...data
  }))
}

View logs in the Google Cloud Console under Cloud Run → your service → Logs, or query with:

gcloud logging read   'resource.type="cloud_run_revision" AND resource.labels.service_name="my-mcp-server"'   --limit 50   --format json

CI/CD with Cloud Build

Automate deployments from GitHub with Cloud Build:

# cloudbuild.yaml
steps:
  - name: 'node:20'
    entrypoint: 'npm'
    args: ['ci']
  - name: 'node:20'
    entrypoint: 'npm'
    args: ['run', 'build']
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', 'us-central1-docker.pkg.dev/$PROJECT_ID/mcp-servers/my-mcp-server:$COMMIT_SHA', '.']
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'us-central1-docker.pkg.dev/$PROJECT_ID/mcp-servers/my-mcp-server:$COMMIT_SHA']
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    args:
      - 'run'
      - 'deploy'
      - 'my-mcp-server'
      - '--image'
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/mcp-servers/my-mcp-server:$COMMIT_SHA'
      - '--region'
      - 'us-central1'

Cost Optimization

Cloud Run's per-request pricing makes it economical for MCP workloads:

• Dev/personal servers: Set --min-instances 0 and accept cold starts. Cost is near-zero for low traffic.
• Team servers: Use --min-instances 1 to eliminate cold starts. The cost of one always-warm instance is ~$5-15/month at 1 vCPU/512MB.
• Production: Set min instances based on your p95 concurrency. Cloud Run's automatic scaling handles burst traffic.

Browse the MCP server directory for servers to deploy, and check our guides for other platforms: AWS Lambda, Cloudflare Workers, and Railway.