What can AI agents do with Google Cloud Spanner through Ferentin?

Ferentin exposes 15 Google Cloud Spanner MCP tools to your AI agents, grouped as Discover (3 tools), Access (4 tools) and Manage (7 tools). Every call is checked against your Ferentin policies before it reaches Google Cloud Spanner.

How is Google Cloud Spanner access secured?

Requests through the Google Cloud Spanner integration are covered by OAuth 2.0 consent, cloud iam authorization, no API keys and audit logging. These controls are applied by Ferentin, not by Google Cloud Spanner, so they hold across every connected agent.

What permissions does the Google Cloud Spanner integration require?

The Google Cloud Spanner integration requests 2 OAuth 2.0 scopes: https://www.googleapis.com/auth/spanner.admin (admin access); https://www.googleapis.com/auth/spanner.data

How do I connect Google Cloud Spanner to Ferentin?

Open the Ferentin admin console, add Google Cloud Spanner as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.

Is the Google Cloud Spanner integration generally available?

Yes. The Google Cloud Spanner integration is generally available on Ferentin, including the free tier.

Google Cloud Spanner

Generally Available

Manage Cloud Spanner instances and databases and run multi-model (SQL + graph GQL) queries — governed by Cloud IAM.

Database
Distributed SQL
Graph

Configure Google Cloud Spanner Browse the 15 tools

Authentication: OAuth 2.0
Hosting: Vendor-hosted endpoint
Required scopes: 2
Data actions: Read and write

How it works

Every agent request passes through Ferentin policy before it reaches Google Cloud Spanner.

Ferentin's Google Cloud Spanner MCP server connects agents through OAuth2 + Cloud IAM, with tools for instance/config/database management, DDL schema evolution, and session-based query execution. Graph (GQL) and semantic queries run through the SQL-execution tools. SQL calls are auto request-tagged for auditing.

AI agentAsks for something
Ferentin policies
- OAuth 2.0 consent
- Cloud iam authorization
- No API keys
- Audit logging
Google Cloud Spanner MCP serverAuthorized connection
Governed resultMasked, logged, returned

What agents can do

15 tools · you choose which ones agents may call

Search and browse what exists, without opening the content itself.

list_instances
list_configs
list_databases

Permissions requested

The OAuth 2.0 scopes Google Cloud Spanner asks you to approve when you connect.

Scope	Access
https://www.googleapis.com/auth/spanner.admin	Admin
https://www.googleapis.com/auth/spanner.data	Not rated

Before you connect

Google does not support Dynamic Client Registration (DCR) — each tenant must create its own OAuth client in Google Cloud Console.
Authentication is OAuth 2.0 + Google Cloud IAM. API keys are not accepted; access is enforced by the signing-in identity's IAM roles.
Use access_type=offline to receive a refresh token for long-lived access.
Requires roles/mcp.toolUser, roles/oauthconfig.editor, and Cloud Spanner Admin.

3 more technical notes

A x-goog-user-project header attributes quota/billing to the project.
Graph (GQL) and semantic/vector queries run through execute_sql / execute_sql_readonly — there are no separate graph tools.
SQL executions are auto request-tagged (mcp_execute_sql, mcp_execute_sql_readonly, mcp_commit) for observability.

About Google Cloud Spanner

Cloud Spanner is Google Cloud's globally-distributed, strongly-consistent relational database with unified multi-model support (relational SQL, Spanner Graph GQL, and semantic/vector data).

Developer docs

Frequently asked about Google Cloud Spanner

What can AI agents do with Google Cloud Spanner through Ferentin?: Ferentin exposes 15 Google Cloud Spanner MCP tools to your AI agents, grouped as Discover (3 tools), Access (4 tools) and Manage (7 tools). Every call is checked against your Ferentin policies before it reaches Google Cloud Spanner.
How is Google Cloud Spanner access secured?: Requests through the Google Cloud Spanner integration are covered by OAuth 2.0 consent, cloud iam authorization, no API keys and audit logging. These controls are applied by Ferentin, not by Google Cloud Spanner, so they hold across every connected agent.
What permissions does the Google Cloud Spanner integration require?: The Google Cloud Spanner integration requests 2 OAuth 2.0 scopes: https://www.googleapis.com/auth/spanner.admin (admin access); https://www.googleapis.com/auth/spanner.data
How do I connect Google Cloud Spanner to Ferentin?: Open the Ferentin admin console, add Google Cloud Spanner as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
Is the Google Cloud Spanner integration generally available?: Yes. The Google Cloud Spanner integration is generally available on Ferentin, including the free tier.