Google Gemini Enterprise

Gemini Enterprise connects to CARTO through a custom MCP server data store, configured in the Google Cloud console. Once connected, you can also upload the CARTO Agent Skills so the agent uses the CARTO tools well.

Requirements

• A Gemini Enterprise license and a Google Cloud project.

• The Discovery Engine Editor role (roles/discoveryengine.editor) to create the data store.

• Your CARTO MCP Server URL.

• A CARTO SPA OAuth Client. You create it in the OAuth step below.

• For Agent Skills, an administrator with the Gemini Enterprise Admin role (roles/discoveryengine.agentspaceAdmin).

Custom MCP lives under Data Stores, not under Agents or Actions. Admin console: console.cloud.google.com/gen-app-builder.

Connect the CARTO MCP Server

1. Create the data store

1. In Google Cloud Console, open AI Applications > Data stores > Create data store.

2. Under MCP servers, pick the Custom MCP Server card and click Add MCP server.

3. Under MCP Server Configuration, choose OAuth 2.0.

2. Connect via OAuth

1. In CARTO, go to Developers > Credentials > SPA OAuth Clients and click Create new > SPA OAuth Client. Set the Application Login URL to Gemini Enterprise's redirect URI:

   https://vertexaisearch.cloud.google.com/oauth-redirect

   Save, then copy the Client ID and Client Secret.

2. Back in Google Cloud Console, fill in the MCP Server Configuration fields:

   Field	Value
   MCP Server URL	Your MCP Server URL. Use the SSO login URL if your organization signs in through SSO.
   Authorization URL	https://auth.carto.com/authorize
   Authorization URL Parameters	&audience=carto-cloud-native-api
   Token URL	https://auth.carto.com/oauth/token
   Client ID / Client Secret	From the SPA OAuth Client you just created
   Scopes	openid profile email read:workflows write:workflows

   The &audience=carto-cloud-native-api parameter is easy to miss. Without it, sign-in appears to succeed but the connection can't use any CARTO tools.

3. Click Verify Auth and complete the CARTO sign-in. If it fails, see Troubleshooting.

4. Click Continue, name the data connector, select a pricing tier, and click Create.

5. Wait until the connector status changes from Creating to Active. This can take a few minutes; refresh the page to check.

6. Open the data store, go to the Actions tab, and click Reload custom actions to fetch CARTO's tool list.

7. Enable the tools you want to use. All tools are disabled by default.

Registering an MCP server creates a billable data store, even when it isn't linked to an app. Remove data stores you no longer need.

Gemini Enterprise can't render maps inline, so leave the view_map tool disabled or ask the agent for the map URL and open it in CARTO.

3. Link the data store to your Gemini Enterprise app

1. In AI Applications, open Apps.

1. Create a Gemini Enterprise app or open an existing one.

1. On the Connected data stores tab, click Connect an existing data store and select the CARTO data store you just created.

1. In the Gemini Enterprise chat, authorize the CARTO connector when prompted.

Add the CARTO Agent Skills

CARTO Agent Skills are playbooks that teach the agent how to use the CARTO tools well: which tool to reach for, the right SQL dialect per warehouse, and recipes for common spatial analyses.

1. Enable skills. An administrator opens your app in Google Cloud Console, goes to Configurations > Feature Management, and turns on Enable skills. Until then, the Skills menu doesn't appear in Gemini Enterprise.

2. Upload the skills. From the Skills menu, upload each CARTO skill as a ZIP file. You can select several at once. See Agent Skills → Installation for how the skills are distributed.

3. Use them. Ask something CARTO-specific, such as "List my CARTO maps". The agent picks the matching skill, or you can call one with @ and the skill name.

Troubleshooting

• "Callback URL mismatch" — the SPA OAuth Client's Application Login URL isn't https://vertexaisearch.cloud.google.com/oauth-redirect. Fix it in Developers > Credentials > SPA OAuth Clients and click Verify Auth again.

• "[401010] Unauthorized" — you signed in to CARTO as a user from a different organization than the one that owns the SPA OAuth Client. Sign out and sign in with the right user.

• "Failed to reload custom actions" — the connector is still Creating. Wait until it's Active and retry.

• Sign-in works but there are no tools — the Authorization URL Parameters field is missing &audience=carto-cloud-native-api, or the MCP Server URL was typed by hand. Fix it and click Reload custom actions.

• Sign-in doesn't use your identity provider — your organization uses SSO. Use the SSO login URL as the MCP Server URL.

For general OAuth issues, see Connecting with OAuth.