Agent Gateway egress from Agent Runtime to VPC network

1. Introduction

This Codelab explores Agent Gateway egress governance for AI agents accessing remote endpoints through a private VPC network. Agent Gateway operating in egress (agent-to-anywhere) mode supports private connectivity to a VPC network using Private Service Connect (PSC) interfaces. In this scenario, Agent Runtime uses Agent Gateway to access a remote streamable HTTP MCP server hosted on Cloud Run by using a Private Service Connect (PSC) endpoint for Google APIs in the VPC network.

AI apps, from standalone chatbots to autonomous systems with multi-agent workflows, can dynamically invoke external tools. Providing agents with controlled access for querying databases, fetching web content, and executing actions is essential for safe and productive agents. However, in enterprise environments, securing agent tool execution is a challenge. If an agent has direct network access, prompt injection attacks or model hallucinations can cause the agent to exfiltrate sensitive data or run destructive commands.

To manage autonmous agents at scale, Agent Gateway provides a centralized, zero-trust enforcement point directly integrated into the Agent Platform architecture. Instead of relying on custom implementations unique to each application or agent code, Agent Gateway provides network routing, agent governance, and runtime security enforced at the platform level.

When Agent Gateway operates in egress (agent-to-anywhere) mode, it proxies all outbound requests from agents configured to use the gateway. Each agent workload request is authenticated using the unique Agent Identity and authorized using Identity-Aware Proxy (IAP) policies. MCP tool calls are dynamically decoded and inspected for policy enforcement. Security admins can centrally enforce fine-grained permissions to ensure agents can only invoke approved endpoints and methods.

What you build

• Agent Gateway in egress (agent-to-anywhere) mode
• Identity-Aware Proxy (IAP) authorization extension
• Agent Runtime ADK agent with agent identity
• Cloud Run streamable HTTP MCP server
• Agent Registry with Google API and custom MCP endpoints
• Authorization policies with IAM access control
• VPC network resources, Cloud DNS zone, and PSC endpoint for Google APIs
• PSC network attachment for Agent Gateway egress
• Cloud Next Generation Firewall (NGFW) firewall policy rules

Fig 1. Codelab architecture

What you learn

• How to deploy Agent Gateway in a structured configuration sequence
• How to configure Agent Gateway with private VPC network connectivity
• How to transition authorization policies from a dry-run to enforced mode
• How to register Google API endpoints and MCP servers in the Agent Registry
• How to audit Agent Gateway logs to validate egress governance
• How to validate Agent Gateway egress traffic using Cloud NGFW logs

What you need

• A Google Cloud project with billing enabled
• IAM permissions to provision networking services, BigQuery datasets, and Agent Platform resources
• A POSIX-compatible shell (bash or zsh) with Google Cloud CLI (gcloud and bq components) installed
• Command-line tools: git, curl, jq (JSON processor), Python 3, and uv (Python package manager)

2. Concepts

Deployment sequence

This codelab follows a structured configuration sequence so agents have access to the necessary resources on initialization and connectivity can be confirmed before applying enforced access policies.

This Codelab uses the following deployment sequence:

1. Start in DRY_RUN mode: Ensure that agent requests are successfully arriving at the gateway and passing through (audit-only mode).
2. Register all services: Register all agentic components in Agent Registry and confirm agent tool access. Use Cloud Logging and the Agent Gateway observability dashboard to view queries to Agent Registry.
3. Create authorization policies: Create and apply authorization policies to allow egress traffic from agents to MCP servers and endpoints.
4. Switch to ENFORCED mode: Update authorization extension policy to enforce policies and block unauthorized egress traffic.

Fig 2. Deployment sequence

Egress routing topology

Agent Gateway egress (agent-to-anywhere) acts as a centralized, zero-trust outbound proxy for agentic workloads. When an agent makes a request to an external tool or API, the outbound request is intercepted by Agent Gateway and evaluated against governance policies before routing to its destination. In a Google Cloud Agent Platform architecture, Agent Gateway provides data plane connectivity to:

• Private networks (VPC): Outbound traffic targeting internal enterprise APIs, microservices, databases hosted within private VPCs, and on-premises or cross-cloud networks reachable through hybrid connectivity.
• External networks (Internet): Outbound traffic targeting third-party web services, SaaS APIs, or public endpoints.
• AI services & Agent Platform: Outbound traffic targeting managed Google Cloud APIs, foundation models, Google MCP endpoints (such as BigQuery), and platform governance services (Agent Registry and IAP policies).

Fig 3. Agent Gateway egress routing topology

The focus of this Codelab is outbound traffic from a custom agent on Agent Runtime targeting a PSC for Google APIs endpoint deployed in a VPC network. This architecture enables private access to the MCP server hosted on Cloud Run by using the PSC network attachment for Agent Gateway egress.

VPC connectivity

Agent Gateway egress (agent-to-anywhere) is able to connect to a VPC network by specifying the networkConfig: egress: networkAttachment: [URI] in the deployment YAML configuration file. This setting configures routing rules on Agent Gateway to send traffic that resolves to private IP addresses through the PSC network attachment into the VPC network.

Fig 4. Agent Gateway VPC connectivity

Agent Gateway is able to resolve private DNS hostnames using Cloud DNS peering to a specified target project and VPC network. Any private zones listed in the dnsPeeringConfig: domains: [NAME] configuration will use Cloud DNS records in the target project. Any other DNS queries will use the default VPC Cloud DNS public resolver.

This concludes the concepts portion... next on to the Setup section.

3. Setup

Required IAM roles

The following roles are required to create the resources in this Codelab:

Alternatively, use a broad basic role like roles/admin or legacy role roles/owner.

Access your project

This Codelab uses a single Google Cloud project. Configuration steps use gcloud CLI and Linux shell commands.

Start by accessing your Google Cloud project command line:

• Cloud Shell at shell.cloud.google.com, or
• A local terminal with gcloud CLI installed

Set your Project ID

gcloud config set project SET_YOUR_PROJECT_ID_HERE

Authenticate session

# login to gcloud cli
gcloud auth login

# login for gcloud api
gcloud auth application-default login

Set shell environment variables

# set custom var for slug (eg, "foo") and region preference
export SLUG="foo"
export REGION=