Google Data Agent Kit: Free MCP Tools for 15+ Data Cloud Services

Your coding agent can write excellent SQL. What it cannot do, out of the box, is know anything about your data: which tables exist, how they are partitioned, which ones your team trusts, or why last night's job failed. So you paste schemas into chat and watch the agent forget half of it by the next prompt. Google's Data Agent Kit ends that ritual by giving the agent a live connection to your Google Cloud data instead of a pasted summary.

It is a free set of Model Context Protocol (MCP) tools and Google-authored agent skills, generally available since September 30, 2026, according to Google's launch post by product manager Arun Nair and developer advocate Jeff Nelson. The kit connects a coding agent you already use to more than 15 Google Data Cloud services, so it can inspect schemas, run queries, read job logs, and manage resources in your live environment. That last phrase is the whole pitch and the whole risk.

A date correction before you trust today's headlines

Some coverage dated October 24, 2026 describes Data Agent Kit as newly generally available that day. That date is wrong. Google's launch post is dated September 30, 2026, and Google's weekly "What's new with Google Data Cloud" digest lists the GA in its October 5-9 roundup. Third-party coverage records version 1.0.0 on September 29, 2026 and version 1.1.0 on October 13, 2026. The October 24 stories are re-reporting the GA, not a new release, so check any other claim in those stories against Google's post before relying on it.

What Data Agent Kit actually is

The kit has two parts. First, MCP tools: connections to more than 15 Google Data Cloud services, so an agent can inspect schemas, run queries, read job logs, and manage resources live. Second, Google-authored skills: open-source instructions from Google Cloud engineers that teach an agent data practices, such as optimizing BigQuery SQL, designing Bigtable row keys, and building dbt pipelines. Third-party coverage counts 37 skills; Google's post gives no number, so treat 37 as a coverage figure, not a Google claim.

Google's worked example shows the flow. You ask the agent to forecast next month's demand for your top products and check inventory. The kit loads the relevant skills, searches Knowledge Catalog for the sales and inventory tables your team trusts, runs a forecast in BigQuery, checks stock in AlloyDB for PostgreSQL, and returns the combined answer to your editor or terminal. Every step runs with your own IAM permissions: the agent runs as you, or as a service account you impersonate, so your row- and column-level security policies still apply.

What is new at GA

BigQuery and BigQuery Graph

Graphs show relationships, like which products people buy together. Building one usually means hand-writing CREATE PROPERTY GRAPH statements and learning GQL. The bigquery-graph-author skill maps tables to nodes and edges, checks each relationship against the actual data, and shows a plan to approve before creating anything. The bigquery-graph-query skill then writes the GQL, and the IDE's graph visualizer lets you click through results.

Spanner, AlloyDB, Cloud SQL, and Bigtable

Bigtable joins the other three as a fully supported database at GA. It serves features that must load instantly, like a personalized feed or live counter, and it rewards a well-designed row key while punishing a bad one. The bigtable-basics skill designs a schema around how data will be read and flags hotspots and full table scans before creation. The agent can then create and query the table with GoogleSQL, with column families flattened into readable columns.

Lakehouse and Spark

An agent could already query Apache Iceberg tables through BigQuery. Now it can also work with those tables using serverless Spark on Managed Service for Apache Spark, with no cluster to manage, session state preserved across statements, and Iceberg branching, time travel, and schema evolution. The federate-lakehouse-catalog skill also connects a lakehouse to AWS Glue and Databricks Unity Catalog, so an agent can query that data in place with no ingestion pipeline. That federation is the feature most likely to surprise a governance team, since data outside Google Cloud becomes reachable from a Google Cloud agent session.

Pipelines: dbt, Dataform, and Airflow

Once logic works, an agent can turn it into a pipeline. It writes dbt or Dataform models, then the gcp-pipeline-orchestration skill schedules them with notebooks as an Orchestration Pipeline on Managed Service for Apache Airflow, including Gemini Enterprise Agent Platform steps like batch inference. In the IDE, a visual canvas tracks each run, and clicking Diagnose hands a failing task's logs to the agent, which proposes a fix for you to approve. Approve is the operative word throughout this product: the agent proposes, you decide.

Setup

Google says setup takes under a minute, because the kit does the boring parts itself. You sign in once and select the services you use; it automatically enables the required APIs, installs the matching skills, and configures your MCP servers. That auto-configuration is useful, and it is also the step to watch: auto-enabling APIs changes a project's surface, so try it first in a sandbox project, not the one holding your production warehouse.

As an IDE extension, search for "Google Cloud Data Agent Kit" in VS Code, Antigravity IDE, Cursor, or any VS Code-compatible editor; it is also on the VS Code Marketplace and Open VSX. In Antigravity 2.0, go to Settings, then Customizations, then Build with Google Plugins. In Cloud Shell and Cloud Workstations, it comes pre-installed. As a CLI plugin, take the command for your agent from the official GoogleCloudPlatform/data-agent-kit-plugin repository on GitHub, since the exact command varies by agent and blog posts may quote older versions.

Inside the IDE, the SQL editor and notebooks support inline code generation, @ references to tables, and diff views for suggested changes. The extension shares your active project, open file, and the error from the query you just ran, so "fix this query" just works, in Google's phrase. Google also says tuned notebook skills finish notebook tasks faster with fewer tokens; with no published benchmark in the launch post, treat that as a design goal, not a measured result. A sensible first run: install in a sandbox, ask the agent to describe a table's schema and partitioning and check it against the catalog, dry-run a query and confirm the bytes it will scan, and only then ask a real question, on a read-only service account if possible.

What it costs, with the fine print

Google's pricing sentence needs unpacking: the kit is included at no additional cost, and you pay standard pricing only for the services your agent uses. The kit is free. Everything it touches is not.

The bill that matters most is BigQuery. Third-party pricing reporting, consistent with Google's published pricing page, puts on-demand queries at $6.25 per TiB scanned after the first 1 TiB per month free. That free tier is thin: one careless full-table scan over a multi-terabyte table can eat it in a single query. The kit's skills steer the agent toward cost-aware patterns, like checking partition keys and dry-running before executing, but an agent that can run queries without asking can run expensive queries without asking. For steady workloads, capacity-based editions priced per slot-hour may beat on-demand, but that sizing decision is yours, not the kit's.

Service by service, the same logic holds: Bigtable, Spanner, AlloyDB, Cloud SQL, and serverless Spark bill at standard rates, storage bills separately from compute, and federated queries against AWS Glue or Databricks catalogs can add transfer and third-party costs outside Google's bill. New Google Cloud accounts are advertised with a $300 trial credit in the kit's documentation pages, which can absorb early experiments, but trial terms and expiry are account terms, not kit terms, so confirm them in your console before treating the trial as a budget. In short, the kit removes the software price and leaves the cloud price intact, and the cloud price is set by how much data your agent scans.

The guardrails: two layers, and only one enforces

Layer one is advisory. Skills are instructions, not controls. Third-party analysis describes a skill called accidental-data-loss-prevention that tells an agent to halt and get explicit user consent before destructive commands such as DROP TABLE or a DELETE without a WHERE clause. That is a good instruction, and it is still only an instruction: a model can misread it, a prompt injection can talk around it, and another agent build may not load it. Treat skill-based protection as a seatbelt, not a wall.

Layer two is enforced, and it is the one to build policy on. Because the agent connects as you or as an impersonated service account, row- and column-level security applies automatically. Admins can govern MCP access with IAM, screen MCP traffic with Model Armor, and scope agents with VPC Service Controls and Principal Access Boundary policies. Third-party analysis adds a concrete mechanism: run a read-only agent through a dedicated service account, or apply an IAM deny policy blocking tools where tool.isReadOnly is false, denying mcp.googleapis.com/tools.call at the organization, folder, or project level. Implement that before any agent touches production data.

Two limits from the same analysis are worth knowing. A blocked tool still appears in the agent's tool listing, revealing capabilities it cannot invoke until runtime: information leakage, not access, but leakage all the same. And the IAM controls cover Google Cloud MCP servers, with some policy attributes exclusive to gcloud, so a multi-cloud team cannot assume the same policy shape everywhere. Nor does any of this govern the agent's own provider: the model behind Claude Code, Codex, or Cursor still processes prompts and results under that provider's terms.

How it compares

Against pasting schemas, the kit is strictly better: live context beats a typed summary. Against a hand-rolled server, it trades control for speed, since Google maintains the connectors and writes the skills. Against a managed platform, it trades hand-holding for openness: skills are open source, auditable, forkable, and you keep your existing IDE and agent. That openness is a strong argument for the kit, and it is also why the IAM layer matters: the skill your agent actually runs may not be the one Google wrote.

Pros and cons

Pros: the kit itself is free; one install covers analytics, operational databases, the lakehouse, and pipelines; setup auto-configures APIs, skills, and MCP servers; skills are open source and auditable; agents run under your IAM permissions with row- and column-level security intact; federation reaches AWS Glue and Databricks catalogs without an ingestion pipeline.

Cons: cloud bills are untouched and can spike on careless scans; skill-based protections are advisory, not enforced; blocked tools still appear in listings; IAM mechanisms are Google Cloud-specific; some October 24 coverage misdates the GA; and there is no published independent benchmark for the claimed token savings.

Who should use it, and who should wait

Use it now if you already work in Google Cloud and use VS Code, Cursor, Claude Code, or Codex, and want your agent to stop guessing about your data. Start in a sandbox, on a read-only service account, with dry runs before execution. Wait, or proceed slowly, if your data lives mostly outside Google Cloud, if governance has not approved agent access to production tables, or if you need one policy shape across clouds. In those cases the evaluation is a governance project first. Either way, do not let an agent near production data on a skill's promise; let it near production data on an IAM policy you wrote yourself.

FAQ

Is Google Data Agent Kit free?

The kit is included at no additional cost, according to Google. You still pay standard pricing for every service your agent uses, including BigQuery compute and storage, Bigtable, Spanner, AlloyDB, Cloud SQL, and serverless Spark. Free kit, paid cloud: that is the whole pricing story.

Which coding agents does it work with?

As an IDE extension, it works in VS Code, Antigravity IDE, Cursor, and other VS Code-compatible editors. As a plugin, it supports Antigravity 2.0, Antigravity CLI, Claude Code, and Codex, and it comes pre-installed in Cloud Shell and Cloud Workstations. If your agent is not on that list, the kit does not officially cover it.

When did it actually reach general availability?

September 30, 2026, according to Google's launch post. Some coverage dated October 24, 2026 re-reports the GA as if it were new; Google's weekly digest places it in the October 5-9 roundup, and version 1.1.0 followed on October 13, 2026 according to third-party coverage. Trust the September 30 date.

Can the agent delete my tables?

It can only do what its IAM permissions allow, which is the protection that matters. An advisory skill tells it to stop and ask before destructive commands, but skills do not enforce. For a guarantee, use a read-only service account or an IAM deny policy on non-read-only tools, and test that policy before it touches anything real.

Does it work with data outside Google Cloud?

Partly. The federate-lakehouse-catalog skill connects a lakehouse to AWS Glue and Databricks Unity Catalog, so an agent can query that data in place. That is federation for lakehouse tables, not a general connector for every external database, and governance for that external data still sits with its own platform.

Key takeaways

• Google Data Agent Kit is a free set of MCP tools and Google-authored skills that connects coding agents to more than 15 Google Data Cloud services, generally available since September 30, 2026, not October 24 as some coverage claims.
• The kit itself costs nothing extra, but every query, job, and Spark session bills at standard Google Cloud rates, with BigQuery on-demand reported at $6.25 per TiB scanned after 1 TiB free each month.
• GA adds BigQuery Graph, Bigtable, and Managed Service for Apache Spark, plus federation to AWS Glue and Databricks Unity Catalog and orchestration through dbt, Dataform, and Managed Service for Apache Airflow.
• Safety has two layers: advisory skills that ask before destructive actions, and IAM controls that actually enforce access, and only the IAM layer should carry a production decision.
• Start in a sandbox on a read-only service account, dry-run before executing, and check secondary coverage against Google's own post before trusting a launch date.

Data Agent Kit is not a new database, a new model, or a shortcut around governance. It is plumbing: good, free, open plumbing that lets an agent see your data as it actually is. Used with a read-only account and a dry run before every expensive query, it is a genuinely useful free tool. Used with production credentials and no policy, it is a fast way to let an agent scan, and bill, everything it can see. The difference is in the account you give it, and as of October 24, 2026, that choice is still yours to make carefully.

Official links: Google's Data Agent Kit GA announcement, Data Agent Kit documentation, and the official plugin repository on GitHub. Related reading on this site: OpenAI Comes to Google Cloud: GPT-6 Models and Codex Land in Model Garden and AWS Infinity: 75,000 AI Agents on a Raspberry Pi, Zero Compute While They Wait.