Google has made Data Agent Kit generally available, ending the preview that ran through the summer. The free, open source kit installs into coding agents such as Antigravity, Claude Code, Codex, Cursor and VS Code-compatible editors. It pairs MCP tools for more than fifteen Google Data Cloud services with 37 Google-authored skills under Apache 2.0. The GA release adds BigQuery Graph, Bigtable and Managed Service for Apache Spark.
The accidental-data-loss-prevention skill tells the agent to stop and get explicit user consent before irreversible actions such as DROP TABLE, TRUNCATE or KMS key destruction. That is guidance the agent is asked to follow, not an enforced control. For enforcement, Google documents an IAM deny policy that blocks any MCP tool where tool.isReadOnly is false, applied at the organization, folder or project level. Blocked tools still show up in tools/list, the controls cover only Google Cloud MCP servers, and resource.service and tool.name are available only through gcloud, not the console.
Ankit Dongre, an AI engineer at viaSocket, argues that permissions do not tell an agent whether a timed-out write committed. He says Data Agent Kit's tool results do not currently carry an idempotency key or commit status. Microsoft's Agent 365 integration with Azure API Management takes a different approach, enforcing governance at a gateway that is in public preview.
Why it matters if you build agents
Teams can use IAM deny policies to keep coding agents read-only on Google Cloud MCP tools instead of relying only on skill guidance. They should still expect agents to see tools they cannot call, and plan for writes that time out and may have partly committed.
Get stories like this every weekday
One short email with the day's agent tooling news.