Skip to main content
Gemini Enterprise connects to Orion through a custom MCP server data store. Once connected, your Gemini Enterprise agents can ask Orion data questions, check metrics, run workflows, and search your Context pages alongside your other connected data stores.
An official Orion connector for Gemini Enterprise is in the works with Google. Until it ships, the custom MCP server setup below is the supported way to connect.

​
Prerequisites

  • An Orion account with login credentials
  • A Gemini Enterprise app in your Google Cloud project
  • The Discovery Engine Editor role (roles/discoveryengine.editor) on that project
  • An organization policy that permits custom MCP data stores. Google Cloud blocks them by default, so an Organization Policy Administrator must turn the constraint off. If your organization also restricts data sources or egress domains, that administrator adds custom_mcp to allowedDataSources and g.runorion.com to allowedEgressFqdns

​
Get OAuth Client Credentials

Gemini Enterprise authenticates to MCP servers with OAuth 2.0 and asks for a client ID and client secret. Reach out to your Gravity Solution Consultant, who will provide credentials registered for Gemini Enterprise. Store them somewhere safe; you will enter both in the next step.

​
Create the Data Store

1

Open your app's data stores

In the Google Cloud console, go to Gemini Enterprise, select your app, and open Connected data stores.
The Connected data stores page in the Google Cloud console with the New data store button highlighted

Create a data store in Gemini Enterprise

2

Add the MCP server

  1. Click New data store
  2. Search for and select Custom MCP Server
  3. Click Add MCP server
3

Configure the connection

Choose OAuth 2.0 as the authentication method and fill in the form:
The MCP Server Configuration form in the Create data store flow, with Enable PKCE Support checked and Use HTTP Basic Authentication unchecked

Configure Orion as an MCP server

Two checkboxes decide whether the connection works:
  • Check Enable PKCE Support. Orion’s authorization endpoint rejects requests without a PKCE code challenge.
  • Uncheck Use HTTP Basic Authentication. Orion’s token endpoint only accepts client credentials in the request body, so Basic authentication fails with a 401 invalid_client error.
Click Verify Auth and sign in with your Orion credentials in the window that opens. If your email domain maps to more than one Orion organization, pick the organization Gemini Enterprise should access. Then click Continue.
4

Name and create

The location defaults to global (Global). Enter a Data connector name (for example, Orion); the ID Google generates from it cannot be changed later. Leave the optional tag and sensitive data protection policy fields blank unless your organization uses them, then click Create.Gemini Enterprise takes you to the new connector’s page, where Connector state shows Active. The next section turns Orion’s tools on.

​
Enable Orion Tools

Orion’s tools appear on the connector’s Actions screen, where you choose which ones your agents can use.
  1. Open the connector from Connected data stores, then open Actions in the left-hand menu
  2. If the list is empty, click Reload custom actions
  3. Select the tools your agents should use. Start with Ask Orion, List Projects and Get Conversation History, or use the header checkbox to select all of them
  4. Click Enable actions in the selection bar, and check that the Status column reads Enabled
Orion marks its read-only tools with the MCP readOnlyHint annotation, which Gemini Enterprise uses to run those calls without a user confirmation step. ask_orion carries no such annotation, because it starts an analysis rather than reading a stored value. The Tools Reference lists every tool by its identifier, so Get Conversation History appears there as get_conversation_history.

​
Verify the Connection

In your Gemini Enterprise app, ask the agent to list your Orion projects:
“List my Orion projects”
If the connection is working, the agent returns the projects your Orion account can access. Each user needs an existing Orion account and signs in with their own credentials the first time they use an Orion tool, so results always respect that user’s Orion permissions. The authorization lasts four weeks and refreshes automatically.
Gemini Enterprise only supports the StreamableHTTP transport, which is what Orion’s MCP server uses. If the connection fails, see Troubleshooting.