Documentation / Google Agent Registry

Connect Google Agent Registry

Meridian lists agents in your governance project once a day and posts mapping records. You grant a role to Meridian's service account. You do not create a key for Meridian. Google brings agents only. Assign owners in Meridian. It is Early access until a customer connects.

The connect card is on Settings, Google Agent Registry. Dollars stay on the Vertex SKU rows. A separate read listsresource.name beside each saved runtime. That read does not write spend and does not decide a match. The setup steps are also in Google Agent Registry agents in Meridian.

1. Enable the API

On the governance project:

gcloud services enable agentregistry.googleapis.com --project=GOVERNANCE_PROJECT_ID

2. Choose a role

Use the custom role when you want the smallest grant. Meridian calls only agentregistry.locations.list and agentregistry.agents.list.

gcloud iam roles create meridianAgentRegistryReader \
  --project=GOVERNANCE_PROJECT_ID \
  --title="Meridian Agent Registry reader" \
  --description="List locations and agents for Meridian." \
  --permissions=agentregistry.locations.list,agentregistry.agents.list \
  --stage=GA

gcloud projects add-iam-policy-binding GOVERNANCE_PROJECT_ID \
  --member=serviceAccount:SERVICE_ACCOUNT_EMAIL \
  --role=projects/GOVERNANCE_PROJECT_ID/roles/meridianAgentRegistryReader

The simple grant is roles/agentregistry.viewer. Google's IAM catalog labels that role Beta. It can also list MCP servers, skills, and endpoints. Meridian does not call those methods.

gcloud projects add-iam-policy-binding GOVERNANCE_PROJECT_ID \
  --member=serviceAccount:SERVICE_ACCOUNT_EMAIL \
  --role=roles/agentregistry.viewer

Copy the service account email from the connect card. Staging and production use different accounts. Grant the email shown on the environment you are connecting.

3. Check the connection

Open Google Agent Registry settings. Copy the service account email from Step 1 and grant it the role from the previous section. In Step 2, the field is labeled Project ID (not the name). The ID is the short lowercase value on the IAM page. The name in the console header is different.

Click Check connection. That saves the project and runs three checks: the project ID, locations, and agents. An empty global page still passes when the grant works. If Google cannot find that ID, the check says Google can't find a project with that ID.

Preview appears after the checks pass. It shows agent id, display name, version, runtime identity, and runtime reference, and it writes nothing. It says the list was cut off only when Google returned another page that was not read. A complete list does not say that. When more than 50 agents are in the list, the preview says it was cut off at 50. Removals are still counted in that case.

Manage appears once a project is connected. Stop import skips that project on the next daily read. Open names stay. While the connection is stopped, that button is Resume import. Resume import asks you to confirm, runs the check, and starts the daily read again if the check passes. The page then says Import resumed, and the button is Stop import again. Disconnect asks you to type a confirmation, then clears the saved project and its open names. Google is not changed.

Vertex dollars

If Vertex spend is already in Meridian, the detailed billing export is already on. That is the table gcp_billing_export_resource_v1_BILLING_ACCOUNT_ID. The card can read resource.name from it and show those names beside each saved runtime. It does not match them and it does not write spend. You do not turn on a second export.

Detailed usage cost is off on a billing account until someone enables it under Billing, Billing export, Detailed usage cost. Standard usage cost does not haveresource.name. Detailed export starts from the day it is enabled. A Vertex SKU with an empty resource.name stays on the SKU total. An agent id that starts with urn:agent:googleapis.com: is a Google built-in, such as Workspace Agent. Google registers it automatically. It has no customer runtime, so the preview marks it Google built-in and says No Vertex join. A runtime reference whose host is agentregistry.googleapis.com is the registry's own service record. That is also no runtime, and it is not a billable resource.