Google previews Connected Apps Platform for third-party MCP apps in Gemini and AI Mode in Search

Google has opened a preview of the Connected Apps Platform, a single developer environment for building, testing and publishing third-party apps that run inside the Gemini app and inside Search. The announcement, published on the Google blog on October 28, 2026 by Chips Mistry, Group Product Manager for Search, and Mai Lowe, Group Product Manager for the Gemini app, describes the goal in one line: developers should be able to "build once and reach high-intent users across both Search and the Gemini app." Until now, a service that wanted to appear in Google's AI products had to deal with separate integration stories; the new platform puts registration, testing, review and post-launch monitoring behind one portal, the Google Connected Console.

The technical foundation is the Model Context Protocol. Developers can expose their service through a remote MCP server hosted in the cloud, or through Android MCP, which is built on Android AppFunctions and runs the app's tools locally on the user's device. Once a user links an app to their Google account, Gemini or AI Mode can read that user's data in the service and take actions on their behalf during a conversation, with explicit confirmation for anything that changes state. Google says more than 50 Connected Apps are already live across Search and Gemini, in categories that include productivity, event ticketing, and health and fitness.

The platform is a preview, not a general release. Google says access is opening in phases and that more developers, markets and Google products will be added over the coming months. Developers apply for access through an interest form and are then onboarded into the Connected Console on a self-service basis.

··········

WHAT THE CONNECTED APPS PLATFORM DOES.

According to the developer documentation, the platform brings an app's functionality into Google products so that users can work with their account data and trigger actions from within an AI conversation. The documentation is explicit about the user model: people link an app once, and after that the app is available whenever it is relevant across the supported Google surfaces. The surfaces named today are the Gemini app, AI Mode in Search and, in Google's wording, "other Google AI surfaces," which leaves room for further products without naming them.

The blog post frames the change around the developer's workflow. Before an app goes to review, the developer chooses whether it should go live in Search, in Gemini or in both. After launch, the Connected Console shows traffic, latency and error rates, which gives developers the kind of operational visibility they normally get from their own API gateways. Google also stresses brand control: apps carry verified logos and rely on authenticated accounts, so a user who invokes a service inside Gemini is dealing with the real provider rather than a lookalike.

On the user side, invocation is conversational. A user can type @ followed by the app's name, or simply mention the app in a prompt; the MCP developer guide says the app then stays in context for relevant prompts during the session. The examples Google gives are ordinary consumer tasks, such as ordering groceries, building playlists or confirming a dinner reservation in Gemini.

··········

TWO INTEGRATION PATHS: REMOTE MCP SERVER AND ANDROID MCP.

The platform offers two connection types, and the choice matters because the documentation says it cannot be changed after an app is created. The remote MCP server path targets Gemini and Search on the web, Android and iOS. The Android MCP path targets on-device actions in Gemini on Android phones and tablets and is tied to an existing Google Play app.

........

Aspect	Remote MCP server	Android MCP
Built on	Model Context Protocol over HTTPS	Android AppFunctions, Jetpack AppFunctions SDK
Where tools run	Developer's server, any cloud	Locally on the user's device
Surfaces	Gemini and Search on web, Android, iOS	Gemini on Android phones and tablets
Review	Submitted from Connected Console	Reviewed with the Play app's Production release
Availability set by	Countries, languages, products chosen in console	Play store listing languages and country targeting
Limit per app	One connection type, fixed at creation	One Android MCP connected app per Play app

........

For the remote path, the integration standards are specific. Servers must use the Streamable HTTP transport, specification version 2025-03-26 or later, through a single HTTP endpoint that accepts POST for all JSON-RPC calls; the legacy HTTP+SSE transport from 2024-11-05 is not supported. Google currently supports MCP protocol versions up to 2025-11-25 and asks developers not to adopt newer revisions yet. Stateless servers may answer optional GET requests with HTTP 405. Developers who filter inbound traffic by IP address must allow HTTPS on port 443 from a list of Google address blocks published in the documentation.

For Android, the developer uploads an Android App Bundle with implemented AppFunctions to a Play release, and the Connected Console detects the app functions, tool count, languages and country targeting from the bundle. There is no separate review step for the connected app: Google reviews it together with the Play app's Production release and publishes it automatically when that release rolls out, which the documentation notes can lengthen Play review times.

··········

HOW DEVELOPERS REGISTER, TEST AND PUBLISH AN APP.

The registration flow in the Connected Console is a sequence of fixed steps. A developer creates the app, picks a category (which cannot be changed later) and chooses the connection type. The listing requires a 512 × 512 pixel icon in JPG or PNG up to 1 MB, a one-sentence description under 30 words, at least three capabilities and at least three example prompts, of which at least two must start with @ and the app name and one must mention the app naturally. Terms of Service and Privacy Policy URLs are mandatory.

For a remote server, the developer enters a public HTTPS endpoint and proves domain ownership by hosting a verification file at /.well-known/google-connected-apps, which must return HTTP 200 without redirects. Authentication is then configured either as machine-to-machine access through OAuth Client Credentials or as user-delegated access through the Authorization Code flow; the platform documentation describes the user-facing model as OAuth 2.1. For user-delegated apps, Google requires seeded test accounts with sample data and two-factor authentication disabled, and warns that an app it cannot fully test "may be rejected during review."

After syncing tools and fixing any errors flagged as "Must fix," the developer sets availability by country or region, language and product, enables or disables individual tools, chooses which context signals a tool may receive, and marks actions that need user confirmation. Testers are added with @gmail.com accounts, and the documentation says visibility can take up to 10 minutes. The release is then sent for review and, once marked ready, published. Any later change to tools or server behaviour requires a new version, and Google recommends a separate endpoint per version.

The documentation also lists the commands it suggests for local validation and deployment, taken here from the MCP developer guide:

npx @modelcontextprotocol/inspector
gcloud run deploy <server-name>

Developers can additionally debug inside Gemini itself through Gemini Apps Developer Mode, available at gemini.google.com/devmode, which shows JSON-RPC payloads, HTTP status codes and latency, displays how Gemini parsed tool schemas and safety annotations, and can simulate date, time and language.

··········

THE RULES GOOGLE SETS FOR TOOLS, DATA AND SECURITY.

The most consequential part of the documentation for developers is the set of integration standards, because they determine whether an app passes review and how reliably Gemini will call it. Tools must be atomic, with one function each, flat schemas and explicit parameter types; servers that expose dozens of tools or broad "mega-tools" may be flagged for revision. Admin, health-check and setup tools should not be exposed to the model at all, large datasets must be filtered on the backend rather than returned raw, and numeric identifiers should be sent as strings because IDs of ten or more digits risk truncation.

Safety annotations carry real weight. Read-only tools should set readOnlyHint: true, while state-changing tools should set destructiveHint: true and, where appropriate, openWorldHint: true to trigger confirmation prompts. Google states that if annotations are omitted, clients assume a tool is not read-only and is destructive, which means an unannotated search tool would ask users for confirmation on every call. Responses must be serialized JSON inside text content, since structuredContent is not yet supported, and state-changing actions must return an explicit confirmation message rather than an empty string.

The security guidance targets prompt-injection patterns directly. Tool descriptions must describe what a tool does without instructing the model to take follow-up actions, must not use attention-grabbing formatting such as "CRITICAL," must not reference other apps or include competitive or SEO-style preference instructions, and must not name parameters after agent internals such as system_prompt or conversation_history. On data, developers are told to use opaque identifiers, avoid requesting personal, health or sensitive business data, and never forward user queries, location or context to unauthorized third parties or logging services. Location and locale signals are only delivered if enabled in the console, and precise location is limited to Gemini and to permitted verticals.

........

Requirement	Value in Google's documentation
MCP protocol version	Up to 2025-11-25
Transport	Streamable HTTP, spec 2025-03-26 or later
Legacy HTTP+SSE	Not supported
UI resource size	15 MB each, 100 MB per server
UI MIME types	HTML, JavaScript, CSS, MCP app HTML
App icon	512 × 512 px, JPG or PNG, up to 1 MB
Description	One sentence, under 30 words
Example prompts	At least three, two starting with @

........

Apps can also render interactive interfaces through MCP Apps. A tool's output can be bound to a UI resource, which Gemini displays in a sandboxed iframe within the conversation. UI resources are fetched when tools are ingested, so changing them requires re-ingestion, and the content security policy is restrictive by default: external scripts must be inlined or loaded with a SHA-256 subresource integrity hash.

For terminal failures, Google defines platform error codes that servers raise as MCP errors, including -32300 when a user has hit a usage limit, -32302 when the user lacks permission or a subscription, and -32502 when a dependent service is down. Recoverable problems, such as an invalid ID, should instead come back as a normal text message so the model can correct course.

··········

WHAT CHANGES FOR GEMINI USERS AND FOR DEVELOPERS.

For users, the visible change is a growing catalogue of services that can be called by name inside Gemini and, increasingly, inside AI Mode in Search. Google says Adobe, Experian, Localiza and Peloton are already live in Gemini and will reach Search in the coming weeks, while a new Calm integration launches across both surfaces. Linking happens once, write actions require manual confirmation, and the help pages for Search and Gemini list the available apps.

Gemini's help center separately documents custom apps, which let users connect an MCP server of their choice by URL. That feature currently has narrower conditions: users must be 18 or older and in the US, must use a personal Google account rather than a work or school account, must keep Keep Activity turned on, and can add custom apps only from the Gemini web app, after which they also appear on mobile; custom apps are English-only for now. Google warns that it does not control, monitor or secure third-party MCP servers, that apps may request more data than they need, and that Gemini may share information from chats and other sources, including Connected Apps and Personal Intelligence, with the custom app.

For developers and product teams, the practical significance is distribution. An MCP server built for other assistants can, with Google's specific constraints on transport, protocol version, annotations and descriptions, become a listing in two of Google's largest AI surfaces from a single registration. The cost is a review process whose duration Google does not disclose, a frozen tool schema per version, and a set of rules that will require many existing MCP servers to be refactored, particularly those that rely on broad multi-purpose tools or unannotated read operations. Teams already experimenting with Google's agent tooling, such as the extension system covered in our article on Google Agents CLI, will find the same emphasis on explicit capabilities and supply-chain hygiene here.

··········

WHAT IS ESTABLISHED AND WHAT REMAINS OPEN.

What Google has documented is substantial: two integration paths built on MCP and Android AppFunctions, a single console for registration, testing, review and monitoring, precise transport and protocol requirements, detailed rules on tool design, safety annotations and data handling, and a live base of more than 50 apps with named partners. The integration standards read as a deliberate attempt to make third-party tools predictable for the model and resistant to manipulation, and they are more prescriptive than a generic MCP deployment would require.

Several important questions remain unanswered in the official material. Google has not said which countries or languages the preview covers beyond what developers can configure in the console, how long reviews take, whether there are rate limits or payload limits on tool calls, or how monetization will work for developers whose apps drive transactions inside Gemini or Search. It has also not explained how Search will rank or surface Connected Apps against organic results, a question that matters to publishers and merchants as AI Mode grows. Those details will decide whether the platform becomes a primary distribution channel for services or remains a convenience layer, and they are worth watching as Google widens access over the coming months alongside its model roadmap, from Gemini 4 Argon onward.

··········

FOLLOW US FOR MORE.

·····

DATA STUDIOS

·····

datastudios.org