Google's Agentic Data Cloud turned BigQuery, Spanner, AlloyDB into MCP tool calls Claude Code, Codex, and Gemini CLI fire directly.

IAM gates the service account. It does not know what you thumbs-down'd yesterday.

ThumbGate keeps a local SQLite lesson DB next to your agent and gates the MCP call before it fires. One thumbs-down and every future session refuses it.

npx thumbgate init --agent claude-code

https://thumbgate.ai/guides/gcp-mcp-guardrails
