Building secure, real time AI agents with Google ADK & MCP Toolbox

Key Concepts

• Google Agent Development Kit (ADK): A framework for building AI agents.
• MCP Toolbox for Databases: A secure gateway for database access by AI agents, focusing on authentication, authorization, and query control.
• Prompt Injection: A security vulnerability where malicious prompts manipulate an LLM to perform unintended actions.
• Data Exfiltration: Unauthorized removal of sensitive data from a system.
• Least Privilege Access: Granting users or agents only the minimum necessary permissions to perform their tasks.
• Connection Pooling: Managing a pool of database connections to improve performance and prevent resource exhaustion.
• Identity-Aware Proxy (IAP): A Google Cloud service providing zero-trust access control.
• Spanner Graph & AlloyDB: Specific Google Cloud database services used in the demonstration.
• Parameterized SQL Queries: Predefined SQL queries with placeholders for input values, enhancing security and efficiency.
• Secret Manager: A Google Cloud service for securely storing and managing sensitive information like database credentials.
• Private Service Connect (PSC), Private Service Access (PSA), Global Private Access (GPA): Networking technologies used to keep data off the public internet.

---

Secure AI Agents with Google Cloud: A Detailed Overview

This presentation by Paul Ramsey, a database specialist at Google Cloud, details a solution for building secure and high-performance AI agents that access real-time enterprise data. The core of the solution leverages Google’s Agent Development Kit (ADK) and the open-source MCP Toolbox for Databases. The demonstration focuses on a fictional financial services organization, Simple Bank, and their need to automate fraud detection and improve customer service.

The Challenge: Balancing AI Autonomy with Security

Many organizations are eager to utilize Generative AI (GenAI) agents with their enterprise data, but face significant security and operational concerns. Ramsey highlights two primary hurdles:

1. Security Risks: Security teams are worried about vulnerabilities like prompt injection – where malicious prompts can manipulate the LLM – and data exfiltration – the unauthorized removal of sensitive data.
2. Operational Risks: Operations teams are concerned about agents generating inefficient queries, overwhelming databases with excessive connections, and creating unmanaged connections.

The key is to balance the autonomy of the AI agent with the stringent security requirements of the organization. As Ramsey states, “I have to balance the autonomy of my agent with the stringent security requirements of my organization.”

The Solution: ADK & MCP Toolbox – A Layered Approach

The proposed solution employs a layered approach, utilizing the ADK for agent orchestration and the MCP Toolbox as a secure gateway.

• Access Control: Users access the agent through Identity-Aware Proxy (IAP), enforcing zero-trust validation and ensuring only authorized personnel can interact with the agent.
• Tool Governance: Instead of allowing the LLM to generate SQL queries directly (a significant security risk), the MCP Toolbox exposes predefined, parameterized SQL queries as tools. The agent selects the tool, but doesn’t write the code. This provides complete control over the queries executed against the database.
• Credential Management: Database credentials are securely stored in Secret Manager and accessed only by the Toolbox host running in Cloud Run, never directly by the agent.
• Network Security: All traffic is routed over private networking using Private Service Connect (PSC), Private Service Access (PSA), and Global Private Access (GPA), preventing data exposure on the public internet.

Demonstration: Fraud Investigation at Simple Bank

The demonstration showcases a fraud analyst at Simple Bank using an AI agent to investigate a potential money laundering scheme. Traditionally, this would involve manually logging into multiple databases, crafting complex SQL queries, and analyzing data – a process that could take hours.

The agent, accessed through IAP, is initialized with tool definitions retrieved from the MCP Toolbox. Crucially, the agent doesn’t possess database connection details; it only knows which questions it’s permitted to ask the Toolbox.

Key Use Cases Demonstrated:

• Indirect Transfer Detection: The agent successfully identified indirect transfer paths between two accounts using a Spanner Graph query optimized for multi-hop traversals, triggered by a natural language query: “have there been any indirect transfers between account 75 and 199.”
• Account Blocking: The agent facilitated the immediate blocking of a destination account suspected of receiving illicit funds, demonstrating the value of real-time data and actionability.
• Ownership Identification: The agent orchestrated multiple tool calls to identify the owners of intermediary accounts, enabling their subsequent blocking.
• Audit Event Analysis: The agent retrieved and analyzed audit events for accounts associated with a known associate, flagging potentially suspicious activity (password resets, security question updates, device unlinking).
• Report Summarization: The agent automatically summarized the investigation findings and actions taken into a structured report for the analyst’s manager.

Technical Implementation Details

The agent itself, implemented in agent.py, is relatively simple, relying on a standard model and a basic prompt. The intelligence resides within the database layer, specifically in the tools defined in the toolbox config file. These tools consist of simple SELECT statements with parameters, providing granular control over query execution.

The MCP Toolbox also manages a connection pool, preventing database overload by reusing existing connections instead of establishing new ones for each agent request. Ramsey notes that “if I have a thousand agents, they aren't opening a thousand database connections. They funnel through the toolbox protecting the database from connection storms.”

Data & Statistics

While specific performance metrics weren’t explicitly stated, the demonstration emphasized the speed and efficiency gains achieved by automating tasks that previously took hours. The solution provides “up to the microsecond visibility” into data, enabling immediate action.

Logical Connections & Synthesis

The presentation logically progresses from identifying the challenges of integrating AI agents with enterprise data to presenting a comprehensive solution built on the ADK and MCP Toolbox. The demonstration effectively illustrates how this solution addresses security and operational concerns while enabling real-time data access and actionability. The decoupling of AI reasoning (ADK) from agent execution (MCP Toolbox) is a central theme, allowing for a performant and secure experience.

Conclusion

The presentation successfully demonstrates a practical approach to building secure, high-performance AI agents that can unlock the value of real-time enterprise data. By prioritizing security, controlling access, and optimizing database interactions, Google Cloud’s solution empowers organizations to leverage the power of AI without compromising data integrity or operational stability. The key takeaway is that a layered approach, combining robust agent frameworks with secure database gateways, is essential for successful AI adoption in sensitive environments.