Give Claude access to BigQuery and Google’s other remote MCP servers with an OAuth client from your own Google Cloud project, set up in the Enterprise Admin Console.
When Claude Desktop is deployed on third-party inference, Claude can work with your organization’s BigQuery and other Google data through Google’s remote MCP servers, for example the BigQuery server at https://bigquery.googleapis.com/mcp. The device talks to Google directly: users’ Google tokens stay on the device, and no Google data passes through Anthropic’s infrastructure.
Google’s remote MCP servers don’t support dynamic client registration, and Google’s token endpoint requires the client secret even for a client of the Desktop app type. You create one Desktop-app OAuth client in your Google Cloud project, enter its client ID and client secret in the server’s entry, and each user signs in with their own Google account. Google doesn’t treat a Desktop-app client secret as confidential, so the Enterprise Admin Console stores it with the entry, as described under Where the client secret goes. That page also explains each OAuth field.
In the Google Cloud project that holds your BigQuery data, enable the BigQuery MCP server and grant each user the MCP Tool User role (roles/mcp.toolUser) together with the BigQuery roles their queries need. Google’s Use the BigQuery MCP server guide covers both.
2
Create a Desktop-app OAuth client in Google Cloud
If the project has no OAuth consent screen, configure one first in the Google Cloud Console under APIs & Services → OAuth consent screen. Choose the Internal user type when all users are in your Google Workspace organization. With External, add every user as a test user while the app is in testing, or Google blocks their sign-in.Then open APIs & Services → Credentials, choose Create credentials → OAuth client ID, and select Desktop app as the application type. When Google shows the new client, copy its Client ID (ends in .apps.googleusercontent.com) and Client secret (begins with GOCSPX-). You don’t add redirect URIs, because Desktop-app clients accept loopback redirects automatically.
3
Add the server in the Enterprise Admin Console
In the Enterprise Admin Console (claude.ai → Organization settings), open the Connectors page under Desktop 3P. Under Managed MCP servers, click Add → Blank and fill in the entry:
Field
Value
Name
BigQuery
Transport
Streamable HTTP
URL
https://bigquery.googleapis.com/mcp
OAuth
Bring your own client
Client ID
The client ID from step 2
Client secret
The client secret from step 2
Authorization server
["https://accounts.google.com"]
A BigQuery entry on the Connectors page with OAuth set to Bring your own client.
Click Save changes. Users’ apps pick up the new entry as described under Configuration updates. Devices need outbound HTTPS access to bigquery.googleapis.com, accounts.google.com, and oauth2.googleapis.com.If you manage configuration through MDM or a bootstrap server instead, the equivalent managedMcpServers entry is:
Each user opens Customize → Connectors in Claude Desktop, clicks Connect next to BigQuery, and approves Google’s consent screen in the browser. Claude Desktop asks Google for offline access automatically, so the token refreshes in the background without another sign-in.
Google’s other remote MCP servers take the same Client ID, Client secret, and Authorization server values. For the Google Workspace servers (Gmail, Drive, Calendar, Docs, Sheets, Slides, and Chat), that guide lists each server’s URL and prerequisites, including a Google Cloud project enrolled in Google’s Workspace Developer Preview Program.
