· Gary O'Keeffe · AI & Data · 4 min read
Connecting Gemini to Your Lab Data
Gemini in Workspace and Gemini Enterprise are different products with different capabilities. Here's what you can actually connect.
Google has several products with “Gemini” in the name, and they don’t all do the same thing. If you’re trying to connect Gemini to your lab data, the first question is: which Gemini?
Gemini in Google Workspace vs. Gemini Enterprise
Gemini in Google Workspace is built into Gmail, Docs, Sheets, and other Workspace apps. It can summarize emails, draft documents, and analyze spreadsheets. It works with the data already in your Workspace environment.
Gemini Enterprise is a separate product with its own admin console and expanded capabilities, including custom MCP data stores. If you want to connect Gemini to your LIMS, ELN, or instrument data, you need Gemini Enterprise.
Check which product your organization has licensed. The capabilities are different.
What Gemini Enterprise can connect to
Gemini Enterprise supports custom MCP server data stores. These are external services that Gemini can query to retrieve information. The server must support HTTPS and StreamableHTTP transport, with OAuth for authentication.
Custom data stores are blocked by default by organization policy. An admin must explicitly enable them.
When enabled, Gemini can call your MCP server to search samples, retrieve experiment results, or query instrument metadata—whatever tools you expose. The request comes from Google’s infrastructure, authenticated with the user’s identity through your OAuth setup.
Where to run the MCP server
The pattern is the same as Claude, ChatGPT, and Copilot: don’t run the MCP server directly on your lab network. Run it in your cloud account, next to a curated copy of your data.
On Google Cloud, Cloud Run is a natural fit. It’s serverless, scales to zero when idle, and integrates with Cloud IAM for authentication.
The MCP server queries a curated data layer—BigQuery, a Cloud SQL database, or an open-source stack. The curated layer is populated by pipelines that read from your systems of record. Your LIMS stays behind the firewall.
Authentication and authorization
Gemini Enterprise uses OAuth to authenticate users to your MCP server. The user proves their identity through your organization’s Google Workspace or Cloud Identity.
That gets you authentication. Authorization—what each user can access—is your responsibility. Implement it server-side in your MCP server. Just because someone can authenticate doesn’t mean they can query every dataset.
Google’s egress IPs are shared across all Google Cloud customers. IP allowlisting is a useful filter but not a security boundary.
The BigQuery path
If you’re already on Google Cloud, BigQuery is often the natural curated layer. It handles large datasets, supports fine-grained access controls, and integrates well with other GCP services.
The workflow:
- Pipelines read from your systems of record (LIMS, ELN, instruments)
- Data lands in BigQuery with linked records and enforced permissions
- Your MCP server queries BigQuery
- Gemini queries your MCP server
BigQuery isn’t required—you can use any data store your MCP server can query. But if you’re in the GCP ecosystem, it’s the path of least resistance.
VPC Service Controls and residency
For data that must stay in specific regions, Google Cloud offers VPC Service Controls. You can restrict which services can access your data and from where. This is relevant if you have residency requirements or want to limit data exposure.
Regional endpoints are available for Vertex AI. Check the current documentation for what’s available in your region.
What about Gemini in Workspace apps?
Gemini in Workspace (not Enterprise) works with data in Google Drive, Docs, Sheets, and Gmail. It doesn’t support custom MCP data stores.
If you just want Gemini to work with documents and spreadsheets in Drive, you don’t need custom connectors. Review your Drive sharing permissions and ensure users only see what they should see.
A practical architecture
Gemini Enterprise
↓ (HTTPS, OAuth)
Cloud Run MCP Server
↓ (queries)
BigQuery (curated layer)
↑ (pipelines, read-only)
Systems of Record (LIMS, ELN, instruments)Cloud Run handles scaling and HTTPS termination. BigQuery handles the data. Your MCP server is the thin layer that translates Gemini’s tool calls into BigQuery queries.
Checklist
- Confirm you have Gemini Enterprise (not just Gemini in Workspace)
- Custom data stores enabled in admin console
- MCP server deployed on Cloud Run (or equivalent)
- OAuth configured through your organization’s IdP
- Per-user authorization enforced in the MCP server
- Read-only tools only
- Audit logging enabled
- VPC Service Controls configured if needed
- Curated data layer in place with linked records
Need help? Our AI Data Readiness service supports connecting Claude, ChatGPT, Copilot, and Gemini.
