DEV Community

Google Developer Experts profile image xbill
xbill for Google Developer Experts

Posted on • Originally published at xbill999.Medium on

Secure MCP Development with Go, and Gemini CLI

#agents #gemini #go #mcps

Leveraging the Gemini CLI and the underlying Gemini LLM to add support for building secure Model Context Protocol (MCP) AI applications with the Go Language in a local development environment.

What is this Tutorial Trying to Do?

Traditionally, ML and AI tools have been deployed in interpreted languages like Python, and Java. One of the key goals of this tutorial is to validate that a compiled language like Go can be used for AI software development beyond the traditional interpreted languages.

What Is Go?

Go, also known as Golang, is a programming language created at Google. It’s known for being simple, efficient, and reliable. It’s particularly well-suited for building network services and concurrent applications.

Google Open Source Projects

Installing Go

If Go has not been installed in your environment — there are tools for managing Go installations. The Go Version Manager is available here:

GitHub - moovweb/gvm: Go Version Manager

There are several steps to install gvm :

sudo apt-get install bison
sudo apt-get install curl git mercurial make binutils bison gcc build-essential

bash < <(curl -s -S -L https://raw.githubusercontent.com/moovweb/gvm/master/binscripts/gvm-installer)
Enter fullscreen mode Exit fullscreen mode

Then use the gvm tool to install the latest version of Go:

xbill@penguin:~$ gvm install go1.26.0 -B
Installing go1.26.0 from binary source

gvm use --default go1.26.0
Enter fullscreen mode Exit fullscreen mode

You can validate the installation of Go with the version command:

xbill@penguin:~$ go version
go version go1.26.0 linux/amd64
Enter fullscreen mode Exit fullscreen mode

Gemini CLI

If not pre-installed you can download the Gemini CLI to interact with the source files and provide real-time assistance:

sudo npm install -g @google/gemini-cli
Enter fullscreen mode Exit fullscreen mode

Note- if you are an a non standard environment — you will need to make sure to have at least Node version 20 available in order to run Gemini CLI.

Testing the Gemini CLI Environment

Once you have all the tools and the correct Node.js version in place- you can test the startup of Gemini CLI. You will need to authenticate with a Key or your Google Account:

gemini
Enter fullscreen mode Exit fullscreen mode

Getting Started with Go and MCP

There are several competing implementations of the MCP protocol in Go.

This article will focus on the official release:

GitHub - modelcontextprotocol/go-sdk: The official Go SDK for Model Context Protocol servers and clients. Maintained in collaboration with Google.

Go MCP Documentation

The official GitHub Repo provides samples and documentation for getting started:

go-sdk/docs at main · modelcontextprotocol/go-sdk

Where do I start?

The strategy for validating Go for MCP development is a incremental step by step approach.

First, the basic development environment is setup with the required system variables, and a working Gemini CLI configuration.

Then, a minimal Hello World Style Go MCP Server is built with stdio transport. This server is validated with Gemini CLI in the local environment. This setup validates the connection from Gemini CLI to the local compiled Go process via MCP. The MCP client (Gemini CLI) and the Go MCP compiled binary Server both run in the same local environment.

The stdio server is extended to check for an API key from the Cloud environment.

Setup the Basic Environment

At this point you should have a working Go compiler and a working Gemini CLI installation. The next step is to clone the GitHub samples repository with support scripts:

cd ~
git clone https://github.com/iap-https-rust
Enter fullscreen mode Exit fullscreen mode

Then run init.sh from the cloned directory.

The script will attempt to determine your shell environment and set the correct variables:

cd iap-https-rust
source init.sh
Enter fullscreen mode Exit fullscreen mode

If your session times out or you need to re-authenticate- you can run the set_env.sh script to reset your environment variables:

cd iap-https-rust
source set_env.sh
Enter fullscreen mode Exit fullscreen mode

Variables like PROJECT_ID need to be setup for use in the various build scripts- so the set_env script can be used to reset the environment if you time-out.

Hello World with STDIO Transport

One of the key features that the Go SDK provides is abstracting various transport methods.

The high level MCP tool implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

The connection over stdio will look similar to this:

if err := server.ServeStdio(s); err != nil {
                slog.Error("Failed to serve stdio", "error", err)
                os.Exit(1)
        }
Enter fullscreen mode Exit fullscreen mode

Building the Go Binary

First- switch the directory with the Go stdio sample code:

cd ~/iap-https-rust/stdiokey-go
Enter fullscreen mode Exit fullscreen mode

Build the release version of the Go binary on the local system:

cd ~/iap-https-rust/stdiokey-go
make release
Enter fullscreen mode Exit fullscreen mode

You can validate the final result of the build by checking the compiled Go binary:

xbill@penguin:~/iap-https-rust/stdiokey-go$ file stdiokey-go 
stdiokey-go: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, Go BuildID=kfCRIafV2uOROdOaI-t9/72gyVKhS2_KLrTCU5N5l/0Xj-kUh1eSoP1RCBdChK/Ed_gxPnZDCt9vgGlsDM0, BuildID[sha1]=bd44a8473df7d2b5c2bdacfcfe49164fc62be757, with debug_info, not stripped
Enter fullscreen mode Exit fullscreen mode

Then run local tests:

xbill@penguin:~/iap-https-rust/stdiokey-go$ make test
Running tests...
ok stdiokey-go (cached)
xbill@penguin:~/iap-https-rust/stdiokey-go$
Enter fullscreen mode Exit fullscreen mode

Validate Local Binary

The next step is to call the compiled binary directly. The Makefile generates a static binary :

xbill@penguin:~/iap-https-rust/stdiokey-go$ make release
{"time":"2026-02-11T18:06:52.929191658-05:00","level":"INFO","msg":"Fetching MCP API Key","projectID":"comglitn"}
{"time":"2026-02-11T18:06:54.333379395-05:00","level":"INFO","msg":"Successfully fetched API key via gcloud"}
MCP API Key Status
------------------
Cloud Project: comglitn
Cloud Match: [EXPECTED KEY FETCHED]
Provided Key: [NOT FOUND]

Authentication Failed: Invalid or missing API Key.
Please set MCP_API_KEY environment variable or use --key flag.
Enter fullscreen mode Exit fullscreen mode

Running the Tool Locally

Once the release version has been built- the resulting binary can be executed directly in the local environment.

The quick summary of local system info can be run right from the Makefile:

xbill@penguin:~/iap-https-rust/stdiokey-go$ make info
{"time":"2026-02-11T18:08:12.04481637-05:00","level":"INFO","msg":"Fetching MCP API Key","projectID":"comglitn"}
{"time":"2026-02-11T18:08:13.49468712-05:00","level":"INFO","msg":"Successfully fetched API key via gcloud"}
MCP API Key Status
------------------
Cloud Project: comglitn
Cloud Match: [EXPECTED KEY FETCHED]
Provided Key: [NOT FOUND]

Authentication Failed: Invalid or missing API Key
make: *** [Makefile:29: info] Error 1
Enter fullscreen mode Exit fullscreen mode

This call failed because no API key was provided on the command line or in the current environment.

The tool will also fail if an invalid key is passed:

xbill@penguin:~/iap-https-rust/stdiokey-go$ export MCP_API_KEY=gophergo!
xbill@penguin:~/iap-https-rust/stdiokey-go$ make info
{"time":"2026-02-11T18:09:03.668113979-05:00","level":"INFO","msg":"Fetching MCP API Key","projectID":"comglitn"}
{"time":"2026-02-11T18:09:05.150485941-05:00","level":"INFO","msg":"Successfully fetched API key via gcloud"}
MCP API Key Status
------------------
Cloud Project: comglitn
Cloud Match: [EXPECTED KEY FETCHED]
Provided Key: [NOT FOUND]

Authentication Failed: Invalid or missing API Key
make: *** [Makefile:29: info] Error 1
Enter fullscreen mode Exit fullscreen mode

Setting an API Key

On project setup the init.sh script configures the Google Cloud environment and creates a sample key to secure the connection. To set this key in the current environment — use the set_key.sh script:

xbill@penguin:~/iap-https-rust/stdiokey-go$ source ../set_key.sh 
--- Setting Google Cloud Project ID ---
Using Google Cloud project: comglitn
Checking for existing MCP API Key...
Using existing MCP API Key: projects/1056842563084/locations/global/keys/cbd6422f-e594-4536-9ad9-6f179f43f11b
Retrieving API Key string...
MCP API Key retrieved and exported.

This key can be used with all variants that support API key validation:
  - Rust: manual, local, stdiokey
  - Python: manual-python, local-python, stdiokey-python

Ensure this script was sourced: source ./set_key.sh
--- Environment Checks ---
Not running in Google Cloud VM or Shell. Checking ADC...
Running on ChromeOS.
--- Initial Setup complete ---
Enter fullscreen mode Exit fullscreen mode

The tool can now execute:

xbill@penguin:~/iap-https-rust/stdiokey-go$ make info KEY=$MCP_API_KEY
{"time":"2026-02-11T18:13:37.945327004-05:00","level":"INFO","msg":"Fetching MCP API Key","projectID":"comglitn"}
{"time":"2026-02-11T18:13:39.37837143-05:00","level":"INFO","msg":"Successfully fetched API key via gcloud"}
System Information Report
=========================

MCP API Key Status
------------------
Cloud Project: comglitn
Cloud Match: [EXPECTED KEY FETCHED]
Provided Key: [FOUND]
Key Validation: [SUCCESS]

System Information
------------------
System Name: linux
OS Name: linux
Host Name: penguin

CPU Information
---------------
Number of Cores: 12

Memory Information
------------------
Total Memory: 6410 MB
Used Memory: 257 MB
Total Swap: 0 MB
Used Swap: 0 MB

Network Interfaces
------------------
lo : RX: 586257 bytes, TX: 586257 bytes (MAC: unknown)
br-413ba64fd5af : RX: 0 bytes, TX: 0 bytes (MAC: 36:10:67:8c:35:b8)
docker0 : RX: 0 bytes, TX: 0 bytes (MAC: aa:8b:14:57:7f:9b)
eth0 : RX: 1325986649 bytes, TX: 1038923853 bytes (MAC: 00:16:3e:52:c3:b9)
Enter fullscreen mode Exit fullscreen mode

System Information with MCP STDIO Transport

One of the key features that the Rust rmcp SDK provides is abstracting various transport methods.

The high level tool MCP implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

First- switch the directory with the Gp stdio sample code:

xbill@penguin:~/iap-https-rust/stdiokey-go$ make release
{"time":"2026-02-11T18:14:37.073560159-05:00","level":"INFO","msg":"Fetching MCP API Key","projectID":"comglitn"}
{"time":"2026-02-11T18:14:38.450148938-05:00","level":"INFO","msg":"Successfully fetched API key via gcloud"}
MCP API Key Status
------------------
Cloud Project: comglitn
Cloud Match: [EXPECTED KEY FETCHED]
Provided Key: [FOUND]
Key Validation: [SUCCESS]

Authentication Verified: Server is ready to be used by an MCP host.
Enter fullscreen mode Exit fullscreen mode

Connecting Gemini CLI to the MCP STDIO Server

To configure Gemini CLI as the MCP client- a sample settings.json is provided in the .gemini config directory:

 {
    "mcpServers": {
      "stdiokey-go": {
        "command": "$HOME/iap-https-rust/stdiokey-go/stdiokey-go",
        "args": ["--prebuilt","--stdio"],
                "env": {
          "MCP_API_KEY": "$MCP_API_KEY"
        }

      }
    }
  }
Enter fullscreen mode Exit fullscreen mode

Pass the API Key in Gemini Settings

The stdio server checks the API key if it is provided. The set_key.sh scripts sets the environment variable from the Google Cloud settings.

Next Gemini CLI is used to check the MCP connection settings:

 > /mcp list
Configured MCP servers:

🟢 stdio-go - Ready (2 tools)
  Tools:
  - disk_usage
  - local_system_info
Enter fullscreen mode Exit fullscreen mode

The local MCP Server (sysutils-stdiokey-go) can now be used directly using Gemini CLI as a MCP client. This is the same Rust binary that was tested locally as a standalone build:

 > run mcp tool local_system_info
✦ I will read the main.go file to understand how the local_system_info tool is implemented and how to invoke it.

╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✓ ReadFile main.go │
│ │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
✦ I will try to run the local_system_info tool directly using go run main.go info. I will also attempt to fetch the necessary API key if it's
  not already set in the environment.

╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✓ Shell go run main.go info [current working directory /home/xbill/iap-https-rust/stdiokey-go] (Running the system info tool directly.) │
│ │
│ {"time":"2026-02-11T18:21:25.123647605-05:00","level":"INFO","msg":"Fetching MCP API Key","projectID":"comglitn"} │
│ {"time":"2026-02-11T18:21:26.574326585-05:00","level":"INFO","msg":"Successfully fetched API key via gcloud"} │
│ System Information Report │
│ ========================= │
│ │
│ MCP API Key Status │
│ ------------------ │
│ Cloud Project: comglitn │
│ Cloud Match: [EXPECTED KEY FETCHED] │
│ Provided Key: [FOUND] │
│ Key Validation: [SUCCESS] │
│ │
│ │
│ System Information │
│ ------------------ │
│ System Name: linux │
│ OS Name: linux │
│ Host Name: penguin │
│ │
│ CPU Information │
│ --------------- │
│ Number of Cores: 12 │
│ │
│ Memory Information │
│ ------------------ │
│ Total Memory: 6410 MB │
│ Used Memory: 653 MB │
│ Total Swap: 0 MB │
│ Used Swap: 0 MB │
│ │
│ Network Interfaces │
│ ------------------ │
│ lo : RX: 586257 bytes, TX: 586257 bytes (MAC: unknown) │
│ br-413ba64fd5af : RX: 0 bytes, TX: 0 bytes (MAC: 36:10:67:8c:35:b8) │
│ docker0 : RX: 0 bytes, TX: 0 bytes (MAC: aa:8b:14:57:7f:9b) │
│ eth0 : RX: 1326569648 bytes, TX: 1040042302 bytes (MAC: 00:16:3e:52:c3:b9) │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
✦ The local_system_info tool has been executed.
Enter fullscreen mode Exit fullscreen mode

Verify API key is Enforced

To check that the tool is actually using the API key — set the MCP_API_KEY to an invalid value and restart Gemini CLI:

xbill@penguin:~/iap-https-rust/stdiokey-go$ export MCP_API_KEY=gophergo!

✕ Error during discovery for MCP server 'stdiokey-go': MCP error -32000: Connection closed

 > /mcp list
Configured MCP servers:

🔴 stdiokey-go - Disconnected
Enter fullscreen mode Exit fullscreen mode

Summary

The potential for using Go for MCP development with Gemini CLI was validated with a incremental step by step approach.

A minimal stdio transport MCP Server was built from Go source code and validated with Gemini CLI running as a MCP client in the same local environment.

This approach can be extended to more complex deployments using other MCP transports and Cloud based options.

Top comments (0)