Google Opens Gemini and Search to Connected Apps: What the MCP Developer Preview Means for Businesses

28 October 2026 | Global AI | Status: phased developer preview, not general availability. Google has opened a new way for businesses to reach customers inside AI conversations. Its Connected Apps Platform lets developers prepare integrations for Gemini, Google Search, or both, rather than build separate bespoke connections. The official 28 October launch announcement calls this a preview. Submitting an integration is not the same as being approved or available to users.

From search results to completed actions

Traditional search often ends when a person clicks through to a website. Connected Apps offer another path: after linking an authorized service, a user can ask an AI interface to take an action using that service. Google describes scenarios from creating playlists to completing everyday tasks. The developer overview says linked users can access authorized account data and actions from applicable Google products.

My interpretation is that this could become a new distribution channel for action-oriented services, not simply another SEO feature. A company might be found because it can solve a user's immediate problem, such as checking an order or booking an appointment. But Google has not promised rankings, traffic, sales, or a new search-optimization formula. The announcement establishes a platform for integrations, not guaranteed customer acquisition.

What actually launched

Google Connected Console provides a place to register, test, submit, version, and manage integrations. Developers choose whether an approved app should target Search, Gemini, or both. Google says developers can monitor traffic, latency, and error rates once live. Its Connected Console guide documents tool registration, tester management, and the review process. These are new developer workflows, not evidence that every submitted service will pass review.

There are two technical routes. Web services can expose authorized tools through a hosted Model Context Protocol (MCP) server. Android apps can expose supported device-side functions through Android MCP and AppFunctions. Those are alternative integration architectures, not two mandatory layers of one implementation. Google's platform documentation explains both options.

Google reports more than 50 Connected Apps across Search and Gemini, but the apps are not all available on both surfaces. The company says integrations from Adobe, Experian, Localiza, and Peloton are available in Gemini, with Search expansion planned over the coming weeks. A Calm integration is also planned. The figure does not mean 50 integrations launched on 28 October. See Google's dated announcement.

Preview access and commercial unknowns

Google says it is admitting developers and markets in phases. TechCrunch reported on 28 October that initial preview access is for U.S. developers who apply. The official developer portal provides the application path. Worldwide availability, approval times, supported business categories, and a full pricing schedule are not confirmed by the launch material.

Do not call the offering universally free or production-ready. Even a preview integration can require paid hosting, secure identity infrastructure, support, and maintenance. A business should verify the preview terms and any usage fees directly with Google before estimating ROI. The developer documentation describes the onboarding process but does not establish a universal cost or acceptance guarantee.

Architecture and security: Google is the interface, not the authority

A sensible architecture begins with a user request in Search or Gemini. An approved Connected App routes an authorized call to the company's MCP server or Android function. The service authenticates the caller, enforces business permissions, executes the operation, and returns a result. Google's interface does not replace the company's system of record or its access-control obligations. The OAuth implementation guide explains delegated account linking.

For MCP integrations, Google recommends OAuth 2.1 and supports authorization-code flow with PKCE. Its documentation covers user consent, token exchange, metadata discovery, and narrow scopes. An AI assistant must not receive unrestricted service credentials merely because the user asked a question. Test expired tokens, consent revocation, and two users with different entitlements. Source: Google's OAuth 2.1 guide.

Write operations need extra safeguards. Google's testing guide describes tool snapshots, tester accounts, and confirmation requirements, including tools annotated as destructive. Begin with read-only actions, add explicit approval for consequential changes, and log the real business outcome. A confident AI message is not proof that a payment, booking, or update succeeded.

What this means for SAP and enterprise software

A business with an existing order-status API, appointment service, or quotation workflow could explore exposing a tightly scoped action through MCP. The opportunity is to be useful at the moment of customer intent. But this release does not establish a native Google-to-SAP SuccessFactors, S/4HANA, or Joule connector. Those systems would require separately designed integration, authorization, and audit controls. Google's launch announcement does not promise universal enterprise connectors.

For HR or finance data, a safe pilot should preserve the employee's or customer's identity end to end. Do not let a generic service account bypass role-based permissions, and do not expose sensitive records merely because an external AI tool requests them. Treat the MCP endpoint as a new external access boundary, with its own threat model and monitoring. The authorization guide is a starting point, not a substitute for the company's security design.

A practical five-step evaluation

1. Check eligibility: Apply through the preview portal and verify market, approval, and surface availability.
2. Pick one measurable task: Choose an authorized user action that produces a clear outcome rather than a generic FAQ.
3. Implement least privilege: Design narrow MCP tools, consent, OAuth scopes, and per-user authorization using the official security guidance.
4. Test failures and approvals: Exercise invalid tokens, unauthorized users, errors, and destructive actions. Follow the review and testing workflow.
5. Measure the real funnel: Track qualified requests, successful transactions, latency, errors, and downstream conversion before claiming business impact. The Connected Console supports operational metrics.

The takeaway

The important news is not a claim that Google launched 50 brand-new integrations today. It is that developers now have a preview submission and management pathway for bringing useful services into Gemini and Search. This could matter as AI interfaces move from answering questions to completing tasks, but the rollout is phased and commercial results are unproven. Start with a secure API, one customer problem, and a measurable pilot. Review the 28 October announcement and official documentation before committing.