Site Scanner MCP Server — Gemini Enterprise setup guide

Connect Gemini Enterprise to Evinced Site Scanner MCP and ask Gemini about your accessibility scan results in plain language. An admin adds the connector once; then each person connects their own Evinced account.

The setup at a glance

Part 1 · Before you start

Google Cloud admin, once

1. Check the MCP policy

Evinced has already enabled Gemini Enterprise sign-in on its side.

Part 2 · Add the connector

Gemini Enterprise admin, once

2. Start a new data store
3. Choose Custom MCP Server
4. Enter the server details
5. Sign in to verify
6. Name it and create
7. Turn on the tools

Part 3 · Start using it

Everyone, once each

8. Connect your Evinced account
9. Confirm the connection
10. Ask a real question

You need admin access to Gemini Enterprise, an Evinced Site Scanner account, and about 15 minutes.

What you’ll enter

Every value used in steps 4, 6 and 7. Copy them exactly.

Field	Value
MCP Server URL	https://site-scanner-mcp.evinced.io/mcp
Authorization URL	https://site-scanner-mcp.evinced.io/authorize
Authorization URL Parameters	Leave empty
Token URL	https://site-scanner-mcp.evinced.io/token
Client ID	iIHIYWjC4dNEWfjVw4g0knyUpgmNolGS
Client Secret	Leave empty
Scopes	openid profile email offline_access
Enable PKCE Support	On
Use HTTP Basic Authentication	Off
Data connector name	Evinced Site Scanner
Actions to enable	All of them

Good to know

• Why fill in OAuth by hand? Gemini Enterprise doesn’t discover sign-in settings on its own, so you enter them once. The URLs point at the Site Scanner server, which hands the sign-in to Evinced.
• No client secret. The Site Scanner server keeps the secret on its side, and PKCE protects the sign-in, so leave the secret empty and HTTP Basic auth off.
• One tool makes changes. Every tool only reads your Evinced data except Create Property, which adds a property to your account. To keep Gemini read-only, leave it disabled in step 7.
• Everyone signs in as themselves. The sign-ins in steps 5 and 7 are only for the admin. Each person authorises Evinced Site Scanner in the Gemini app with their own Evinced account (step 8) and sees only what that account can access.

Part 1 · Before you start

A Google Cloud admin checks this once.

Step 1 · Check the MCP policy

Google Cloud can stop Gemini Enterprise from connecting to custom MCP servers. If the policy below reads Enforced for your project, turn it off for that project only; the rest of your organization keeps it. You need the Organization Policy Administrator role.

1. Open IAM & Admin › Organization policies, find Disable custom MCP server connector for Gemini Enterprise, and click Manage policy.
2. Under Policy source, choose Override parent’s policy.
3. Under Rules, keep one rule set to Not enforced (Add a rule if there is none).
4. Click Set policy. Its status then reads Not enforced.

Note

Changes can take up to 15 minutes to reach Gemini Enterprise. Constraint: discoveryengine.managed.disableCustomMcpServerConnector

Part 2 · Add the connector

A Gemini Enterprise admin does this once.

Step 2 · Start a new data store

In the Google Cloud console, open Gemini Enterprise in your project and select your app.

1. Open Connected data stores.
2. Click + New data store.

Step 3 · Choose Custom MCP Server

On Select a data source, scroll down to MCP servers.

1. On the Custom MCP Server card, click Add MCP server.

Step 4 · Enter the server details

Keep OAuth 2.0 selected. Leave Authorization URL Parameters and Client Secret empty.

1. MCP Server URL

   https://site-scanner-mcp.evinced.io/mcp

2. Authorization URL

   https://site-scanner-mcp.evinced.io/authorize

3. Token URL

   https://site-scanner-mcp.evinced.io/token

4. Client ID

   iIHIYWjC4dNEWfjVw4g0knyUpgmNolGS

5. Scopes

   openid profile email offline_access

6. Enable PKCE Support: on

7. Use HTTP Basic Authentication: off

8. Click Verify Auth.

Step 5 · Sign in to verify

Verify Auth opens the Evinced sign-in in a pop-up.

1. Enter your Evinced email, click Continue, and finish signing in. The pop-up closes on its own.

   

2. Check for Successfully logged in.

   

3. Scroll down and click Continue.

Step 6 · Name it and create

Location stays global (Global). The tag and the sensitive data protection policy are optional.

1. Data connector name: Evinced Site Scanner
2. Click Create. You land on the new connector’s page, and Evinced Site Scanner is listed under Connected data stores.

Tip

If Create reports Operation denied by org policy, complete step 1. The change can take up to 15 minutes; then click Create again.

Step 7 · Turn on the tools

A new connector starts with every tool turned off. Gemini calls them actions.

1. On the connector’s page, click Go to actions.

   

2. Click Reload custom actions and sign in to Evinced in the pop-up. The Site Scanner tools appear, all Disabled.

3. Tick Select all rows.

4. Click Enable actions. It appears once rows are selected.

5. Check that every action shows Enabled.

   

Note

Gemini asks people to confirm each tool call before it runs.

Part 3 · Start using it

Everyone does this once, each with their own Evinced account.

Step 8 · Connect your Evinced account

Gemini works only with what your Evinced account can access.

1. Open your Gemini Enterprise app and click Sources, the sliders icon under the prompt box.
2. Next to Evinced Site Scanner, click Authorise (Authorize in US English) and sign in with your Evinced account.
3. The pop-up closes and the Evinced Site Scanner toggle is on.

Before: 1 Sources, 2 Authorise

After: connected

Step 9 · Confirm the connection

The whoami tool only reads. It’s the quickest way to check which account Gemini is using.

1. Start a chat and ask:

   Use the Evinced Site Scanner connector to run its whoami tool.

2. Gemini shows the tool it wants to run. Click Send.

   

3. Gemini replies with the Evinced account and tenant it’s using.

   

   Account details censored for this guide

Note

Gemini asks before every tool call, so a Send / Cancel card appears each time.

Step 10 · Ask a real question

Ask in plain language. Gemini picks the Site Scanner tool that fits.

1. Ask about your sites, for example:

   List my Evinced Site Scanner properties with their latest scan date and score.

2. Check the details Gemini will send (here, how many properties) and click Send.

   

3. Gemini answers from your live Site Scanner data.

   

   Property names, dates and scores censored for this guide

If something goes wrong

What you see	What to do
“Operation denied by org policy” when you click Create	Your organization still blocks custom MCP servers for Gemini Enterprise. Complete step 1, wait a few minutes (up to 15), and click Create again.
“Callback URL mismatch” when you click Verify Auth	Evinced’s sign-in doesn’t recognise Gemini Enterprise. Email support@evinced.com.
“No actions are enabled” after you create the connector	Gemini can’t use any tool yet. Complete step 7: reload the actions, select all, and click Enable actions.
Evinced Site Scanner shows “Authorise” (or “Authorize”) in the Gemini app	That’s expected the first time. Click it and sign in with your Evinced account (step 8).

What the org policy error looks like

Still stuck?

Email support@evinced.com and include the MCP server URL, https://site-scanner-mcp.evinced.io/mcp.

That’s it

Evinced Site Scanner is live in Gemini Enterprise. Each person connects their own Evinced account once, and Gemini asks before each tool call.

Claude setup guideAdd the same server to Claude.

Privacy policyWhat the Site Scanner MCP Server handles, and why.