Developers using Google Cloud Platform (GCP) for prototyping, hackathons, codelabs, microservice sandboxes, and frontier Large Language Model (LLM) evaluations often watch their project lists turn into digital archaeological digs.

You start with one or two clean production environments. A few years later, gcloud projects list outputs 50+ projects across multiple legacy billing accounts.

Behind that sprawling list lie common cloud failure modes:

  1. The Zombie Storage Leak: You stopped a Compute Engine VM two years ago. Stopping a VM halts CPU and RAM charges. Attached persistent disks continue billing monthly storage fees indefinitely.
  2. The Passive Budget Illusion: You set a $100 monthly budget alert in Cloud Billing. GCP Budget Alerts only send emails. They do not cap API calls or pause infrastructure when traffic surges.
  3. The Frontier Model Spend Cliff: You deploy a modern Generative AI pipeline on Vertex AI. A single weekend of batch testing across Claude Sonnet/Opus or Gemini 1.5 Pro models runs up hundreds or thousands of dollars before anyone checks the billing console on Monday morning.

To bring order, transparency, and automated governance to sprawling multi-project setups, I packaged our cloud assessment workflows into an open Agent Plugin and suite of Agent Skills called gcp-management.

The workflows enforce a read-only safety mandate that protects your production infrastructure while delivering automated visibility and actionable remediation commands.

The gcp-management Plugin Architecture

The plugin complies with the Agent Plugins Specification v1.0.0 and the Agent Skills Specification, dividing cloud portfolio management into three focused, co-dependent skills:

plugins/gcp-management/
├── plugin.json                                         # Agent Plugins v1.0.0 Manifest
└── skills/
    ├── gcp-project-assessment/                         # Skill 1: Portfolio Discovery & Cost Analysis
    │   ├── SKILL.md
    │   ├── scripts/
    │   │   └── audit_portfolio.py                      # Parallelized 60+ project scanner & BQ analyzer
    │   └── references/
    │       └── billing-export-queries.sql              # MTD, WoW velocity, & 30-day BigQuery queries
    │
    ├── gcp-quota-governance/                           # Skill 2: Rate Limits, Caps & Circuit Breakers
    │   ├── SKILL.md
    │   ├── scripts/
    │   │   └── inspect_quotas.py                       # Read-only quota metrics & Cloud Run scaling inspector
    │   └── references/
    │       ├── quota-capping-guide.md                  # Vertex AI & Gemini quota ID / decrease reference
    │       └── automated-circuit-breaker.md            # Pub/Sub + Cloud Function hard dollar cap architecture
    │
    └── gcp-project-consolidation/                      # Skill 3: Cleanup, Decommissioning & Liens
        ├── SKILL.md
        └── references/
            ├── decommissioning-checklist.md           # Safe project deletion & Dialogflow lien handling
            └── orphaned-resource-playbook.md           # Terminated VM disk & reserved static IP cleanup

1. Skill Breakdown: Where Each One Shines

1. gcp-project-assessment — Macro Visibility & Spend Velocity

  • The Problem: Clicking through the Google Cloud Console across dozens of projects to figure out which ones receive traffic, run compute, and cost money takes hours.
  • Where It Shines: Delivers complete macro visibility in under 15 seconds across 60+ projects.

Execution components:

  1. Parallel Resource Scanning: Uses Python worker threads (concurrent.futures) to query gcloud and firebase CLI tools simultaneously. It discovers Compute VMs, persistent disks, Cloud Run services, App Engine apps, Cloud Functions, GCS buckets, and Firebase assets (Firestore DBs, Multi-platform Apps, and Hosting domains).
  2. Log-Based Traffic Classification: Filters Cloud Logging over a 30-day window (httpRequest.requestMethod:*) to separate real user and API traffic from automated system audit logs (cloudaudit.googleapis.com).
  3. BigQuery Billing Export Queries: Direct SQL queries against your Cloud Billing export dataset (gcp_billing_export_v1_*) unlock exact SKU-level dollar spend and Week-over-Week (WoW) spend velocity (Last 7 Days vs. Previous 7 Days).
  4. Mermaid Visualizations: Generates Markdown audit reports complete with Mermaid pie charts and Gantt spend breakdowns.
pie title Sample Portfolio 30-Day Net Spend ($4,750 USD Total)
    "acme-genai-prod-001 ($4,710.00)" : 99.1
    "acme-dev-sandbox-42 ($35.00)" : 0.8
    "All Other 50 Projects ($5.00)" : 0.1

2. gcp-quota-governance — Moving from Passive Alerts to Hard Caps

  • The Problem: Standard GCP Billing Budgets send email alerts when spend crosses a threshold (50%, 90%, 100%), but they do not stop API consumption. During rapid development or unintended infinite loops, token usage scales unchecked.
  • Where It Shines: Pinpointing runaway cost vectors and providing exact, multi-tier guardrails.

The Three Granularity Levels:

Level Mechanism Scope
Level 1: Fine-Grained API & Model Quotas gcloud beta quotas preferences create Capping specific base models (such as gemini-1.5-pro or Claude models) or regional requests/minute on aiplatform.googleapis.com. Quota decreases take effect immediately.
Level 2: Container Auto-Scaling Caps gcloud run services update --max-instances=2 Restricting microservice concurrency so backend containers cannot scale to 100+ instances during traffic spikes.
Level 3: Automated Dollar Circuit Breaker Budget Alert $\rightarrow$ Pub/Sub $\rightarrow$ Cloud Function An event-driven architecture that unlinks project billing when spend reaches 100% of a target threshold ($100).

3. gcp-project-consolidation — Safe Decommissioning & Zombie Asset Cleanup

  • The Problem: Deleting projects or unlinking billing often fails due to active service liens (such as linked Dialogflow agents), while terminated VMs leave behind unattached storage.
  • Where It Shines: Guiding safe consolidation and retirement of duplicate test projects.

Target assets:

  • Orphaned Disks: Isolating disks attached to terminated or stopped VMs that continue billing storage fees.
  • Unassigned Static IPs: Detecting reserved external IPs that incur hourly reservation penalties when unattached.
  • Service Lien Resolution: Querying gcloud alpha resource-manager liens list to diagnose and clear deletion blockers.
  • Consolidation Pathways: Formulating migration plans (moving Cloud Run microservices or Firestore collections into a centralized dev hub).

2. The Core Philosophy: The Read-Only Safety Mandate

Agent skills for cloud infrastructure require hard safety firebreaks. An AI agent must never execute destructive commands (gcloud projects delete, gcloud compute instances stop, or gcloud beta billing projects unlink) against production accounts.

The gcp-management plugin enforces a Read-Only Safety Mandate:

  1. All agent-executed CLI queries and Python scripts perform read-only discovery (list, describe, read, BigQuery SELECT).
  2. All remediation actions (stopping instances, deleting disks, unlinking billing, or adjusting quotas) format as clean, copy-pasteable shell command blocks for human review and execution.

3. Hands-On Tutorial: Running the Skills with agy and opencode

Step 1: Install or Link the Skills

Install the plugin via the Open Agent Skills CLI or mirror it to your local agent environment:

# Option A: Link into Antigravity CLI global scope
cp -R plugins/gcp-management/skills/* ~/.gemini/antigravity/skills/

# Option B: Link into OpenCode agent scope
cp -R plugins/gcp-management/skills/* ~/.agents/skills/

Verify your local prerequisites:

gcloud projects list   # Ensure gcloud is authenticated
bq ls                  # Ensure BigQuery CLI is available
firebase --version     # Ensure Firebase CLI is installed

Step 2: Run a Complete Portfolio Audit

In your terminal, launch your AI agent (agy or opencode) and request a portfolio review:

> agy "Use the gcp-project-assessment skill to audit all my GCP projects across billing accounts, check BigQuery billing export for top spenders, and generate an audit report."

Automated workflow:

  1. The agent invokes scripts/audit_portfolio.py, scanning dozens of projects concurrently.
  2. It queries BigQuery billing export datasets to pull 30-day net spend and Week-over-Week velocity.
  3. It inspects Cloud Logging to verify which projects are actually serving requests.
  4. It generates GCP_PROJECTS_AUDIT_REPORT.md in your workspace, organizing projects into:
    • Category A: Active High-Value Production Hubs
    • Category B: Deployed Services on Standby
    • Category C: Dormant Projects with Billing Enabled (<$1/mo spend; billing unlinking candidates)
    • Category D: Billing Disabled / $0 Cost Projects (Decommissioning candidates)

Step 3: Investigate Spend Velocity & Trend Direction

To determine whether AI spending accelerates or declines:

> agy "Analyze week-over-week spend trends on acme-genai-prod-001. Which models are trending up?"

The agent queries the 7-day vs. 14-day partition windows in BigQuery and returns a velocity breakdown:

Service: Claude Sonnet 5   | Last 7d: $313.00 | Prev 7d: $914.19 | Change: 📉 DOWN (-65.8%)
Service: Vertex AI Native  | Last 7d: $271.70 | Prev 7d: $224.33 | Change: 📈 UP (+21.1%)
Service: Claude Opus 5     | Last 7d: $16.03  | Prev 7d: $0.00   | Change: 📈 NEW (+100.0%)
Service: Gemini API        | Last 7d: $0.67   | Prev 7d: $184.31 | Change: 📉 DOWN (-99.6%)

Step 4: Establish Quota Caps & Guardrails

To prevent unexpected spikes on high-cost models:

> agy "Use gcp-quota-governance to inspect quotas on acme-genai-prod-001 and give me commands to cap online predictions in us-central1 to 50 req/min."

The agent inspects current preferences via scripts/inspect_quotas.py and outputs the exact command for you to execute:

# Execute manually in your terminal:
gcloud beta quotas preferences create \
  --service=aiplatform.googleapis.com \
  --project=acme-genai-prod-001 \
  --quota-id=OnlinePredictionRequestsPerMinutePerProjectPerRegion \
  --dimensions=region=us-central1 \
  --preferred-value=50 \
  --allow-high-percentage-quota-decrease

Step 5: Clean Up Dormant Projects and Orphaned Disks

To eliminate recurring monthly storage charges on dormant environments:

> agy "Use gcp-project-consolidation to find all orphaned persistent disks on stopped VMs and list dormant codelab projects where billing should be unlinked."

The agent provides a clean remediation checklist:

# 1. Unlink billing from dormant codelabs ($0 cost guarantee):
gcloud beta billing projects unlink sample-codelab-project-01
gcloud beta billing projects unlink old-experiment-sandbox

# 2. Delete orphaned persistent disks from terminated VMs:
gcloud compute disks delete instance-1-disk --zone=us-central1-c --project=retired-test-env --quiet

Conclusion & Next Steps

Agent skills transform cloud management from a tedious, reactive chore into a fast, repeatable, and proactive operational discipline. Pairing parallel read-only discovery with human-in-the-loop remediation gives you full transparency over multi-project spend and token consumption without risking accidental outages.

All three skills, scripts, and SQL references are open source and available in the agent-skills repository:

  • gcp-project-assessment
  • gcp-quota-governance
  • gcp-project-consolidation