Connect Google Cloud Profiler.

Connect profiles from one Google Cloud project. Perfloop uses a dedicated service account to read profiles and stores the ones it uses for performance work.

Cloud Profiler provides best-effort profile reads. Recent queries for an arbitrary service are not supported, even when Google holds matching profiles. For queries by service and time, connect Pyroscope.

Access you need

A project IAM administrator runs the commands from Setup to create a dedicated service account for your Perfloop account and Google Cloud project. Its custom role contains only cloudprofiler.profiles.list.

• cloudprofiler.profiles.list Lists Cloud Profiler profiles for the selected project. No write permission.

• Workload Identity impersonation Perfloop uses Workload Identity to act as the dedicated reader with short-lived credentials. You do not need to upload a service-account key or authorize your personal Google account.

Perfloop uses the credential to read profiles. Models and execution sandboxes do not receive it.

Setup

1 · select the project

In Perfloop Setup, choose Google Cloud Profiler and enter the project that holds your profiles.

2 · install the dedicated reader

Run the Cloud Shell commands from Setup in your selected project. They create the service account, assign its read permission, and allow Perfloop to use it through Workload Identity.

Check the project, service account, and permissions in the generated commands before you run them.

3 · validate the read

Return to Setup and validate the connection. Perfloop saves the connection after this check passes. An Admin's coding agent can also get these commands, run them with IAM rights in the project, and connect the project through the Perfloop MCP server.

Data Perfloop reads

The service account can read every profile in the project. To restrict which profiles Perfloop can receive from Google, use a separate project.

Perfloop stores selected profiles in pprof format. Its models can read stack samples, function and file names, build IDs, and labels. Review these fields before connecting a project if they contain sensitive names or identifiers.

Partial results do not guarantee representative profiles and cannot show that a stack was absent or measure a service-wide improvement.

Repo access

Work on any repo in the workspace can query the profile scopes of every telemetry connection in the workspace. Keep telemetry that some repos must not read in a separate workspace.

Change or remove access

To change the project or service account, run a new install from Setup and validate it. The existing connection stays active until the new one passes validation. To stop reads, remove the Workload Identity binding or the service account's custom role in Google Cloud. This does not delete profiles already stored in Perfloop. To remove the connection from Perfloop, an Admin's agent can disconnect it through the MCP server.

Provider documentation

• Google Cloud Profiler IAM roles and permissions

Security questions: security@perfloop.ai