Gemini 3.1 Deep Research now speaks MCP: connect 49 tools in 5 minutes

Google shipped MCP support inside Deep Research Max in late April 2026, alongside the Gemini 3.1 Pro release. Deep Research can now call any MCP server during a research session, treat the responses as citation-grade evidence, and weave the structured data into the final report. The headline use case Google demoed was scientific literature; the more useful day-to-day pairing is technical due diligence.

Out of the box, Deep Research is good at reading the open web and writing readable prose. It is bad at structured technical lookups. Asked "is acme-payments.io a sketchy domain?", the unaugmented model browses to the homepage, reads marketing copy, and tells you it looks fine. Hand it the botoi MCP server with WHOIS, DNS, SSL, and breach lookups, and the same prompt produces a memo backed by registrar dates, cert expirations, and DMARC posture. This post shows the five-minute setup and a worked example.

Add the botoi MCP server to Gemini

Deep Research reads MCP servers from your Gemini Advanced settings. Open the workspace settings, choose Connectors, then Add MCP server. Paste this JSON or use the equivalent UI fields.

{
  "mcpServers": {
    "botoi": {
      "url": "https://api.botoi.com/mcp",
      "headers": {
        "Authorization": "Bearer $BOTOI_API_KEY"
      },
      "tool_filter": [
        "whois",
        "dns_lookup",
        "ssl_certificate",
        "breach_check",
        "ip_geolocation",
        "domain_availability",
        "tech_detect",
        "url_metadata"
      ]
    }
  }
}

The tool_filter array is an allowlist; Gemini will refuse to call any tool name not in the list. For research workflows the eight tools above cover 90% of what you'd ask. The full 49-tool catalog is at botoi.com/mcp.

Replace $BOTOI_API_KEY with a key from botoi.com/api/signup. The free tier is enough to test the integration; paid keys lift the rate limits.

Run a research task

Open a Deep Research session and paste the prompt below. Gemini will plan the steps, decide where to call botoi tools, browse the web for context, and assemble a report.

You are researching a vendor risk assessment for acquiring acme-payments.io.

Use the botoi MCP tools to gather:
1. WHOIS data (registrar, registration date, expiry)
2. SSL certificate details (issuer, expiry, weak ciphers)
3. DNS configuration (MX, SPF, DMARC, DKIM)
4. Tech stack detection (frameworks, analytics, CDN)
5. Breach history for any executive emails listed in their team page

Combine with public news search and produce a 1-page risk memo with citations.

A snippet of the report Gemini produced when I ran this prompt against a real test domain. The bracketed citations are how Deep Research records every MCP tool call inline.

## Risk findings: acme-payments.io

**Domain trust signals**
- Registered 2024-08-12 with NameCheap, expires 2026-08-12
  [tool: botoi.whois, args: {domain: "acme-payments.io"}, ts: 2026-05-07T10:14Z]
- Short registration window for a payments brand. Typical
  fraud-adjacent domains register in 1-year increments.

**TLS posture**
- Cert issued by Let's Encrypt, valid through 2026-07-04
- TLS 1.3 only, no weak ciphers
  [tool: botoi.ssl_certificate, args: {domain: "acme-payments.io"}, ts: 2026-05-07T10:14Z]

**Email security**
- SPF: pass (~all)
- DMARC: p=none (monitoring only)
- DKIM: configured for selector google
  [tool: botoi.dns_lookup, args: {domain: "acme-payments.io", type: "TXT"}]

**Executive breach exposure**
- ceo@acme-payments.io: 2 known breaches (LinkedIn 2012, Adobe 2013)
  [tool: botoi.breach_check, args: {email: "ceo@acme-payments.io"}]

**Recommendation: medium risk.** Short domain age and DMARC monitoring-only
posture are mild flags. No malicious indicators.

The point isn't the specific findings. It's that Deep Research now stitches structured tool data into the same prose pipeline as web citations, with timestamps and arguments preserved. That's the audit trail you need for any research that ends up in a report someone makes a decision on.

What the eight default tools cover

• whois: registrar, registration date, expiry, registrant org
• dns_lookup: A, AAAA, MX, TXT, NS records and DNSSEC status
• ssl_certificate: issuer, valid-from/to, weak ciphers, SAN list
• breach_check: known breach exposure for an email
• ip_geolocation: country, city, ASN, hosting provider
• domain_availability: registration status across TLDs
• tech_detect: frameworks, analytics, CDN, hosting
• url_metadata: title, description, OG tags, canonical URL

For threat-intel work add phishing_check and security_grade. For supply-chain audits add npm_package. Each one is one entry in the tool_filter array.

The same config works in Claude and Cursor

The MCP spec is the same across clients. Drop a near-identical block into claude_desktop_config.json and the tools light up in Claude with no other changes.

// claude_desktop_config.json: same server works in Claude
{
  "mcpServers": {
    "botoi": {
      "url": "https://api.botoi.com/mcp",
      "headers": {
        "Authorization": "Bearer $BOTOI_API_KEY"
      }
    }
  }
}

The setup docs have copy-paste configs for Claude Desktop, Claude Code, Cursor, VS Code, and Windsurf. The Gemini config above is the newest addition; the rest have been live since the MCP server launched.

Where this changes the workflow

Three research patterns get materially better with Deep Research plus an API-backed MCP:

• Vendor due diligence: domain age, infrastructure, security posture in one pass
• Threat-intel triage: classify an indicator across DNS, TLS, and breach corpora before opening a ticket
• Competitive analysis: tech stack and traffic source detection across 20 competitors in one report

Each one used to mean stitching together five tabs and copying values into a doc. Deep Research with MCP does the stitching and gives you back the audit trail.

Free tier covers the testing run above. Production research desks usually land on the $9/month tier, which lifts the per-day cap and unlocks higher burst rates. Endpoint catalog: botoi.com/api. Full MCP setup docs: botoi.com/mcp.