A comprehensive MCP Server and CLI tool covering 12 Google Workspace services, featuring OAuth 2.0/2.1 multi-user authentication, tool tiers, read-only mode, and enterprise-grade stateless deployment.
workspace-mcp is a Model Context Protocol Server built on FastMCP, also providing a CLI tool, designed to enable AI assistants to securely control the entire Google Workspace suite via natural language. The project covers 12 services — Gmail, Drive, Calendar, Docs, Sheets, Slides, Forms, Chat, Apps Script, Tasks, Contacts, and Custom Search — making it the most comprehensive Google Workspace MCP implementation known to date.
The project provides a three-tier tool classification mechanism (core / extended / complete), supports fine-grained filtering by service name, and offers a global read-only mode to satisfy the principle of least privilege. On the authentication side, it supports three modes — Confidential Client (desktop/web OAuth), Public OAuth 2.1 PKCE (no client secret required), and Service Account Domain-Wide Delegation — covering the full spectrum from individual development to enterprise centralized deployment.
For enterprise deployment, the Stateless mode achieves zero disk writes, suitable for containerized environments; credential storage supports local directory, Google Cloud Storage, and Valkey backends; reverse proxy and external OAuth server support enable seamless integration into existing infrastructure. On security, the project explicitly commits to sending no data to any third party, with no telemetry or analytics, a dependency chain entirely under MIT / Apache 2.0 / BSD licenses, and built-in sensitive path exclusion logic.
Built on FastMCP and FastAPI, each Google service is organized as an independent module, with tool tiers driven by YAML configuration. The transport layer supports the modern MCP-compliant streamable-http mode as well as legacy stdio fallback. The project provides a Dockerfile, docker-compose.yml, and Helm Chart, enabling one-click startup via uvx or container-based deployment.
Service Coverage
| Service | Capabilities |
|---|---|
| Gmail | Full email management |
| Drive | File operations, sharing, permissions, Office/PDF/image processing |
| Calendar | Full schedule management |
| Docs | Fine-grained editing, formatting, comments |
| Sheets | Cell management, formatting, conditional rules |
| Slides | Presentation creation and content manipulation |
| Forms | Creation, publish settings, response management |
| Chat | Space management, messages, reactions |
| Apps Script | Cross-app workflow automation: projects, deployments, versions, execution, debugging |
| Tasks | Task and list hierarchy management |
| Contacts | People API, groups and batch operations |
| Custom Search | Programmable search engine integration |
Quick Start
# Confidential Client
export GOOGLE_OAUTH_CLIENT_ID="..."
export GOOGLE_OAUTH_CLIENT_SECRET="..."
uvx workspace-mcp --tool-tier complete
# Public OAuth 2.1 PKCE
export MCP_ENABLE_OAUTH21=true
export GOOGLE_OAUTH_CLIENT_ID="..."
export WORKSPACE_MCP_PORT=8000
export GOOGLE_OAUTH_REDIRECT_URI="http://localhost:${WORKSPACE_MCP_PORT}/oauth2callback"
export OAUTHLIB_INSECURE_TRANSPORT=1
export FASTMCP_SERVER_AUTH_GOOGLE_JWT_SIGNING_KEY="$(openssl rand -hex 32)"
uvx workspace-mcp --transport streamable-http --tool-tier complete
Unconfirmed Information: PyPI publication status (https://pypi.org/project/workspace-mcp not directly verified in README), workspacemcp.com actual availability unconfirmed, Helm Chart specifics not reviewed, full MCP client compatibility matrix not provided.