Each service tool takes an operation argument rather than splitting into a dozen entries, so the list stays short while the arguments carry the work — the mail tool alone covers search, read, send, forward and labels. The three infrastructure tools are what make it usable for anything longer than a one-liner: compose in the scratchpad, stage files in the sandbox, chain steps with result references. The most useful safety feature is the scope choice: authorize an account read-only and a write is refused before the request leaves, with the re-authorization command in the error.
A server over Google Workspace — Gmail, Calendar, Drive, Docs, Sheets, Tasks, Meet and Contacts — with one tool per service plus three that make multi-step work possible: a file sandbox, a compose-and-deliver scratchpad, and bulk execution. It runs on your machine with your own OAuth client, and holds a token per account.
- Gmail through its own search syntax: read, send, reply and reply-all, forward, triage, trash, labels, threads and attachments
- Drive searched, uploaded to, downloaded from, copied, moved, exported, shared with a person or a whole domain, and commented on
- Calendar events listed, created with attendees and a Meet link, added in natural language, and free-busy checked before a time is proposed
- Docs read, created, appended to and find-and-replaced; Sheets read and written by range with tab management; Google Tasks lists and their tasks
- Contacts looked up across your saved contacts, addresses you have only corresponded with, and your organization's directory
- Past Meet conferences with their participants, transcripts, recordings and smart notes
- A sandbox with nested paths that acts as the exchange point for attachments, downloads and exports
- Multi-line content composed and edited by line or JSON path then delivered to any target, and several operations chained in one call with $N.field references — or one operation applied to many items in a single Google request where Google publishes a method for it
- Per-account read-only authorization: ask for read scopes at consent time and the token itself cannot send, edit or delete
Node 22.12 or newer, and your own Google OAuth 2.0 client of type Desktop app with the APIs you want enabled — Gmail, Calendar, Drive, Sheets, Docs, Tasks, Meet, and the People API for contacts. Its client id and secret go in the environment, and each account is then authenticated once through the account tool, which opens a browser. Tokens live on your own disk under your home directory; there is no hosted service in the middle. Meet transcripts and recordings need Workspace Business Standard or higher. Apache-2.0, with no paid tier held back.
One command plus a key — npx -y @aaronsb/google-workspace-mcp, then supply credentials