listUsersLABSCO SUMMARY
Account admin without the Admin console.
The onboarding and offboarding path is all here — create, read, suspend, unsuspend — and new accounts come out with a generated password the person is forced to change. It writes to your directory, so the OAuth token you hand it decides how far it reaches.
What it is
Five Admin Directory calls over a Google Workspace domain: list the users in it, create one, read one, suspend one, and lift the suspension.
What you get
- Every user in a domain you name
- A new user created with a randomly generated password they must change at first login
- The full record for one user, by email address
- A user account suspended
- A suspended account put back into service
Requirements
Docker, Node.js 20 or later for the repository's token script, and a Google Workspace admin account with the Admin Directory API turned on. scripts/authorize.js signs you in through a Google Cloud OAuth client file (credentials.json) and writes token.json; base64-encoded, that is the GOOGLE_TOKEN_JSON the container reads. The repository is archived on GitHub, so it gets no further fixes.
Setup effort
Run a container — build the image from the repository, then point your client at it
USE CASES
01
Onboarding a new hire
Create the account and hand over a password they have to change on first login, without opening the Admin console.
02
Cutting off access the day someone leaves
Suspend the account in the conversation where the decision was made, and lift it again if the leave turns out to be temporary.
03
Answering who actually has an account here
List the domain, then read one record in detail when the question narrows to a specific person.
04
Checking an address exists before you send work to it
Look the user up and see the state of the account rather than guessing from a stale directory export.
5 tools
Listed in project docs. Your client may show a different list.
addUsergetUsersuspendUserunsuspendUserBEFORE YOU INSTALL
What to know first
Tools you get
5 tools named in the project's documentation. There is no delete-user or password-reset tool; offboarding means suspendUser, and addUser generates a random password.
Requires
- Docker
- Node.js 20 or later with npm, to run the repository's token script (scripts/authorize.js)
- A Google Workspace admin account with the Admin Directory API turned on, and a Google Cloud OAuth client file saved as credentials.json
- GOOGLE_TOKEN_JSON in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
Clone and get a Google token
TERMINAL
git clone https://github.com/securityfortech/google-admin-mcp.git
cd google-admin-mcp
npm installSave your Google Cloud OAuth client file in this folder as credentials.json
TERMINAL
node scripts/authorize.jsSign in with your Google Workspace admin account in the browser window it opens; it writes token.json
Build the Docker image
TERMINAL
docker build -t google-admin-mcp .MCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"google-admin-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GOOGLE_TOKEN_JSON",
"google-admin-mcp"
],
"env": {
"GOOGLE_TOKEN_JSON": "<YOUR_GOOGLE_TOKEN_JSON>"
}
}
}
}<YOUR_GOOGLE_TOKEN_JSON> is the token.json from the sign-in step, base64-encoded on one line (for example base64 < token.json | tr -d '\n'). The script saves it as an authorized_user credential (client_id, client_secret, refresh_token) for the admin.directory.user and admin.directory.group scopes; the server base64-decodes GOOGLE_TOKEN_JSON and loads it with google.auth.fromJSON. -e GOOGLE_TOKEN_JSON passes the value from the env block into the container.
