Summary

One account, one server, instead of twelve separate integrations.

What it takes off you is the seam between products: the agent finds the thread in Gmail, opens the sheet it points at, writes the summary into a Doc and puts the follow-up on the calendar without a different connector for each step. The tool tiers are what make that practical rather than expensive.

What it is

One server across twelve Google Workspace services, with 120-plus tools behind it, OAuth 2.1 multi-user auth, three progressive tool tiers, a read-only mode and a full CLI. It runs locally over stdio for older clients and remotely over streamable HTTP.

What you get

Gmail, 15 tools: search, send, draft, labels, filters and attachments
Drive, 16 tools: search, create, share and import Office files
Calendar, 7 tools: events, free/busy across calendars, and Out of Office and Focus Time blocks
Docs, 19 tools: editing, styling, tables, tabs, comments and export
Sheets, 14 tools: ranges, structured tables, formatting and conditional rules
Slides, 7 tools: presentations created and batch-updated, with thumbnails and comments
Forms, 6 tools: forms built, published and their responses read — the part most integrations stop short of
Tasks 6 and Contacts 8: task lists with hierarchy, and people and groups
Chat, 6 tools: spaces and messages; Custom Search, 2 tools: programmable search
Apps Script, 15 tools: write, deploy and run
Three tool tiers — `core`, `extended`, `complete` — plus `--tools` to pick services, `--read-only`, per-service `--permissions`, and `--disabled-tools` to subtract individual ones

Requirements

Uvx, and an OAuth client from your own Google Cloud project with the APIs enabled for the services you plan to use — `GOOGLE_OAUTH_CLIENT_ID` and `GOOGLE_OAUTH_CLIENT_SECRET`. Launch as `uvx workspace-mcp --tool-tier core`, which is the setting that keeps 120 tools from filling the context window. For Claude Desktop and web the recommended path is HTTP mode added as a Connector; OAuth 2.1 with PKCE also requires HTTP transport, plus `MCP_ENABLE_OAUTH21=true` and a redirect URI. The server sends nothing anywhere except Google's APIs, using your own credentials, with no telemetry unless you configure tracing. Local file reads default to the managed attachment directory, and `.env*` files and credential stores such as `~/.ssh/` and `~/.aws/` stay blocked even if `ALLOWED_FILE_DIRS` is widened.

Setup effort

One command plus a key — uvx workspace-mcp, then supply credentials