google_workspace_mcp MCP工具

secret, but Google still requires one server-side

export MCP_ENABLE_OAUTH21=true export GOOGLE_OAUTH_CLIENT_ID="..." export GOOGLE_OAUTH_CLIENT_SECRET="..."

2. Launch - OAuth 2.1 requires HTTP transport

uvx workspace-mcp --transport streamable-http --tool-tier core ```

</td> </tr> </table>

Tool tiers keep context windows lean: core is the essential set, extended adds management operations, complete loads everything. Combine with --tools <service> ..., --read-only, or per-service --permissions, and subtract individual tools with --disabled-tools <name> ... - details in the server modes docs.

Optional: install the bundled skill for better Workspace tool routing

ln -s "$(pwd)/skills/managing-google-workspace" ~/.claude/skills/managing-google-workspace ```

ChatGPT - connect via Developer Mode with the ChatGPT guide.

VS Code, LM Studio, Open WebUI, and everything else - any MCP client works over streamable HTTP (recommended) or stdio. Client-specific walkthroughs live in the guides and FAQ.

Deployment & Advanced Configuration

Everything you need to run this in production lives in two places. The documentation covers auth modes and server configuration:

• OAuth 2.1 multi-user auth - bearer tokens, required for remote or shared HTTP endpoints
• Stateless container mode - zero disk writes for locked-down deployments
• OAuth proxy storage backends - memory, disk, or Valkey/Redis for distributed setups
• External OAuth provider mode - bring your own auth server, validate bearer tokens only
• Service accounts with domain-wide delegation - per-request user impersonation with an optional domain allowlist
• Trusted-gateway identity - proxy-verified per-user isolation with Pomerium, Cloudflare Access, oauth2-proxy, or any JWKS-verifiable gateway
• OpenTelemetry tracing - optional, off unless you configure an OTLP endpoint
• Docker - docker build -t workspace-mcp . && docker run -p 8000:8000 workspace-mcp

The Advanced Deployment guide covers self-hosting specifics: reverse proxy setup with WORKSPACE_EXTERNAL_URL (including the nginx Origin: null consent workaround, the WORKSPACE_MCP_ALLOW_NULL_ORIGIN_CONSENT escape hatch, and the Referrer-Policy pitfall), origin validation and VS Code webview allowlisting, credential store backends (local directory or GCS with CMEK enforcement), and the complete environment variable reference. Optional per-download payload ceiling for container deployments: set WORKSPACE_MCP_MAX_FILE_BYTES to a positive byte count (e.g. 5242880 for 5 MiB) to reject Drive / Gmail / Chat / Google Docs downloads that would otherwise be fully buffered in-process. Unset or 0 leaves the total size uncapped; uncapped Drive transfers still use 256 KiB transport chunks instead of the Google client's 100 MiB default. This is a file-size limit, not a process-RSS limit: leave headroom for parsing, base64/JSON representation, and concurrent tool calls. Invalid or negative values fail server startup instead of silently disabling the limit. Downloads streamed directly to disk are not subject to this in-memory payload ceiling.

Advanced OAuth 2.1 deployments affected by concurrent client token refreshes can tune FastMCP's early-refresh threshold and client-facing access-token lifetime. See .env.oauth21 for the bounded settings, recommended values, and security tradeoffs. These settings reduce how often the race occurs; they do not add a grace period to FastMCP's one-time-use refresh-token rotation.

Quick Start

Set credentials → pick a launch command → connect your client. Full walkthrough with screenshots: workspacemcp.com/quick-start

You'll need an OAuth client from Google Cloud Console with the APIs enabled for the services you plan to use - the quick start guide walks through it in about five minutes.