# ========================================
# MCP Server Google - Environment Configuration
# ========================================
# Copy this file to .env and fill in the values
# IMPORTANT: Never commit .env to version control!
# ========================================
# Authentication Mode
# ========================================
# Options: "oauth" or "service_account"
# - oauth: For local development / individual use
# - service_account: For automation / shared access
AUTH_MODE=oauth
# ========================================
# OAuth Configuration (when AUTH_MODE=oauth)
# ========================================
# Get these from Google Cloud Console > APIs & Services > Credentials
OAUTH_CLIENT_ID=your-client-id.apps.googleusercontent.com
OAUTH_CLIENT_SECRET=your-client-secret
OAUTH_REDIRECT_URI=http://localhost:3000/oauth/callback
OAUTH_TOKEN_PATH=.secrets/token.json
# ========================================
# Service Account Configuration (when AUTH_MODE=service_account)
# ========================================
# Path to the downloaded JSON key file
SERVICE_ACCOUNT_PATH=.secrets/service-account.json
# The email address of the service account
SERVICE_ACCOUNT_EMAIL=your-sa@your-project.iam.gserviceaccount.com
# ========================================
# Google API Scopes (comma-separated)
# ========================================
# Uncomment and modify if you need different scopes
# GOOGLE_SCOPES=https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/calendar
# ========================================
# Feature Flags - Safety Controls
# ========================================
# Gmail - Default: readonly
GMAIL_READONLY=true
GMAIL_SEND_ENABLED=false
GMAIL_DELETE_ENABLED=false
GMAIL_MODIFY_LABELS_ENABLED=false
# Drive
DRIVE_WRITE_ENABLED=true
DRIVE_DELETE_ENABLED=false
# Sheets
SHEETS_WRITE_ENABLED=true
# Docs
DOCS_WRITE_ENABLED=true
# Calendar - Default: read-only with dry-run for writes
CALENDAR_READ_ENABLED=true
CALENDAR_WRITE_ENABLED=false
CALENDAR_DRY_RUN_DEFAULT=true
# ========================================
# Drive Folder Allowlist (comma-separated folder IDs)
# ========================================
# If empty, all folders are accessible
# Recommended: Set this for Service Account mode
# DRIVE_ALLOWLIST_FOLDERS=folder-id-1,folder-id-2
# ========================================
# Logging Configuration
# ========================================
LOG_DIR=./logs
LOG_TO_CONSOLE=true
LOG_TO_FILE=true
# Options: debug, info, warn, error
LOG_LEVEL=info
# ========================================
# Server Configuration
# ========================================
# Options: "stdio" (for Claude Code) or "http" (for debugging)
SERVER_MODE=stdio
SERVER_PORT=3000
