Skip to main content
Glama

Manage spreadsheet access

manage_permissions
Destructive

List, grant, update, or revoke sharing permissions on a Google Sheet to control access by users, groups, domains, or public link.

Instructions

Shares the spreadsheet (Drive permissions on the file — the OAuth token needs a Drive scope; the spreadsheets scope alone gets 403 here while every Sheets tool still works). action=list shows who has access: id, type, role, emailAddress/domain per permission; one page per call (shared-drive files cap a page at 100) — when the reply carries nextPageToken, pass it back as page_token for the rest. action=grant gives role reader/commenter/writer to type user/group (email_address required), domain (domain required, e.g. "example.com") or anyone (makes the link public — use deliberately); send_notification_email (default true for users) and email_message control the notification, allow_file_discovery lets domain/anyone grants surface in search. action=update changes an existing permission's role (permission_id + role). action=revoke removes a permission (permission_id) — the person loses access immediately. Ownership transfer is not supported by this server. Protecting individual ranges from co-editors is manage_protected_ranges, not this tool.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
roleNogrant/update: the access level to give.
typeNogrant: who the grantee is.
actionYesWhat to do with the file's permissions.
domainNogrant (domain): the domain, e.g. "example.com".
page_sizeNolist: max permissions per page (1..100; shared-drive files default to 100).
page_tokenNolist: nextPageToken from the previous page.
email_addressNogrant (user/group): the grantee's email.
email_messageNogrant: custom text for the notification email.
permission_idNoupdate/revoke: the permission's id from action=list (or the grant reply).
spreadsheet_idYesThe spreadsheet id — the long id from the URL (docs.google.com/spreadsheets/d/<spreadsheetId>/edit) or from create_spreadsheet / search_spreadsheets output.
allow_file_discoveryNogrant (domain/anyone): let the file appear in search results (default false).
send_notification_emailNogrant: send the standard sharing notification (default true for users/groups).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses that revoke removes access immediately, anyone grants make the link public, a Drive scope is required while Sheets scope fails, pagination is one page per call, and shared-drive pages cap at 100. This is substantial behavioral context beyond destructiveHint and readOnlyHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but tightly structured around the four actions, with the core purpose and critical auth caveat front-loaded. Every sentence adds necessary information; there is no filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter, four-action tool with no output schema, the description is remarkably complete. It covers all action semantics, parameter combinations, defaults, pagination, auth requirements, destructive behavior, and the boundary with a sibling tool. Nothing essential is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema coverage is 100%, the description adds meaningful semantics: action-specific parameter usage, defaults, pagination flow, and consequences of certain values like domain/anyone. It explains how page_token, permission_id, and send_notification_email behave in practice, which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific resource (Drive permissions on the spreadsheet) and enumerates each action (list, grant, update, revoke). It explicitly distinguishes itself from the sibling manage_protected_ranges, so an agent can tell exactly what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit per-action usage conditions: which parameters are required for each grantee type, pagination handling with nextPageToken, and defaults for send_notification_email and allow_file_discovery. It also explicitly routes range-protection work to manage_protected_ranges instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/A1-x-Tech/mcp-google-sheets'

If you have feedback or need assistance with the MCP directory API, please join our Discord server