📁 Google Drive MCP Server (Least Privilege Key)

Enterprise-grade Google Drive integration for AI assistants — seamless Shared Drive boundary control, Least Privilege Key Authentication, and real-time audit logging for Gemini, Claude, Cursor, and more.

An MCP server providing secure Google Drive access to AI assistants using Least Privilege Key Authentication, Application Default Credentials (ADC), and Service Account Impersonation.

⚡ Quick Start

Add to your MCP client configuration (e.g., claude_desktop_config.json, mcp_config.json, or Cursor):

{
  "mcpServers": {
    "googledrive": {
      "command": "npx",
      "args": ["-y", "@hydrochlorix/googledrive-mcp-server"],
      "env": {
        "GOOGLE_DRIVE_SHARED_DRIVE_ID": "<YOUR_SHARED_DRIVE_ID>",
        "GOOGLE_DRIVE_ROOT_FOLDER_ID": "<OPTIONAL_ROOT_FOLDER_ID>"
      }
    }
  }
}

Related MCP server: mcp-google-drive

✨ Features

• 🛡️ Least Privilege Key Security: Supports Service Account JSON keys alongside Application Default Credentials (ADC) while strongly enforcing Drive and Root Folder boundaries.

• 🎯 Two-Layer Boundary Control: Combined mandatory Shared Drive boundary with an optional narrower Root Folder boundary (GOOGLE_DRIVE_ROOT_FOLDER_ID).

• 🏢 Google Workspace Shared Drive Support: Full support for enterprise Shared Drives (supportsAllDrives: true) for 24/7 automation.

• 📋 Structured Operation Logger: Machine-readable NDJSON process log (~/.mcp/logs/operation.log) with crash reporting, zero-dependency sync durability, and automatic credential sanitization.

• 📂 Automatic Local Destination Folders: Missing local directory structures are created automatically when downloading files.

• 📄 Auto-Text Workspace Docs Export: Automatically converts Google Workspace Docs/Sheets to plain text (text/plain) for immediate consumption by LLMs.

• 📊 Real-time Audit Dashboard: Built-in SQLite WAL logger (~/.mcp/audit.db), REST API, SSE streaming, and a glassmorphism web SPA dashboard (default http://127.0.0.1:3001).

• 🔒 Read-only Enforcement: Option to restrict tool registration to read-only tools via GOOGLE_DRIVE_MODE="readonly".

💡 Why @hydrochlorix/googledrive-mcp-server?

🏗️ How It Works

AI Assistant (e.g. Gemini / Claude / Cursor)
       │  MCP Protocol (stdio)
       ▼
googledrive-mcp-server (Node.js Process)
       │  Google Auth Application Default Credentials (ADC)
       ▼
Google Cloud IAM (Service Account Impersonation)
       │  Short-Lived Access Token (OAuth2)
       ▼
Google Drive API v3 (Shared Drive Boundary Enforcement)

🛠️ Tools

1. drive_list_files (Read)

List files and folders in Google Drive within configured boundaries.

• pageSize (number, optional): Maximum number of items to return (1-100, default: 10).

• query (string, optional): Search query string (e.g. name contains 'Report').

2. drive_download_file (Read)

Download a file from Google Drive to local disk.

• fileId (string, required): The ID of the file to download.

• destPath (string, required): Local file path where the file will be saved. Missing parent directories are created automatically.

3. drive_download_file_from_url (Read)

Download a file using a public/shared Google Drive URL.

• url (string, required): Full Google Drive shareable link.

• destPath (string, required): Local file destination path.

4. drive_create_folder (Write)

Create a new folder inside Google Drive.

• name (string, required): Name of the folder.

• parentId (string, required): Parent folder ID within boundary.

5. drive_upload_text_file (Write)

Upload a text file to Google Drive.

• name (string, required): File name.

• content (string, required): Text file contents.

• parentId (string, required): Parent folder ID within Shared Drive.

Note: Setting GOOGLE_DRIVE_MODE="readonly" hides write tools (drive_create_folder, drive_upload_text_file).

🚀 Setup & Authentication (3 Steps)

Step 1: One-Time Google Cloud IAM Setup

gcloud config set project <PROJECT_ID>
gcloud services enable drive.googleapis.com iamcredentials.googleapis.com --project="<PROJECT_ID>"

# Grant Impersonation Permission to your user account
gcloud iam service-accounts add-iam-policy-binding <SERVICE_ACCOUNT_EMAIL> \
    --member="user:<YOUR_WORKSPACE_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator" \
    --project="<PROJECT_ID>"

Step 2: Configure Shared Drive Permissions

Add your Service Account email (<SERVICE_ACCOUNT_EMAIL>) as a member of your target Google Workspace Shared Drive (Viewer for read-only, Contributor for write access).

Step 3: Authenticate (Choose A or B)

Option A: Local Desktop (ADC / Impersonation) Run Application Default Credentials (ADC) login with impersonation:

# Desktop (GUI)
gcloud auth application-default login --impersonate-service-account="<SERVICE_ACCOUNT_EMAIL>"

# Headless (WSL / SSH)
gcloud auth application-default login --no-browser --impersonate-service-account="<SERVICE_ACCOUNT_EMAIL>"

Verify setup:

gcloud auth application-default print-access-token

Option B: Server / 24-7 Headless (Least Privilege Key) For servers where session controls cause ADC to expire daily, use a Service Account JSON Key:

1. Ensure your Service Account has no project-level IAM roles (this enforces Least Privilege). It only needs to be invited directly to the target Google Workspace Shared Drive.

2. Download the JSON key file to your server.

3. Set the environment variable in your MCP client config or shell:

export GOOGLE_APPLICATION_CREDENTIALS="/absolute/path/to/service-account-key.json"

📊 Real-Time Audit & Governance Dashboard

Logs all MCP tool calls to SQLite (~/.mcp/audit.db) with zero performance overhead.

• Dashboard Web UI: http://127.0.0.1:3001?token=<TOKEN>

• REST Logs API: GET http://127.0.0.1:3001/api/audit/logs

• SSE Stream: GET http://127.0.0.1:3001/api/audit/stream

• Environment Options:

  • MCP_DASHBOARD_ENABLED=false — Disable dashboard server.

  • MCP_DASHBOARD_PORT=3001 — Change HTTP port.

  • MCP_DASHBOARD_TOKEN=<CUSTOM_TOKEN> — Set authentication token.

• Generate Token: Run npx -- @hydrochlorix/googledrive-mcp-server --gen-token (or locally: npm run build && node dist/server.mjs --gen-token) to securely generate a 256-bit token.

💻 Development & Testing

• Development Mode: npm run dev

• Build Production: npm run build

• Run Full Suite (Lint, Build & All Tests): npm run test:all

• Run Unit Tests: npm test

• Run Dashboard & Security Tests: npm run test:dashboard

❓ Troubleshooting

• insufficient authentication scopes or 401/403 Permission Denied: Re-run gcloud auth application-default login --impersonate-service-account="<SERVICE_ACCOUNT_EMAIL>" (add --no-browser for headless/WSL).

• invalid_rapt Reauthentication Error / Token Expiration: Token expiration is typically governed by your Google Workspace Admin's Session Control policies.

  • Local/Desktop: Perform a clean reset using gcloud auth revoke --all followed by gcloud auth application-default login --impersonate-service-account="<SERVICE_ACCOUNT_EMAIL>".

  • Server/Headless: If you need 24/7 uptime without manual re-auth, you may use a Service Account JSON Key as a fallback (ADR-0011) by setting export GOOGLE_APPLICATION_CREDENTIALS="/path/to/key.json".

• Service Account Storage Quota Error: Service accounts do not have personal Drive storage quota. Ensure uploads target a Google Workspace Shared Drive.

💖 Support

If this project helped you, please consider supporting its development!

📜 License

Distributed under the MIT License.