human_edit_tracking: enabled: true history: []

Google Docs Preview MCP

Create anchored comments, replies, and real suggested edits in Google Docs from Claude.

Google’s hosted Docs MCP recognizes the preview operations but does not expose enough of the Docs API schema to use them:

The underlying Google Docs REST API accepts all three operations. See what failed and why.

Related MCP server: Ultimate Google Docs & Drive MCP Server

Choose a setup

The local server is the current recommendation. Claude.ai cannot connect to localhost or stdio; use Claude Desktop or Claude Code for the local option. Tool results still go to Claude for processing.

The local token file is plaintext JSON protected by Unix file permissions, not an OS keychain. Local execution removes the independent MCP host, but it does not protect against malware running as your user or an administrator.

Local quick start

npm test
npm run auth -- --client /path/to/desktop-oauth-client.json
claude mcp add --scope user google-docs-preview-local -- \
  node "$PWD/bin/docs-mcp-local.js"

The OAuth flow requests:

https://www.googleapis.com/auth/documents

This is the minimum scope for arbitrary document IDs, but Google classifies it as Sensitive and describes it as permission to see, edit, create, and delete all Google Docs documents. A drive.file design can narrow access to files a user explicitly selects, but it requires a Google Picker or per-file grant flow that this document-ID-only prototype does not implement.

See the complete setup guide before authorizing an account.

Existing working pilot

The local connector is already configured and connected on this machine:

Both credential files are ignored, outside this repository and mode 600; the table contains no credential value. Google Docs and Drive APIs are enabled, and the tester has effective Project Owner access. Check the connector with:

claude mcp get google-docs-preview-local
npm test

The pilot has now passed two live workloads: a disposable comment/reply/suggestion test and a revision-guarded suggested replacement plus evidence comment in a real published article's source Doc. The organization pilot record contains the access evidence; the stale-content finder retains the real-workflow readback.

This proves the local account and Preview API path. It does not make the developer-owned remote deployment production-ready.

Organization connector

One Google Cloud project and OAuth app can serve the team. Staff do not create Cloud projects or handle credentials: a Claude Owner publishes the connector once, then each registered Preview tester clicks Connect and authorizes their own Google account. Read the staff onboarding guide, administrator runbook, and pilot result.

The pilot deployment is developer-owned. Move the deployment, Redis store, secrets and administration to 80,000 Hours accounts before approving confidential documents.

Repository map

api/        Vercel HTTP transport
bin/        Local authorization and stdio entrypoints
src/        Shared MCP and Google Docs logic
test/       Protocol, passthrough, and token-refresh tests
docs/       Setup, security analysis, evidence, and guide images
archive/    Superseded documents retained for context

docs/reproduce/ is the concise maintained path from decisive prompts through method, scripts, inputs, and checks to the current output.

Verification

npm test

The test suite covers the preview schema, complete request forwarding, Docs-only scope metadata, canonical remote origins, redirect rejection, local token refresh, file permissions, OAuth challenges, and stateless protocol methods. Claude.ai, Claude Code and Claude Desktop have each passed live reads. The Claude.ai organization pilot created and recovered an anchored comment, its reply and a real unresolved suggestion, then the Google Docs UI was inspected.

Security status

• Local tokens are plaintext JSON stored outside the repository with mode 600.

• Docs tool calls construct requests only for the fixed docs.googleapis.com origin; local OAuth separately contacts Google’s documented authorization and token endpoints.

• Tool annotations mark writes as destructive, but approval behavior is enforced by the MCP client. Configure per-call approval for writes.

• The remote uses separate MCP and Google tokens. Google grants are encrypted at rest; Claude never receives the Google refresh token.

• The pilot proved one member’s flow. A second user and organizational unit have not been tested.

• The pilot host and Redis resources are still developer-owned. Organization ownership, admin-led offboarding, rate limits, monitoring and security review remain.

Read SECURITY.md, the organization-owned deployment decision, and the full threat model.