gws-admin-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CUSTOMER_ID | No | Google Workspace customer ID. Defaults to 'my_customer'. | my_customer |
| GOOGLE_SA_KEY | No | Path to the service account JSON key file. Overrides the default location ~/.config/gws-admin-mcp/service-account.json. | |
| DELEGATED_ADMIN | No | Email address of the super-admin to impersonate. Overrides the delegatedAdmin field in config.json. | |
| GWS_ADMIN_AUDIT | No | Set to '0' to disable the audit log. Default is '1' (enabled). | 1 |
| GWS_ADMIN_CONFIG_DIR | No | Alternate directory for config files (service-account.json, config.json, audit.log). Default is ~/.config/gws-admin-mcp. | |
| GWS_ADMIN_ALLOW_WRITE | No | Set to '1' to enable write tools. Default is unset (read-only). | 0 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| users_listB | List directory users. Optional |
| users_getA | Get a single user by email or id. |
| groups_listB | List groups. Optional |
| groups_getA | Get a group by email or id. |
| groups_list_membersC | List members of a group. |
| orgunits_listC | List organizational units. |
| orgunits_getA | Get an org unit by path (e.g. /Sales). |
| roles_listA | List admin roles defined in the org. |
| role_assignments_listA | List role assignments, optionally for a specific user. |
| domains_listA | List the domains and domain aliases in the org. |
| customer_getA | Get the Workspace customer (org) info. |
| devices_list_mobileC | List managed mobile devices. |
| devices_list_chromeosC | List managed ChromeOS devices. |
| reports_activitiesC | Query the audit log for an application. applicationName e.g. login, admin, drive, token, groups, calendar, mobile, user_accounts, saml. |
| reports_usage_userC | Get a user usage report for a date (YYYY-MM-DD). Use 'all' for all users. |
| reports_usage_customerA | Get the customer-wide usage report for a date (YYYY-MM-DD). |
| groupsettings_getA | Get a group's access settings (who can join/post/view, archiving, moderation, etc.). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Each tool targets a distinct resource and action (get vs list, different resource types like users, groups, devices, reports, etc.). Even similar tools like reports_activities and reports_usage are clearly separated by audit vs usage, and device lists distinguish mobile vs ChromeOS.
All tool names follow a consistent resource_operation pattern (e.g., users_list, groups_get, orgunits_list). Some names include a subresource (devices_list_mobile, groups_list_members), but the convention remains uniform and predictable.
17 tools is a reasonable number for a Google Workspace admin server covering users, groups, devices, reports, org units, roles, and domains. It is slightly on the heavier side but each tool focuses on a distinct administrative area.
The tool set is almost entirely read-only (get/list/query). There are no create, update, or delete operations for users, groups, devices, org units, roles, or domains, which is a significant gap for an 'admin' server. Management tasks like creating users or updating group settings are impossible.