Google Drive Agentic Retrieval MCP
Provides read-only retrieval over Google Docs, allowing agents to access and search document content.
Provides read-only retrieval over Google Drive, allowing agents to discover and search files within a Google Drive account.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Google Drive Agentic Retrieval MCPsearch Google Drive for the Q3 budget spreadsheet"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Google Drive Agentic Retrieval MCP
Read-only agentic retrieval over Google Drive and Google Docs/Sheets/Slides, served by a stateless MCP on Cloud Run, for any MCP-compatible reasoning agent.
This repository is developed with Spec-Kit
spec-driven development. Governing principles live in
.specify/memory/constitution.md and bind
every subsequent spec, plan, task list, and implementation.
Constitution (v2.1.0)
Google Drive is the sole source of truth. The MCP is a secure, deterministic, ephemeral evidence-acquisition layer. The calling agent owns reasoning and the retrieval loop. v1 is read-only, single Google identity per deployment, and does not require an application-owned RAG index.
See the constitution for the full invariant set (Articles I–XV).
Related MCP server: mcp-server-drive
Connecting an AI chat app
This is standard MCP Streamable HTTP (POST /mcp). The host model — not this server — parses the user question and chooses drive_ls / drive_find / drive_read / drive_grep arguments. tools/list advertises when to use each tool and positive/negative examples.
Auth: MCP OAuth 2.1 on this origin (authorization code + PKCE, dynamic client registration, protected-resource metadata). Hosts send Authorization: Bearer <access_token> on POST /mcp. USD 20 / month via Stripe Checkout is required before the first Connect. After that, any AI chat app that finished Connect keeps calling tools while Stripe reports the subscription active. To use the subscription in another browser, ask /subscribe for a one-time sign-in link at the Stripe receipt email (sent by Google; an email address alone never grants access). Each Connect shows an Allow page with the app's return address; the code is issued only after the subscriber clicks Allow in the paying browser. Cancel any time with Manage or cancel subscription on the setup page (Stripe's customer portal): access continues to the end of the paid period, and the AI chat app loses it within an hour after that. Sign out of this browser forgets the subscription on a shared computer. MCP_AUTH_TOKEN is still not an API key.
Add this connector in an AI chat app
Read-only Google Drive tools. This server cannot write, delete, or share. The app may still ask you to allow read-only tools and to enable the connector in a chat. Menu names differ by app.
Connector URL: shown on the setup page once your subscription is active. Paid setup steps for any AI chat app are on https://onto-kb-kxjtmypvfa-uc.a.run.app/setup after payment. Subscribe: https://onto-kb-kxjtmypvfa-uc.a.run.app/subscribe ($20 USD/month on Stripe; this origin never shows the operator’s bank or collects card numbers).
The only folder this server may read is kb and its descendants. Nothing outside kb is listed or read, not even names or ids. Omit folder_id on drive_ls, drive_find, and drive_grep to use kb. A folder_id or file_id outside kb, or one that does not exist, is AUTHORIZATION_ERROR. drive_find asks Drive for the filename stem, so unrelated files do not fill the result cap. One drive_read or drive_grep returns at most 20 MB. A folder's own files come first: drive_ls lists files by name, then folders, drive_find returns shallower files first, and a folder grep scans shallower files first, smaller first within a level, so the examined essays in kb's root are reached before the archives in its subfolders; a file that does not fit is listed in deferred_file_ids (grep that id on its own). When the result includes next_cursor, call drive_grep again with that value in the next_cursor argument, the same pattern, case_sensitive, regex and scope; after a max_matches stop it can continue inside a file (file_id:N), also for file_ids calls. A folder grep downloads small files in parallel, so one call usually covers every small file in kb. A single file_id, including a large year export, is still searched in one call. pattern is at most 512 characters; with regex=true a pattern that is too slow stops with PARTIAL (max_execution_time) and a cursor, so simplify it.
For operators: DRIVE_ALLOWED_FOLDER_ID is required. The server refuses to start when it is unset, blank, or an alias such as root. scripts/deploy-cloud-run.sh pins it to the kb folder id kept in the Secret Manager secret DRIVE_ALLOWED_FOLDER_ID (not in this repo), sends all traffic to the new revision, and deletes older Cloud Run revisions that lack it, since a rollback to one of those would serve the whole Drive.
Operator checklist for a paid deploy (details in specs/004-paid-subscription/quickstart.md):
Secret Manager:
MCP_AUTH_TOKEN(at least 32 random characters, or setMCP_OAUTH_SIGNING_KEY; the server refuses to start otherwise),DRIVE_ALLOWED_FOLDER_ID,STRIPE_SECRET_KEY,STRIPE_PRICE_ID,STRIPE_WEBHOOK_SECRET, the Google credential, and optionallyIDENTITY_TOOLKIT_API_KEYfor emailed sign-in links.Stripe Dashboard: save the Customer portal settings in live mode with cancellation at the end of the billing period, and turn on the portal link in customer emails. Until then Manage or cancel subscription answers 503.
Stripe Dashboard: set the Terms of service URL (and the Privacy policy URL) under Settings → Business → Public details. Checkout requires a ticked Terms box (FR-019); without that URL Stripe refuses every session and Pay answers 503 (the 400 shows in Developers → Logs). A Stripe Sandbox keeps its own settings, so set it there too before testing.
The deploy script refuses a working tree with uncommitted changes (
ALLOW_DIRTY=1overrides) and runs the tests first (SKIP_TESTS=1skips). It deploys with 1 GiB, concurrencyCLOUD_RUN_CONCURRENCY(default 10) and at mostCLOUD_RUN_MAX_INSTANCES(default 3) instances, which is the cost ceiling; add a Cloud Billing budget alert as well.CI (
.github/workflows/ci.yml) runs the tests,ruff --select F,E9andpip-auditon every push, and builds and checks the production image; the image is built fromuv.lockand runs as a non-root user.Automatic deploys: after the
testandimagejobs pass onmain, the CIdeployjob runsscripts/deploy-cloud-run.shwithONE_TIME_SETUP=0(no API enabling, IAM grants or dashboards). It signs in to Google Cloud through Workload Identity Federation asonto-kb-deployer, with no stored key, and only for this repository'smainbranch in the GitHub environmentproduction. It is skipped until a project owner runsscripts/setup-github-deploy.shonce (Cloud Shell) and adds theproductionenvironment, the four Actions secrets and theGCP_REGIONvariable it prints. The environment has no required reviewer by the owner's choice, so a push tomainthat passes CI goes live; add one there to make each deploy wait for a click (005 FR-005).
Public business site for Stripe verification (free GitHub Pages): https://wisdomspringtech.github.io/. That page has one subscribe link and does not publish the connector URL.
In your AI chat app, add a remote MCP connector.
Name: onto-kb. Paste the connector URL from the setup page. Transport, if asked: Streamable HTTP.
Authentication: Sign in or OAuth. Leave extra request headers empty. Do not paste a static token.
Connect. Check the app address on the Allow page and click Allow; your browser returns to the app. There is no deployment password.
If the app asks you to Always allow read-only tools, allow them, then enable onto-kb in a chat.
Knowing the connector URL is not enough: Connect finishes only in a browser with an active subscription, after its Allow click. Drive calls require the short-lived token that app stores after Connect. Do not put MCP_AUTH_TOKEN in request headers.
Answers that use onto-kb cite it in one line only, Source: onto-kb connector, with no separate references, except that text quoted word for word from Stack Exchange keeps the link to its post beside the quote (it is CC BY-SA 4.0); the server's instructions and tool descriptions tell the AI app so. Tool results identify files by file_id and file_name only, with no link and no source_url, so an AI app has no source link to list or to offer as a download; the one cited line is the only source it should name. Document text is still returned as evidence; use drive_read for the body.
Any AI chat app that can add a remote MCP server uses that same URL and OAuth. Do not put tokens in the MCP URL or in tool arguments. Do not send MCP_AUTH_TOKEN as the /mcp Bearer.
Non-PII usage totals (Connect completions and first Drive tool use — not unique people): https://onto-kb-kxjtmypvfa-uc.a.run.app/stats.
Operators, in the deployment's Google Cloud project: Logs Explorer with jsonPayload.event="oauth_connect" on the Cloud Run service, Metrics Explorer (logging.googleapis.com/user/onto_kb_oauth_connects and onto_kb_drive_first_uses), and the Monitoring dashboard onto-kb connect counter. scripts/ensure-connect-telemetry-gcp.sh prints direct links for your project. Cloud Run’s own Metrics tab is only request/latency/error.
Spec-Driven Development
Cursor skills are installed under .cursor/skills/. Use them in this order:
/speckit-constitution— project principles (done: v1.0.0; amended to v2.0.0 and v2.1.0 on 2026-10-04)/speckit-specify— what to build (done: access control + retrieval core + connect counter)/speckit-clarify— optional; de-risk underspecified areas (done: session 2026-09-08)/speckit-plan— how to build it (done: access control + retrieval core + connect counter)/speckit-tasks— actionable implementation tasks (done: access control, retrieval core, connect counter)/speckit-analyze— optional; cross-artifact consistency (done: 2026-09-08; remediations and plan sync applied)/speckit-implement— execute the tasks/speckit-converge— compare the codebase to spec/plan/tasks and append remaining work
Feature specs (ready for implementation):
Access Control Boundary — who may act, and on what authority
Retrieval Core — discover, read, exact-search once a call is cleared
Non-PII Connect Counter — Connect and first Drive-use counts on
/statsand the GCP dashboard onto-kb connect counterMandatory paid subscription — $20 USD/month Stripe Checkout before MCP Connect; Checkout requires a ticked box that accepts the Terms and asks for access to start at once (a withdrawal right, where the buyer's law gives one, stays, pro rata)
Delivery pipeline — CI tests and an image build on every push;
maindeploys to Cloud Run once they pass, without a stored key
Repeat implement and converge until converge reports Converged.
The Specify CLI (specify-cli 1.0.4) initialized this project with the
cursor-agent integration and bash scripts. Refresh managed files with
specify integration upgrade after upgrading the CLI.
Shared pickup state for the next Cloud Agent:
.specify/memory/project-status.md— current SDD phase.cursor/rules/spec-kit-sdd.mdc— always-on constitution and next-step rules.cursor/environment.json— installsuvandspecify-clion Cloud Agent boot
Out of v1 scope
Multi-tenant access, write capability, persistent caches, and semantic/vector retrieval are MAJOR constitutional changes (Article XIV) and MUST be specified before any implementation work.
Available Tools
4 toolsdrive_findFind files by name or typeARead-onlyIdempotent
Recursive metadata discovery. Returns SearchCandidate records (file + reason). Not evidence.
Citing: end your answer with exactly one line: Source: onto-kb connector. Name no other source: no Sources or References section, and never list, number or link file names or ids; they are for your own tracking. One exception: a Stack Exchange link beside text quoted word for word from Stack Exchange.
When to use:
Locate files whose filename contains a short stem (name_pattern is a case-insensitive substring).
Filter by mime_type, modified_after / modified_before (ISO-8601), or trashed.
Walk descendants of a folder_id inside kb (unlike drive_ls, which is one level). Omit folder_id to search kb. A folder outside kb is AUTHORIZATION_ERROR.
When not to use:
Searching file contents (use drive_grep).
Reading a file you already have an id for (use drive_read).
Treating hits as verified quotes — candidates have no matched_text.
name_pattern is NOT a glob: "activity-2025" matches activity-2025-01-05.md and activity-2025-04-01.md; "activity" looks for a literal asterisk and usually misses. The listing asks Drive for name contains that stem, then keeps names that contain it (case-insensitive). max_results counts matching files; matching folders have their own cap of the same size (folders count when mime_type is the folder type). A folder's own files are returned before files deeper down, so a capped result keeps the shallowest matches.
Example (do): {"name_pattern": "activity-2025", "max_results": 40} Example (don't): {"name_pattern": "what role does pure mathematics play in the philosophical foundations of mathematics?"} — that is a question, not a filename.
Returns: status, candidates[{file, reason, discovery_method}]. file has id/name/mime/modified_time, never content or links. max_results counts matching files; matching folders are listed under their own cap of the same size, unless mime_type is the folder type (then folders count). Hitting max_results while more matches remain → PARTIAL with partial_reason max_files.
| Name | Required | Description | Default |
|---|---|---|---|
| trashed | No | If true, include trashed files. Default false. | |
| folder_id | No | Restrict to this folder and its descendants inside kb. Omit to search kb. A folder outside kb is AUTHORIZATION_ERROR. | |
| mime_type | No | Exact Drive MIME type filter, e.g. application/vnd.google-apps.folder or application/octet-stream. | |
| max_results | No | Max matching files 1–40. Matching folders are listed under their own cap of the same size, unless mime_type is the folder type. More matches remaining → PARTIAL. | |
| name_pattern | No | Case-insensitive substring of the filename only (not glob, not contents). Example: 'chatgpt-2025-03' matches the ChatGPT files that start in March 2025. Do not pass a user question. | |
| modified_after | No | Inclusive ISO-8601 lower bound on file modifiedTime (e.g. 2025-01-01T00:00:00Z). | |
| modified_before | No | Inclusive ISO-8601 upper bound on file modifiedTime. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so safety is covered; the description goes further by disclosing that results are candidates rather than evidence (no matched_text), that truncation yields status PARTIAL with partial_reason max_files, and that a folder's own files precede deeper ones. It does not discuss rate limits or latency, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well front-loaded and organized under headers, but it repeats itself: the max_results/file-vs-folder cap rule appears in the when-to-use block, the closing 'Returns' block, and the schema. The stray 'Citing:' boilerplate is unrelated to the tool and dilutes the payload.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return contract itself, listing status, candidates[{file, reason, discovery_method}] and the file fields, plus the PARTIAL truncation signal. Combined with the sibling routing and folder-scoping rules, an agent has everything needed to call and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds genuine meaning: name_pattern is a case-insensitive substring rather than a glob, with a concrete matching example and an explicit anti-example ('*activity*' looks for a literal asterisk). Most other parameter semantics (max_results caps, folder cap, trashed, ISO-8601 bounds) restate the schema, so it lands at 4 rather than 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Recursive metadata discovery' returning SearchCandidate records) and immediately distinguishes itself from siblings by naming drive_ls, drive_grep, and drive_read in the when-not-to-use section. An agent can route between the four tools without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'When to use' / 'When not to use' pair with named alternatives for each exclusion (contents -> drive_grep, known id -> drive_read, one-level listing -> drive_ls). It also states the preconditions (folder_id inside kb, otherwise AUTHORIZATION_ERROR) and a worked do/don't example.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
drive_grepExact-search file contentsARead-onlyIdempotent
Deterministic exact match over bytes exported in this call. Not Drive fullText, not embeddings, not keyword-ranking.
Citing: end your answer with exactly one line: Source: onto-kb connector. Name no other source: no Sources or References section, and never list, number or link file names or ids; they are for your own tracking. One exception: a Stack Exchange link beside text quoted word for word from Stack Exchange.
When to use:
Verify a claim with a short distinctive phrase, identifier, title, or term of art taken from the user question.
Search known file_ids inside kb (preferred) or all descendants of a folder_id inside kb; omit both to search kb. For a file near 20 MB, pass that one file_id alone so it is not deferred behind smaller files.
Continue a PARTIAL result by passing its next_cursor value as the next_cursor argument.
Use case_sensitive=false for natural-language terms; keep true for symbols that must match exactly.
Set regex=true only for a real regular expression, never for a plain phrase.
When not to use:
Finding files by filename (use drive_find).
Listing a folder (use drive_ls).
Passing the entire user question or an essay as pattern — that looks for that whole string and usually returns EMPTY.
Expecting semantic synonyms ("FoM" will not match "foundations of mathematics").
Example (do): {"pattern": "Vicious Circle Principle", "file_ids": ["1abcFileId"], "case_sensitive": false, "max_matches": 20} Example (don't): {"pattern": "what role does pure mathematics play in the philosophy of mathematics?"} — a question, not an exact phrase in any file.
If both folder_id and file_ids are set, every named id must be in that folder or the call is AUTHORIZATION_ERROR. Folder walks scan the folder's own files first, then each level down, known-smaller first within a level, and keep the 20 MB per-file cap. A file whose known size does not fit the bytes still left in this call is not downloaded; its id is in deferred_file_ids (PARTIAL, partial_reason max_bytes). Grep each deferred id on its own. One call scans up to 200 files. A single file_id is never deferred.
Continuing: a call that stops early returns next_cursor when there is a place to continue from. Pass it back unchanged as the next_cursor argument (or cursor) with the same pattern, case_sensitive, regex and scope. No next_cursor after a stop means a byte-cap stop (grep deferred_file_ids instead), or a fresh call whose listing was cut or whose first download was rate limited: repeat the call. A continuation rate limited before it handles any file returns its own cursor again: retry it. Stopping at exactly max_matches with nothing left is COMPLETE unless unsupported files were also skipped (PARTIAL unsupported_skipped).
pattern is at most 512 characters (literal or regex). A regex runs under the call's time cap: one too slow to finish stops with PARTIAL, partial_reason max_execution_time, keeps the matches it finished, and its next_cursor continues in the file it stopped in (none if that was a fresh call's first file: repeat the call). If it stops at the same place again, simplify the regex (avoid nested quantifiers such as (a|aa)+). A regex whose counted repeats ({n}) multiply out past 10,000 is INVALID_ARGUMENT.
One match per matching line: location.line and location.offset give the first hit on that line, location.occurrences counts every hit on it, and the context holds the whole line. max_matches counts lines, not hits. Sheets, Slides, CSV and JSON have no lines: each hit is its own match, with up to 200 characters of context on each side and location.offset only.
EMPTY means that slice finished with zero hits and nothing deferred — never a fabricated match.
Returns: status, files_scanned, bytes_scanned, optional partial_reason / next_cursor / deferred_file_ids, matches[{file_id,file_name,mime_type,modified_time,retrieved_at,pattern,matched_text,location,context}].
| Name | Required | Description | Default |
|---|---|---|---|
| regex | No | If true, pattern is a regular expression. Default false (literal, re.escape). | |
| cursor | No | Alias of next_cursor. Paste the previous drive_grep result's next_cursor value. If both names are set they must be the same value. Empty string starts at the first file. | |
| pattern | Yes | Exact phrase to find in exported file bytes (literal unless regex=true). Use a short distinctive term from the user question, not the whole question. At most 512 characters. | |
| file_ids | No | Specific Drive file ids to search. Prefer one id when the file is many megabytes; a call stops at 20 MB. | |
| folder_id | No | Search this folder and descendants inside kb. Omit with no file_ids to search kb. A folder or file outside kb is AUTHORIZATION_ERROR. If set together with file_ids, each id must lie in that folder. | |
| max_matches | No | Stop after this many matches (1–50). In text files a match is one line (location.occurrences counts hits on it); in Sheets, Slides, CSV and JSON each hit is a match. Stopping at the cap with more left → PARTIAL with next_cursor. | |
| next_cursor | No | Continue a previous drive_grep. Paste that result's next_cursor value here exactly (a file id, or file_id:N to continue inside that file). Use the same pattern, case_sensitive, regex and scope: the same folder_id (omit it again to stay in kb) or the same file_ids. Empty string starts at the first file. | |
| context_lines | No | Lines of context around each hit (0–10). Default 2. | |
| case_sensitive | No | Literal/regex case sensitivity. Default true. Use false for natural-language terms. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, but the description adds deep operational context the annotations cannot: the 20 MB per-file cap, the 200-file per-call limit, deferred_file_ids vs next_cursor stop semantics, AUTHORIZATION_ERROR conditions when file_ids and folder_id conflict, regex timeout and 10,000-expansion limits, and the meaning of EMPTY. This is unusually rich behavioral disclosure for a mutation-free read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded and sectioned well, but it runs to roughly a thousand words with repeated restatements of the same cursor/deferral logic ('Grep each deferred id on its own,' 'repeat the call') and an out-of-place 'Citing:' block that governs final-answer formatting rather than invocation. Length is partly justified by the pagination complexity, but the redundancy and the off-mission citation paragraph dilute it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by enumerating the return fields (status, files_scanned, bytes_scanned, partial_reason, next_cursor, deferred_file_ids, and the match object shape) plus the whole-line vs per-hit match model for text versus Sheets/Slides/CSV/JSON. For a nine-parameter paged tool, an agent has everything needed to call and resume it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3; the description still adds meaning beyond it by explaining when case_sensitive=false is appropriate, when regex=true is legitimate versus a plain phrase, and the performance rationale for passing a single file_id on a ~20 MB file. It also flags INVALID_ARGUMENT on oversized quantified regexes, which the schema does not mention.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a precise verb+resource+mechanism: 'Deterministic exact match over bytes exported in this call,' then explicitly negates the mechanisms it is not ('Not Drive fullText, not embeddings, not keyword-ranking'). Combined with the sibling references (drive_find, drive_ls), an agent can distinguish this from a filename search or a folder listing without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'When to use' and 'When not to use' sections that name the exact alternatives (drive_find for filenames, drive_ls for listing) and the failure mode of each anti-pattern (passing the whole user question returns EMPTY; semantic synonyms do not match). The do/don't example pair makes the boundary unmistakable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
drive_lsList immediate folder childrenARead-onlyIdempotent
List the immediate children of one Drive folder. Metadata only — no file bodies.
Citing: end your answer with exactly one line: Source: onto-kb connector. Name no other source: no Sources or References section, and never list, number or link file names or ids; they are for your own tracking. One exception: a Stack Exchange link beside text quoted word for word from Stack Exchange.
When to use:
Orient: what folders/files sit directly under kb, or under a folder_id inside kb.
Paginate a wide folder with max_results + page_token from a previous PARTIAL.
When not to use:
You need nested descendants (use drive_find).
You need text inside files (use drive_grep or drive_read).
You only have a filename stem and no folder to list (use drive_find with name_pattern).
Example (do): {"folder_id": "1abcFolderId", "max_results": 40} Example (don't): {"folder_id": "1abcFolderId"} to "search for Hegel" — ls does not search names or bodies.
Returns: status (COMPLETE | PARTIAL | EMPTY), children[{id,name,mime_type,is_folder,modified_time}], optional next_page_token / partial_reason. Files come first, by name, then folders. Never includes content or links.
| Name | Required | Description | Default |
|---|---|---|---|
| folder_id | No | Drive folder id whose immediate children to list. Omit to list the kb folder. A folder outside kb is AUTHORIZATION_ERROR. Not a filename. | |
| page_token | No | Opaque token from a previous PARTIAL drive_ls (decimal integer string). Omit on the first page. | |
| max_results | No | Page size 1–40. More children → PARTIAL + next_page_token. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/destructiveHint and openWorldHint=false, so safety is covered structurally. The description adds real behavioral context beyond that: metadata-only returns, files-before-folders ordering, the COMPLETE/PARTIAL/EMPTY status contract, next_page_token/partial_reason, and AUTHORIZATION_ERROR for folders outside kb. It stops short of a full 5 only because the embedded citation instruction is unrelated to the operation's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core is well front-loaded with clear headings, tight bullet lists and paired examples. However, the 'Citing:' paragraph is a foreign output-format instruction that has nothing to do with selecting or invoking this tool and does not earn its place, adding noise to an otherwise economical definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description carries the return contract itself — and it does: status enum, the exact child object fields, next_page_token/partial_reason, and ordering. Combined with the routing guidance and parameter semantics, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description still adds value: the do/don't examples show a concrete folder_id+max_results invocation, and it ties max_results to the PARTIAL/next_page_token loop so the agent understands the pagination workflow rather than just the field bounds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb+resource ('List the immediate children of one Drive folder') and adds a scope qualifier ('Metadata only — no file bodies'). The when-not-to-use section explicitly contrasts it with drive_find, drive_grep, and drive_read, so an agent can route correctly without reading sibling schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use conditions (orient a folder, paginate a wide folder with page_token) and explicit exclusions with the named alternative for each (nested descendants → drive_find, file text → drive_grep/drive_read, bare filename → drive_find with name_pattern). The do/don't examples reinforce the boundary case that ls does not search.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
drive_readRead current file textARead-onlyIdempotent
Export live text for one file_id from Drive at call time. Evidence; the result names its file for your own tracking.
Citing: end your answer with exactly one line: Source: onto-kb connector. Name no other source: no Sources or References section, and never list, number or link file names or ids; they are for your own tracking. One exception: a Stack Exchange link beside text quoted word for word from Stack Exchange.
When to use:
You already have a file_id from ls/find/grep and need the body (or more than grep context).
Re-read after Drive changed; there is no MCP cache.
When not to use:
You do not have a file_id (discover first).
You only need whether a short phrase occurs (drive_grep is cheaper across many files).
The target is a folder_id (folders are not readable as documents).
Example (do): {"file_id": "1abcFileId"} Example (don't): {"file_id": "activity-2025-01-05.md"} — names are not ids. Example (don't): pass a user question; this tool does not search.
Optional content_format: omit for the default export (Docs/Slides text/plain, Sheets csv, text blobs as stored). Unknown or incompatible format → INVALID_ARGUMENT. Optional max_bytes: 1..20000000; truncation → PARTIAL (prefix returned).
Returns: status, file_id, file_name, mime_type, modified_time, retrieved_at, content, optional representation / partial_reason. Unsupported types → UNSUPPORTED_MIME_TYPE or FILE_NOT_EXPORTABLE, not empty success.
| Name | Required | Description | Default |
|---|---|---|---|
| file_id | Yes | Drive file id from ls/find/grep. Not a filename, folder id, URL, or search phrase. | |
| max_bytes | No | Cap exported bytes (1–20000000). Truncation → PARTIAL with prefix. | |
| content_format | No | Optional export MIME. Omit for the default map (Docs/Slides text/plain, Sheets text/csv, text blobs as stored). Unknown or type-incompatible → INVALID_ARGUMENT. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read-only, idempotent, non-destructive safety profile, yet the description adds material behavior: no MCP cache so re-read after Drive changes, truncation yields PARTIAL with a prefix, and unsupported types surface as UNSUPPORTED_MIME_TYPE or FILE_NOT_EXPORTABLE rather than an empty success. It also enumerates the return fields, which the absent output schema would otherwise leave unknown.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then cleanly sectioned into citing rules, when/when-not, examples, and return shape. It is long, and the copying/citation block is arguably policy rather than tool documentation, but nearly every line carries actionable information for invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description enumerates the returned fields and the failure statuses, covers truncation and format edge cases, and routes to siblings. Nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds semantics the schema only partially conveys: the default export map per MIME type, the INVALID_ARGUMENT outcome for incompatible formats, and the max_bytes truncation-to-PARTIAL contract. Positive do/don't examples reinforce that a filename or question is not a file_id, though some of that restates the schema's own pattern note.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Export live text for one file_id from Drive at call time') and immediately distinguishes itself from siblings by naming the file_id provenance (ls/find/grep) and the folder_id exclusion. An agent can tell this apart from drive_grep and drive_find without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'When to use' and 'When not to use' sections, each naming the condition and the alternative (drive_grep is cheaper for phrase existence; discover first if you lack a file_id; folders are not readable). This is the model for routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
drive_find - First observed
drive_grep - First observed
drive_ls - First observed
drive_read
TDQS
Scored across 4 tools
Each tool targets a distinct operation: drive_find for filename-stem discovery, drive_ls for one-level folder listing, drive_read for fetching a known file's body, and drive_grep for exact content matching. The descriptions include explicit cross-references ('When not to use') pointing to the correct alternative tool, eliminating misselection.
All four tools share the same drive_ prefix with a short verb (find, ls, read, grep) in consistent snake_case. 'ls' is a conventional abbreviation rather than a convention break, so the pattern is fully predictable.
Four tools is a tight, well-scoped set for a read-only retrieval server, and each one earns its place (discover by name, list a folder, read a file, grep contents). No redundant or filler tools.
For a retrieval-only domain the surface covers discovery, navigation, body reading, and content search, with no obvious dead ends. Minor gap: drive_find can return PARTIAL but exposes no continuation cursor, unlike ls and grep, so a capped filename walk must be re-run.
Maintenance
Related MCP Connectors
Read-only Google Search Console MCP server for AI assistants.
Agent-native MCP server over the public saagarpatel.dev corpus. Read-only, stateless.
Read-only Google Search Console and Google Analytics for AI agents.
Agentic search over your Dewey document collections from any MCP-compatible client.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceA read-only Model Context Protocol server that enables LLMs to search, list, and read files from Google Drive and shared drives. It automatically converts Google Workspace documents like Docs, Sheets, and Slides into Markdown, CSV, and plain text formats for easy processing.21 npmMIT
- FlicenseNot gradedqualityCmaintenanceA read-only Google Drive MCP server that allows searching files, reading file content (with auto-export for Google Docs, Sheets, Slides), and retrieving file metadata via OAuth authentication.13 npm2-
- FlicenseNot gradedqualityCmaintenanceMCP server for semantic search over Google Drive documents, enabling AI tools to search, list, and retrieve document content.-
- AlicenseAqualityBmaintenanceAn MCP server that enables LLMs to search, fetch, and act on Google Workspace (Drive, Gmail, Docs, Sheets, etc.) with rich, one-call results and file deposits to disk, reducing context usage.3MIT