google-mcp

Multi-account Google MCP server exposing Gmail and Calendar read tools over stdio.

Security notes

• credentials.json is local-only and must never be committed.

• Copy credentials.template.json to credentials.json and fill it with your local OAuth client values.

• Refresh tokens are stored in your OS keychain (keyring), not in source control.

Setup

1. Install dependencies:

   • uv sync

2. Create local OAuth client config:

   • cp credentials.template.json credentials.json

3. Set expected account emails (optional but recommended for auth safety checks):

   • export GOOGLE_MCP_PERSONAL_EMAIL="you@example.com"

   • export GOOGLE_MCP_WORK_EMAIL="you@company.com"

4. Optionally set a specific work calendar filter:

   • export GOOGLE_MCP_WORK_CALENDAR="calendar-id-or-summary"

5. Authorize each account:

   • uv run auth_setup.py personal

   • uv run auth_setup.py work

Run server

• uv run server.py

Integration tests

These hit real Google APIs.

• Basic live tests:

  • RUN_LIVE_TESTS=1 uv run integration_smoke.py

• Include destructive keychain mutation test:

  • RUN_LIVE_TESTS=1 RUN_DESTRUCTIVE_TESTS=1 uv run integration_smoke.py

Publish safety checks

• Run local security guardrail:

  • python scripts/security_check.py

• Optional pre-commit integration:

  • uv tool install pre-commit

  • pre-commit install

  • pre-commit run --all-files

• CI runs the same script on every push/PR via .github/workflows/security-check.yml.