google-workspace-mcp

A set of five independent MCP servers over Google Workspace: Gmail, Google Calendar, Google Drive, Google Sheets, and Google Docs.

Status: pre-alpha. The project is under active development; public interfaces and configuration may change before the first stable release.

The servers are intentionally separated. A client or project includes only the service it needs and gets a token valid only for that service: a Gmail token does not open Drive. Shared across all of them are the repository, infrastructure libraries, the authorization framework, and the deployment procedure.

Services

Each service is a separate process, a separate MCP endpoint, a separate tool registry, a separate set of Google permissions, and a separate credential store.

Two layers of authorization

They are independent and do not mix.

Client → service. The MCP client goes through OAuth 2.1 with PKCE and dynamic registration. The issued token is bound to a single resource and is refreshed via a rotating refresh token with reuse detection.

Service → Google. The service calls Google product APIs on behalf of the owner using a long-lived refresh token and refreshes the access token itself. The Google token is never returned to the client under any circumstances.

The official Google MCP endpoints are in Developer Preview and are not used here: calls go to the stable product APIs.

Requirements

• Python 3.14, installed via uv; the system interpreter is not affected

• uv

• a Google Cloud project with the APIs of the five services enabled and an OAuth client

Installation

uv sync --dev

Checks

uv run --no-sync pytest -q
uv run --no-sync ruff check .
uv run --no-sync ruff format --check .
uv run --no-sync mypy src

The --no-sync flag is mandatory when checking dependency versions: without it, uv run re-syncs the environment from the lock file and returns the pinned version instead of the actual one, which would cause a knowingly broken package version to pass the check with a green run.

Origin

The project adapts the OAuth 2.1 core from jimprosser/obsidian-web-mcp under MIT; full information is in NOTICE.

The downstream OAuth 2.1 is based on revision 7e6a52d791a50e3bd533df1060217973ab5be1c8. After that revision, the core received its own fixes to the client and token lifecycle, refresh token rotation, reuse detection, and resource canonicalization.

The domain part of the original project — working with the Obsidian vault and syncing via Git — was not carried over.

Here, mcp>=2,<3 is used: the remote MCP 2.0 package mcp.server.fastmcp is not needed, and the composition is built on mcp.server.mcpserver.

License

MIT, see LICENSE.