Skip to main content
Glama
sldone
by sldone

gchat-mcp

npm CI License: MIT

An MCP server that lets Claude, Codex and other AI agents read, search and send your Google Chat messages.

It doesn't use the Google Chat API, so it needs no OAuth app and no Google Cloud project. Instead, it drives the Chat web app (chat.google.com) in a Chrome profile that you sign in to once. That means it works even when your Workspace admin blocks third-party OAuth apps. Your agent does the summarizing.

Requirements

  • Node.js 22 or later

  • Google Chrome

Related MCP server: login-mcp

Quick start

Claude Code

claude plugin marketplace add sldone/gchat-mcp
claude plugin install google-chat@gchat-mcp

Codex

codex plugin marketplace add sldone/gchat-mcp
codex plugin install google-chat@gchat-mcp

Other MCP clients

Add a stdio server that runs npx -y gchat-mcp. For example, in Claude Desktop's or Cursor's MCP config:

{
  "mcpServers": {
    "google-chat": { "command": "npx", "args": ["-y", "gchat-mcp"] }
  }
}

See docs/configuration.md for every client, setting and command.

Sign in

The first time your agent uses Google Chat, the server reports that you're not signed in. The agent then calls sign_in, which opens a Chrome window where you sign in to Google as usual, with SSO and 2FA. The window closes by itself once Chat loads. You can also sign in ahead of time:

npx gchat-mcp login

Tools

Tool

What it does

list_spaces

Lists your spaces, group chats and DMs, with the ids the other tools take

read_messages(space, limit = 50)

Reads the latest top-level messages of a conversation, oldest first. Scrolls back through history for larger limits

read_thread(space, thread)

Reads every message in a thread

search(query)

Searches all your conversations like the "Search chat" box and returns the top ~20 matches

send_message(space, text, thread?)

Posts as you, as a new message or as a reply in a thread

sign_in

Opens a Chrome window to sign in and waits up to 5 minutes

sign_out

Deletes the Google session stored on this computer

Messages come back as JSON with space, thread, id, author (You for you), time (local) and text. The server also sends your agent instructions on how the tools fit together, and tells it to confirm with you before sending anything.

Example prompts:

  • "Summarize what happened in the Engineering space today."

  • "Find the merge requests people asked me to review this week."

  • "Reply in that thread that I'll look at it after lunch." The agent shows you the text before sending.

Security and privacy

  • Your session stays on your computer. It's stored only in the Chrome profile at ~/.gchat-mcp/profile, which is readable only by your user. Chrome encrypts the cookies with your OS keychain. The server never reads, copies, logs or sends them anywhere.

  • Message content goes to your AI agent. Whatever the tools read is passed to your MCP client, and from there to its model provider.

  • send_message posts as you. Keep your client's approval prompt on for it.

  • sign_out deletes the local session. Run it, or npx gchat-mcp logout, when you're done.

Details, the threat model, and how to report a vulnerability are in SECURITY.md.

Automating around an admin restriction may conflict with your organization's acceptable-use policy. Check before you rely on this.

Limitations

  • It depends on the Chat web UI. When Google changes the page, reads can come back empty or sending can time out until the selectors in src/server.ts are updated.

  • search returns only the first page of results (about 20).

  • Unread status isn't reported.

  • Very long threads return only the part Chat renders first.

  • Tool calls run one at a time, because they share one browser tab.

Contributing

See CONTRIBUTING.md. Changes are listed in CHANGELOG.md.

License

MIT

Available Tools

7 tools
list_spacesList Google Chat conversationsA
Read-only

List every space, group chat and direct message in the Google Chat sidebar as { id, name }. Ids look like "space/AAAAbCdEfGh" or "dm/aBcDeFgAAAE" and are what the other tools take.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, openWorldHint), and the description adds value beyond them: it enumerates the entity types returned (spaces, group chats, DMs) and gives the concrete id formats. It does not mention any auth prerequisite (the sibling sign_in suggests one) or pagination behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the scope and returned shape front-loaded before the id-format detail. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description doing the work of describing the { id, name } return shape is important and it delivers. The only gap is the unstated dependency on being signed in, which matters for a first-call, id-producing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so there is nothing for the description to disambiguate and the baseline applies. The id-format note is arguably more relevant to downstream calls than to this tool's own inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List every space, group chat and direct message') and discloses the exact scope (Google Chat sidebar), which cleanly separates it from read_messages, read_thread and search. It also pins down the return shape as { id, name }.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Ids ... are what the other tools take' tells the agent this is the entry point for the id-driven siblings, which is real usage context. It stops short of an explicit rule such as 'use this when you don't already have an id; use search to find a space by name', so there is no stated exclusion against search.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_messagesRead Google Chat messagesA
Read-only

Read the most recent top-level messages of a space or DM, oldest first. Each message has space, thread and id, author ("You" for the user), time (local, "YYYY-MM-DD HH:MM:SS") and text. Messages that start a thread also have replies (e.g. "3 replies, Last Reply 9:09 AM"); read those with read_thread. Larger limits scroll back through history and take longer.

NameRequiredDescriptionDefault
limitNoHow many of the latest messages to return
spaceYesConversation id from list_spaces or search, e.g. "space/AAAAbCdEfGh" or "dm/aBcDeFgAAAE"

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered. The description adds real value beyond that: field-by-field return shape, ordering, the 'You' author convention, and a latency warning tied to limit size. That is a solid contribution on top of annotations, though it does not discuss pagination mechanics or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each carrying distinct information: scope and ordering, return fields, thread pointers, and the limit/latency trade-off. Scope is front-loaded and no sentence is redundant with the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description compensates by enumerating the returned fields and their formats, including the replies summary string. For a two-parameter read tool, nothing an agent needs in order to call it or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are documented inline, so baseline 3 applies. The description adds context the schema lacks — that a larger limit pages further back and takes longer — but gives no guidance on the default of 50 vs. the 500 maximum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (read top-level messages of a space or DM) plus scope qualifiers (most recent, oldest first, top-level only). It explicitly separates itself from read_thread for threaded replies, so an agent can choose without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative explicitly — '"3 replies..."; read those with read_thread' — and gives the cost trade-off for raising the limit ('scroll back through history and take longer'). The top-level-only scope plus the named sibling covers both when-to-use and when to go elsewhere.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_threadRead a Google Chat threadA
Read-only

Read every message in one thread, starting with the message that opened it. Each message has space, thread and id, author ("You" for the user), time (local, "YYYY-MM-DD HH:MM:SS") and text.

NameRequiredDescriptionDefault
spaceYesConversation id the thread belongs to
threadYesThe "thread" field of a message from read_messages or search

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds real value beyond that by describing the result shape: ordering starts with the thread-opening message, and each message carries space, thread, id, author (with 'You' substituted for the caller), time, and text. It does not mention pagination or message-count limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action, then the return fields. Nothing is redundant, though the field list is dense and slightly run-on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully documents the returned fields and the 'You' author convention. Combined with the fully covered two-parameter schema and permissive read-only annotations, this is largely complete for a small read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both 'space' and 'thread' are already documented, including that thread comes from read_messages or search. The description adds no parameter detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Read every message in one thread'), making the scope unambiguous. It does not explicitly distinguish itself from the sibling read_messages, which an agent could confuse with a per-thread read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit statement of when to choose this tool over read_messages or search, nor any prerequisites. Usage is only implied by the phrase 'in one thread,' leaving the agent to infer the selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_messageSend a Google Chat messageA

Send a message as the user, either as a new message in a space or DM or as a reply in a thread. It is posted immediately and other people see it, so confirm the text and conversation with the user first.

NameRequiredDescriptionDefault
textYesMessage text. Line breaks are kept.
spaceYesConversation id from list_spaces or search
threadNoThread id to reply in. Omit to post a new top-level message.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes beyond the annotations by disclosing the two consequences that matter for a write: immediacy and visibility to other people. That is real value on top of readOnlyHint=false and openWorldHint=true. It omits anything about repeated sends creating duplicates (idempotentHint=false already covers that) and does not mention the sending identity's auth requirements beyond 'as the user'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no padding. The capability statement comes first and the risk/confirmation guidance second, which is the correct order for a write tool the agent may call mid-conversation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter mutation with full schema coverage, rich annotations, and no output schema, this covers what an agent needs: what it does, that it is irreversible in the social sense, and that confirmation is required. Missing only minor detail such as whether the response returns the created message id.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so space, text, and thread are all documented at the field level, including that thread should be omitted for a top-level message. The description reinforces the space-versus-thread choice but adds no format, length, or mention semantics beyond the schema. Baseline 3 applies when the schema carries the parameter burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (send a message) plus the two mutually exclusive modes: new top-level message in a space/DM, or a reply in a thread. All siblings are read/lookup tools, so the write tool is unambiguously distinguishable from list_spaces, read_messages, read_thread, and search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear precondition and operating context: it posts immediately, others will see it, and the agent should confirm text and conversation with the user first. It does not explicitly say when to prefer this over a sibling, but no sibling sends messages, so no disambiguation is needed. The confirm-first instruction is the key usage guidance and it is stated plainly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_inSign in to Google ChatA
Idempotent

Open a visible Chrome window where the user signs in to their Google account. Call it when another tool reports that the user is not signed in. Waits up to 5 minutes and returns once Google Chat has loaded.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnly=false, destructive=false, openWorld=true and idempotent=true, so safety is covered. The description adds genuinely new behavior: the call blocks for up to 5 minutes, requires human interaction in a visible browser, and returns only after Google Chat has loaded — all things an agent cannot infer from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with zero filler. The mechanism comes first, the trigger condition second, and the blocking/return behavior last — a sensible front-loaded order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema and safety covered by annotations, this is nearly sufficient. The one gap is failure semantics: it does not say what happens if the 5 minutes elapse without a successful sign-in.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there is nothing for the description to disambiguate. Baseline 4 applies; no parameter semantics are missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and mechanism: opens a visible Chrome window where the user signs in to their Google account, ending in Google Chat loading. It is clearly distinguishable in practice, but never names sign_out as the inverse operation, leaving that differentiation to the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit, non-obvious trigger: call it when another tool reports the user is not signed in. This is exactly the reactive condition an agent needs, and it implicitly excludes calling it when authentication is already established.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_outSign out of Google ChatA
DestructiveIdempotent

Delete the Google session stored on this computer (the server's Chrome profile). Nothing on this computer can act as the user until sign_in is called again. To also end the session on Google's side, the user can remove it in their Google Account's security settings.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as destructive and idempotent, and the description adds meaningful context about exactly what is deleted: the local Chrome profile session. It also discloses the practical consequence that nothing on the computer can act as the user until sign_in is called again, and clarifies that the Google-side session is not necessarily ended.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loads the core action and scope, and every sentence adds useful information. There is no repetition or wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, annotation-covered sign-out tool, the description gives enough context to act correctly. It explains the local scope, the restoration path through sign_in, and the separate remote-session caveat without needing an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter semantics for the description to explain. The baseline for a zero-parameter tool is 4, and the description does not need to compensate for missing schema details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: deleting the Google session stored on this computer in the server's Chrome profile. It also distinguishes the local sign-out from ending the session on Google's side, so the agent can tell what this tool does and does not cover.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly frames the tool as local sign-out and names sign_in as the way to restore the ability to act as the user. It also directs the user to Google Account security settings for remote session termination, which is an explicit alternative for a related but different need.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.1
    • First observedlist_spaces
    • First observedread_messages
    • First observedread_thread
    • First observedsearch
    • First observedsend_message
    • First observedsign_in
    • First observedsign_out

TDQS

A4.2/5.0

Scored across 7 tools

Disambiguation4/5

The tools map to clearly different operations: listing spaces, reading recent messages, reading a thread, global search, sending, and auth. The only potential confusion is between read_messages and search, since both return message objects, but the descriptions make the scope difference (one space vs. all spaces, recency vs. keyword) explicit.

Naming Consistency4/5

Six of seven tools follow a clean verb_noun snake_case pattern (list_spaces, read_messages, read_thread, send_message, sign_in, sign_out). The lone outlier is the bare verb 'search', which is still unambiguous but breaks the pattern.

Tool Count5/5

Seven tools is a tight, well-scoped surface for a chat client: read paths, one write path, and two auth helpers. Every tool earns its place with no filler.

Completeness4/5

The core loop (list spaces, read messages/threads, search, send) plus session management is covered, so agents can complete typical tasks. Gaps exist around write lifecycle: no edit or delete message, no reaction support, and no way to create/manage spaces.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables token-efficient browser automation for AI chats like ChatGPT, Gemini, and Claude, allowing reading responses, sending messages, waiting for streaming replies, and bridging conversations between tabs via Chrome DevTools Protocol.
    5
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables agents to reuse a human-completed Chrome login session to open confirmed origins, read visible page text, and perform single click, fill, or key press actions without ever handling passwords or exposing cookies.
    6
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Lets local AI agents drive the Chrome browser a user already has open, including signed-in sessions, by listing tabs, reading page text and actionable elements, then clicking, filling, selecting, scrolling, navigating, and capturing viewport screenshots without exporting cookies. Runs as a dependency-free local stdio process over Native Messaging, with per-tab leases, automatic reconnection, and pause/write-action controls.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI assistants to drive the user's real, already-logged-in Chrome browser locally, so they can read and navigate pages, click, type, fill forms, take screenshots, and inspect cookies, tabs, console, and network traffic without headless browsers or remote-debugging ports.
    1 npm
    ISC