Google Workspace MCP Server (salviz/google-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 40 out of 100, grade D. It declares 240 tools. No publisher has claimed this listing.

Warning

40/100

Google Workspace MCP Server

Item: Google Workspace MCP Server
Rating: 40
Author: M8ven

Provides 240 tools for managing Google Workspace services including Gmail, Drive, Calendar, Sheets, Docs, Slides, Contacts, and Tasks via natural language.

→ salviz/google-mcp-server · listed on glama

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

salviz

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: GOOGLE_CLIENT_SECRET, GOOGLE_TOKEN_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes240 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

calendar_list_events

List upcoming Google Calendar events

calendar_search_events

Search Google Calendar events by text query (searches summary, description, location, attendees)

calendar_create_event

Create a new Google Calendar event

calendar_update_event

Update an existing Google Calendar event

calendar_delete_event

Delete a Google Calendar event

calendar_list_calendars

List all Google Calendars accessible to the user

calendar_quick_add

Create a Google Calendar event from natural language text (e.g. "Meeting tomorrow at 3pm")

calendar_get_event

Get detailed information about a specific Google Calendar event

calendar_move_event

Move a Google Calendar event from one calendar to another

calendar_recurring_instances

List instances of a recurring Google Calendar event

calendar_freebusy

Check free/busy time for one or more Google Calendars

calendar_create_calendar

Create a new Google Calendar

calendar_update_calendar

Update a Google Calendar (name, description, time zone)

calendar_delete_calendar

Delete a Google Calendar (cannot delete primary)

calendar_clear

Clear all events from a Google Calendar (removes all events but keeps the calendar)

calendar_acl_list

List access control rules (ACL) for a Google Calendar

calendar_acl_get

Get a specific access control rule for a Google Calendar

calendar_acl_insert

Create a new access control rule for a Google Calendar

calendar_acl_update

Update an existing access control rule for a Google Calendar

calendar_acl_delete

Delete an access control rule from a Google Calendar

calendar_acl_watch

Watch for changes to ACL rules on a Google Calendar (push notifications)

calendar_list_get

Get a specific calendar entry from the user's calendar list

calendar_list_insert

Add an existing calendar to the user's calendar list

calendar_list_update

Update a calendar's settings in the user's calendar list (color, reminders, visibility)

calendar_list_delete

Remove a calendar from the user's calendar list

calendar_list_watch

Watch for changes to the user's calendar list (push notifications)

calendar_stop_channel

Stop receiving push notifications for a watch channel

calendar_get_colors

Get color definitions for Google Calendar (available colors for calendars and events)

calendar_import_event

Import an event into a Google Calendar (adds a private copy using iCalUID)

calendar_watch_events

Watch for changes to events on a Google Calendar (push notifications)

calendar_get_setting

Get a single Google Calendar user setting by name

calendar_list_settings

List all Google Calendar user settings

calendar_watch_settings

Watch for changes to Google Calendar user settings (push notifications)

calendar_get_calendar

Get metadata for a specific Google Calendar by ID

docs_create

Create a new Google Doc, optionally with initial content and in a specific folder

docs_read

Read a Google Doc and return its content as plain text

docs_insert_text

Insert text into a Google Doc at a specified position

docs_batch_update

Apply batch update requests to a Google Doc (formatting, tables, images, page breaks, etc.)

docs_insert_table

Insert a table into a Google Doc at a specified position

docs_insert_image

Insert an inline image into a Google Doc from a URL

docs_find_replace

Find and replace text in a Google Doc

drive_search

Search for files in Google Drive using a query string

drive_read

Read the content of a file from Google Drive. Exports Google Docs/Sheets/Slides as text/csv.

drive_list

List files in a specific Google Drive folder

drive_file_info

Get detailed metadata about a file in Google Drive

drive_create_folder

Create a new folder in Google Drive

drive_create_file

Create a new text file in Google Drive

drive_update_file

Update file metadata and/or content in Google Drive

drive_delete

Permanently delete a file from Google Drive

drive_trash

Move a file to trash in Google Drive

drive_untrash

Restore a file from trash in Google Drive

drive_copy

Copy a file in Google Drive

drive_move

Move a file to a different folder in Google Drive

drive_share

Share a file with someone in Google Drive

drive_list_permissions

List sharing permissions on a file in Google Drive

drive_remove_permission

Remove a sharing permission from a file in Google Drive

drive_about

Get Google Drive storage quota and user info

drive_upload_file

Upload a local file (binary or text) to Google Drive. Supports any file type.

drive_download_file

Download a file from Google Drive to a local path

drive_get_comments

List comments on a Google Drive file

drive_add_comment

Add a comment to a Google Drive file

drive_export_file

Export a Google Workspace file (Doc, Sheet, Slides) to a different format (PDF, DOCX, CSV, PPTX, etc.)

drive_get_revisions

List revisions of a Google Drive file

drive_empty_trash

Permanently delete all files in Google Drive trash

drive_get_changes_start_token

Get the starting pageToken for listing future changes in Google Drive

drive_list_changes

List changes to files in Google Drive since a given page token

drive_watch_changes

Subscribe to changes in Google Drive via push notifications

drive_stop_channel

Stop receiving push notifications for a channel

drive_get_comment

Get a specific comment on a Google Drive file by ID

drive_update_comment

Update the content of a comment on a Google Drive file

drive_delete_comment

Delete a comment from a Google Drive file

drive_list_replies

List replies to a comment on a Google Drive file

drive_get_reply

Get a specific reply to a comment on a Google Drive file

drive_create_reply

Create a reply to a comment on a Google Drive file

drive_update_reply

Update a reply to a comment on a Google Drive file

drive_delete_reply

Delete a reply to a comment on a Google Drive file

drive_create_shared_drive

Create a new shared drive in Google Drive

drive_get_shared_drive

Get metadata of a shared drive in Google Drive

drive_list_shared_drives

List shared drives the user has access to

drive_update_shared_drive

Update metadata of a shared drive (name, restrictions, etc.)

drive_delete_shared_drive

Delete a shared drive (must be empty)

drive_hide_shared_drive

Hide a shared drive from the default view

drive_unhide_shared_drive

Restore a shared drive to the default view

drive_get_permission

Get a specific permission on a Google Drive file by permission ID

drive_update_permission

Update a permission on a Google Drive file (change role)

drive_get_revision

Get metadata of a specific revision of a Google Drive file

drive_update_revision

Update metadata of a revision (published, publishAuto, publishedOutsideDomain, keepForever)

drive_delete_revision

Delete a revision of a Google Drive file (cannot delete the last remaining revision)

drive_generate_ids

Generate a set of file IDs that can be used in create or copy requests

drive_list_labels

List labels applied to a Google Drive file

drive_modify_labels

Modify (add, update, remove) labels on a Google Drive file

drive_watch_file

Subscribe to push notifications for changes to a specific Google Drive file

drive_list_access_proposals

List access proposals on a file (requests for access)

drive_get_access_proposal

Get a specific access proposal by ID

drive_resolve_access_proposal

Approve or deny an access proposal on a file

drive_list_apps

List the user's installed Google Drive apps

drive_get_app

Get a specific installed Drive app by ID

drive_get_operation

Get the status of a long-running operation

contacts_list

List Google Contacts or search by query

contacts_get

Get a specific Google Contact by resource name

140 further tools are not listed here. The complete surface is in the source.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configGOOGLE_CLIENT_IDOAuth 2.0 client ID

🔐 secretGOOGLE_CLIENT_SECRETOAuth 2.0 client secret

configGOOGLE_TOKEN_PATHPath to token JSON file (default: ~/.google-mcp/credentials.json)

🔐 secretGOOGLE_TOKEN_SECRETGoogle Secret Manager secret name for token fallback (default: google-mcp-oauth-tokens)

configREAUTH_PORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

240/240 tools missing one or more hints — calendar_list_events (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); calendar_search_events (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); calendar_create_event (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +237 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Shell command execution

2 calls in production code run through a shell (auth.js:23, auth.js:42)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Secrets never reach shell commands

2 secret values passed to shell commands — possible command injection

Never pass secrets through shell commands. Use library APIs that accept credentials as arguments.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/salviz/google-mcp-server?variant=verified)](https://m8ven.ai/mcp/salviz/google-mcp-server)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 56f414c76c349d12ddd4b2f775851c4b2fe930c4

code hash: 7f220841102e96aac77c020c8e8e2354c60e15b8de7ecc30c6a1522aad1de17f

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client