Comprehensive, highly performant Google Workspace Streamable HTTP & SSE MCP Server with complete coverage for Calendar, Gmail, Docs, Sheets, Slides, Chat & Drive!
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
process.env. You'll be asked to provide them before it can run.WORKSPACE_MCP_CREDENTIALS_DIR— Directory for the local_directory backendGOOGLE_MCP_CREDENTIALS_DIR— Credential directory — default ~/.google_workspace_mcp/credentialsWORKSPACE_MCP_GCS_BUCKET— Required when backend is gcs — GCS bucket nameWORKSPACE_MCP_GCS_PREFIX— Optional object-name prefix for the gcs backendWORKSPACE_MCP_GCS_REQUIRE_CMEK— true to require a bucket default KMS key at startup (fails fast if unset)WORKSPACE_MCP_CREDENTIAL_STORE_BACKEND— local_directory (default) or gcs — see [credential store system](#credential-store-system)MCP_ENABLE_OAUTH21— export =trueSESSION_TIMEGOOGLE_CLIENT_SECRET_PATH— Custom path to client_secret.jsonGOOGLE_OAUTH_CLIENT_ID— export ="..."GOOGLE_OAUTH_CLIENT_SECRET— export ="..."GOOGLE_OAUTH_REDIRECT_URI— export ="http://localhost:${WORKSPACE_MCP_PORT}/oauth2callback"OAUTHLIB_INSECURE_TRANSPORT— required* Set to 1 for development — allows http:// redirectOAUTHLIB_RELAX_TOKEN_SCOPEMCP_SINGLE_USER_MODEWORKSPACE_MCP_BASE_URI— Base server URI (no port) — default http://localhostWORKSPACE_MCP_RESOLVED_PORTWORKSPACE_MCP_PORT— export =8000PORT— WORKSPACE_MCP_PORT Listening port — default 8000. Also controls the stdio-mode OAuth callback port. The env var takes precedence if set.WORKSPACE_EXTERNAL_URL— External URL for reverse proxy setupsWORKSPACE_MCP_BRAND_NAME— OAuth 2.1 consent-page server name — default FastMCP's nameWORKSPACE_MCP_BRAND_ICON_URL— OAuth 2.1 consent-page logo (hosted URL or data: URI), shown at 64px wide — default FastMCP's logoWORKSPACE_MCP_BRAND_WEBSITE_URL— OAuth 2.1 consent-page website linkEXTERNAL_OAUTH21_PROVIDER— true for external OAuth flow with bearer tokensWORKSPACE_MCP_STATELESS_MODE— true for stateless container-friendly operationGOOGLE_SERVICE_ACCOUNT_KEY_FILE— Path to service account JSON key file (domain-wide delegation)GOOGLE_SERVICE_ACCOUNT_KEY_JSON— Inline service account JSON key (alternative to file)DWD_ALLOWED_DOMAINS— Comma-separated domain allowlist for per-request impersonation (optional)OAUTH_CUSTOM_REDIRECT_URIS— Comma-separated additional redirect URIsOAUTH_ALLOWED_ORIGINS— Comma-separated additional CORS originsWORKSPACE_MCP_HOST— Bind host — default 0.0.0.0 for OAuth 2.1 HTTP, 127.0.0.1 for legacy streamable HTTP.WORKSPACE_ATTACHMENT_DIR— Downloaded attachments dir and default trusted local attachment directory — default ~/.workspace-mcp/attachments/WORKSPACE_MCP_URL— Remote MCP endpoint URL for CLIWORKSPACE_MCP_COMMENTS_MAXWORKSPACE_MCP_LOG_DIR— Directory for mcp_server_debug.log — defaults to ~/.google_workspace_mcp/logsFASTMCP_SERVER_AUTH_GOOGLE_JWT_SIGNING_KEY— export ="$(openssl rand -hex 32)"WORKSPACE_MCP_OAUTH_PROXY_STORAGE_BACKEND— memory, disk, or valkey — see [storage backends](#oauth-proxy-storage-backends)WORKSPACE_MCP_OAUTH_PROXY_VALKEY_HOST— export =redis.example.comFASTMCP_HOMEWORKSPACE_MCP_ALLOWED_CLIENT_REDIRECT_URIS— Comma-separated allowlist of redirect URIs that dynamically-registered OAuth clients may use. Default is unset (any URI permitted, per DCR). Supports FastMCP's glob patterns (, .example.com)GOOGLE_PSE_API_KEY— API key for Programmable Search EngineGOOGLE_PSE_ENGINE_ID— Search Engine ID for PSEWORKSPACE_MCP_TOOLS— Comma-separated services, e.g. gmail,drive,calendar; empty means all servicesWORKSPACE_MCP_TOOL_TIER— core, extended, or complete; empty means all toolsWORKSPACE_MCP_READ_ONLY— true, 1, or yes to request read-only scopes and filter write toolsWORKSPACE_MCP_PERMISSIONS— Space-separated service:level entries, e.g. gmail:send drive:readonly; mutually exclusive with tools and read-onlyWORKSPACE_MCP_TRANSPORT— stdio or streamable-http; used when --transport is not passedWORKSPACE_MCP_HTTP_PORT— Advanced legacy-stdio sidecar /mcp port for local workspace-cli access. Disabled when empty. Binds to 127.0.0.1 only and is accessible to local processes.[](https://m8ven.ai/mcp/taylorwilsdon-google-workspace-mcp-1aizji)