Google Drive

google-drive-mcp

Google Drive as MCP tools. Find, organize, share and move files, and follow what changed. One Go binary that speaks Model Context Protocol over stdio, signed in as you, with your own OAuth client and the refresh token in your OS keyring.

It is for a person with a Google account who wants an assistant to work with the files they can already reach in Drive, as them. It works at the file boundary: where a file sits, who can see it, folders, moves and copies, content in and out, sharing, shared drives, revisions, comments and what changed. What is inside a Doc, Sheet or Slides deck belongs to servers built on those APIs.

Goals and non-goals

Goals:

• Access never widens by accident. Google's sharing policy decides what may be shared. share_file grants named people and groups inside your organization, and every wider share is a tool of its own, off by default. A move or a copy never reaches past the organization. Every share shows who could see the item before and after, and sends no mail unless asked.
• Nothing is destroyed without a way back unless you turn it on. Trash and restore are the default. The permanent deletes are not registered by default, and each needs confirm: true.
• The model never guesses which file. Ids are the contract: a name or path matching more than one item comes back as [ambiguous] with every candidate, and every result says which folder and drive a file sits in.
• Shared drives work from the first call. Every request reaches them, and an incomplete search says so instead of quietly returning less.
• Results say what Drive answered, never what the request asked for. Where Drive's reads lag its own writes, the result says so.
• Files move through one directory. Downloads land in GDRIVE_LOCAL_DIR and uploads are read from it; unset, there is no file transfer. Transfers stream in chunks and are checked against Drive's md5.
• Act as you, and log nothing about your files. Every call runs as the signed-in account, only to Google's hosts, with no telemetry. Logs never carry file names, paths, addresses, queries or content.

Non-goals:

• What is inside a Doc, Sheet or Slides deck. It reads them through Google's export and says so. A comment made here sits on the file rather than on a place in it.
• Sync or push. Watch channels need a public HTTPS endpoint; list_changes reads the changes feed with a token instead.
• Domain administration. It acts as the signed-in person and sees what they see.
• Publishing a revision to the web, which is exposure with no control over who sees it.
• Client-side encryption, Apps Script, the Drive UI integration and the app data folder.
• A hosted service. It speaks stdio only.
• Asking you before a call. Your client approves each call; the server asks nothing.

Tools

Drive has no substring search. In search_files, each word of name has to begin some word of the file's name, in any order, so "Bud" finds "Budget 2026" and "udget" finds nothing. Search text by whole words.

These are registered only when the deployer turns their feature on, because each needs another Google API and a scope login would otherwise not ask for: list_labels and manage_labels with GDRIVE_LABELS=true, and list_activity with GDRIVE_ACTIVITY=true.

More are registered only with GDRIVE_ENABLE_DESTRUCTIVE=true, and each of those also needs confirm: true on the call itself. These remove something for good: delete_file, empty_trash, delete_drive, delete_revision and delete_comment. These reach past your organization: share_by_link opens a file to anyone with the link or a whole domain, share_outside_organization grants someone outside it, transfer_ownership hands a file to a new owner, and lift_drive_restriction lets a shared drive's content be shared outside the organization. The tools that reach past it also take the name of what they open up, file_name or drive_name, so the call your client shows you for approval says which file or drive it is; a name that is not the item's is refused.

Some reads are also resources, for a client that attaches them rather than calling a tool: gdrive:// is the file's text, gdrive:// /meta is the description, and gdrive:// /children is a folder's first page. A reference with a slash in it, such as a path or a URL, has to be percent-encoded there, so pass an id.

The live driver runs every tool against a real Google Workspace account as well as the in-memory Drive the tests use, the permanent deletes included, inside a shared drive it creates and deletes. The paths that need a second account or an administrator have not run live: handing over ownership, opening a link-shared file that needs its resource key, a share an organization's policy refuses, and applying a label. Each is tested against the in-memory Drive, and the driver has a mode for each but the resource key: -transfer, -blocked and -labels.

Install

go install github.com/mmedum/google-drive-mcp/v3/cmd/google-drive-mcp@latest

That puts the binary in Go's bin directory, which is often not on your PATH. If the next command says command not found, either use the full path or add the directory once:

"$(go env GOPATH)/bin/google-drive-mcp" --version    # check it landed

export PATH="$(go env GOPATH)/bin:$PATH" # or add it to your shell profile

Or take a signed archive from the latest release — Linux, macOS and Windows, on amd64 and arm64 — and put the binary on your PATH. Every archive carries the binary, LICENSE and this README. Nothing about a release has to be taken on trust:

# --ignore-missing, because checksums.txt covers every archive and you

will have downloaded one of them.

sha256sum -c checksums.txt --ignore-missing

checksums.txt is signed with a keyless Sigstore certificate tied to the

release workflow's identity; the bundle carries the signature and the

certificate together.

cosign verify-blob checksums.txt --bundle checksums.txt.bundle \ --certificate-identity-regexp '^https://github.com/mmedum/google-drive-mcp' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com

And each archive carries build provenance naming the workflow and tag

that produced it.

gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

Every archive also ships an SBOM, so you can see what is inside a binary you did not build.

Claude Desktop

Every release also carries a .mcpb bundle. Open it and Claude Desktop installs the server and asks for the settings a client's configuration would carry: your OAuth client JSON, the profile, read-only, the destructive switch, the sharing tools, the download and upload folder, the largest download, Workspace labels and activity — no config file to edit. Deleting for good and sharing past your organization (enable_destructive), labels (labels) and activity (activity) stay off unless you turn them on, and read-only leaves the destructive switch with nothing to register. This serve