Google Workspace
NPM · @FOREVERWORKS/MCP-GOOGLE
Search and work in Gmail, Calendar, Drive, Docs, Sheets and Slides across several Google accounts.
Available components
Last scanned (9 hours ago)
Scores higher than 69% of npm servers
Category Productivity and Notes
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 7 of 37 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to foreverworks/mcps). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability57
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 23539 tokens (~204/item across 115 items; 115 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management33
- Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 80% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_comment" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 116 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +27
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.90 ▲ functional
- 2 Nov 26 −26
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Dependency health: 0.90 → unverified ▼ functional
- Package version: 0.1.1 → 0.2.0 functional
- 1 Nov 26 +16
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.1.0 → 0.1.1 functional
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 76
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@foreverworks/mcp-google@0.2.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | foreverworks/mcps |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/foreverworks/mcps/.github/workflows/release.yml@refs/tags/release-2026-11-02 |
| Rekor log index | 3637777511 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:2cd3193a14cea63327ab20ce0c0d30c37f37e0906b2d6baa4d5f775ca9ff8bb728470aa0cfbf763e374f3473f2de81aaab0a8f57d3e61a3cba0417ffc |
Background: How many MCP packages publish verified provenance →
Dependencies 37 packages
| Packages resolved | 37 |
|---|---|
| Stale | 7 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
trash Trash ~117
Move threads or messages to Trash, where Gmail keeps them 30 days. There is no permanent delete here. Returns the ids trashed, and any that failed under `failed`.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which mailbox this writes to or sends from: a label from list_accounts. Required; there is no default for writes. |
| ids | array | yes | Thread or message ids, per `target`, from this account. |
| target | string | – | Act on whole threads (default, what Gmail's own buttons do) or on single messages. |
No output schema declared.
No examples provided.
trash_file Move to trash ~78
Send a file to Drive's trash, where it stays recoverable for 30 days. There is deliberately no permanent-delete tool here: the one operation that cannot be undone is the one this server does not expose.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | – | Drive file id. Takes precedence over path. |
| path | string | – | Path under My Drive. |
No output schema declared.
No examples provided.
unmark_spam Not spam ~98
Take threads or messages out of SPAM and back into the inbox.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which mailbox this writes to or sends from: a label from list_accounts. Required; there is no default for writes. |
| ids | array | yes | Thread or message ids, per `target`, from this account. |
| target | string | – | Act on whole threads (default, what Gmail's own buttons do) or on single messages. |
No output schema declared.
No examples provided.
untrash Untrash ~104
Bring threads or messages back out of Trash. Returns the ids restored, and any that failed under `failed`.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which mailbox this writes to or sends from: a label from list_accounts. Required; there is no default for writes. |
| ids | array | yes | Thread or message ids, per `target`, from this account. |
| target | string | – | Act on whole threads (default, what Gmail's own buttons do) or on single messages. |
No output schema declared.
No examples provided.
untrash_file Restore from trash ~61
Take a file back out of the trash. Find it by id; a trashed file no longer answers to its path.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | – | Drive file id. Takes precedence over path. |
| path | string | – | Path under My Drive. |
No output schema declared.
No examples provided.
update_draft Update draft ~390
Change an existing draft. Only the fields you pass change; everything else, including a reply draft's threading, is kept. Passing either body replaces both bodies. Attachments are kept unless you pass a list, and an empty list removes them.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which mailbox this writes to or sends from: a label from list_accounts. Required; there is no default for writes. |
| attachments | array | – | Files to attach. Never type or paste a file's base64 yourself: a retyped file can arrive changed. Give the path of a file in your workspace folders (the roots this client shares; without them /workdi… |
| bcc | array | – | Bcc recipients (kept on a draft, stripped from what recipients see). Each entry is an address, "Name <address>", or a comma-separated list of those. |
| body_html | string | – | HTML body. Given alone, a plain-text alternative is generated from it; give both to control each. |
| body_text | string | – | Plain-text body: write paragraphs as single lines, never hard-wrapped. Given alone, an HTML alternative with the same lines is generated, so Gmail renders it as ordinary prose. |
| cc | array | – | Cc recipients. Each entry is an address, "Name <address>", or a comma-separated list of those. |
| draft_id | string | yes | – |
| from | string | – | Send as this address. It must be one of the account's verified send-as aliases; defaults to the account's default. |
| subject | string | – | – |
| to | array | – | Recipients. Each entry is an address, "Name <address>", or a comma-separated list of those. |
No output schema declared.
No examples provided.
update_event Update event ~719
Change an event. Only the fields given change; a new start with no end keeps the event's length. On a recurring event, the eventId decides the reach: an instance id from agenda changes that one occurrence, and a series id (every occurrence) is refused unless scope is "series". attendees replaces the guest list, and the result says who that added and removed. Guests are NOT emailed unless send_updates says so. meet: true adds a Meet link to an event without one. An event's type cannot change; a focus time or out of office event takes new auto_decline, decline_message and chat_status.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes to: a label from list_accounts. Required; writes have no default. |
| attendees | array | – | Guest email addresses. On an update this REPLACES the guest list; the result lists who that added and removed. |
| auto_decline | string | – | Focus time and out of office only: which invitations Calendar declines while it lasts. "none" (the default), "new" (only those that arrive meanwhile) or "all" (every conflicting one, accepted ones to… |
| busy | boolean | – | Whether it blocks time ("show as busy"). Default true. |
| calendar_id | string | – | Calendar id, from list_calendars or from an agenda event's calendarId. "primary" is the account's own. |
| chat_status | string | – | Focus time only: the status Google Chat shows meanwhile. |
| decline_message | string | – | Focus time and out of office only: the note a decline carries. |
| description | string | – | – |
| duration_minutes | integer | – | Length when end is omitted. Default: an hour for a new event; on an update, the length it already had. |
| end | string | – | Same forms as start, and the same kind. All-day ends are EXCLUSIVE: a one-day event on the 29th ends on the 30th. Omit to use duration_minutes. |
| event_id | string | yes | The eventId from agenda. |
| location | string | – | – |
| meet | boolean | – | true: Google makes a new Meet call for the event, and the result carries its link (meetingUrl). On an update, adds one to an event that has none. |
| recurrence | array | – | Repeat rule as RFC 5545 lines: ["RRULE:FREQ=YEARLY"] for a birthday, ["RRULE:FREQ=WEEKLY;BYDAY=MO,WE,FR"] for a gym slot. On an update of a series this REPLACES the rule; [] stops it repeating. |
| reminders_minutes | array | – | Popup reminders, in minutes before the start, replacing the calendar's defaults. [] means none. |
| scope | string | – | "one" (the default): the event or the one occurrence the eventId names. "series": required when the eventId is a whole recurring series, which this then changes in every occurrence. |
| send_updates | string | – | Who is emailed about this change: "none" (the default), "all" guests, or "externalOnly" (guests outside the domain). |
| start | string | – | YYYY-MM-DD for an all-day event, YYYY-MM-DDTHH:MM for a time in the server's zone (UTC), or RFC 3339 with an offset. |
| title | string | – | The event's title. |
No output schema declared.
No examples provided.
update_label Update label ~162
Rename or restyle a user label, given by id or name. System labels (INBOX, SENT, ...) are refused.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which mailbox this writes to or sends from: a label from list_accounts. Required; there is no default for writes. |
| background_color | string | – | Hex from Gmail's fixed palette, e.g. #16a766. Needs text_color too. |
| label | string | yes | Id or current name. |
| label_list_visibility | string | – | In the label list on the left. |
| message_list_visibility | string | – | On messages in the message list. |
| name | string | – | New name. |
| text_color | string | – | Hex from Gmail's fixed palette, e.g. #ffffff. |
No output schema declared.
No examples provided.
update_permission Change someone's access ~148
A permission's role or expiry (or its expiry removed). Making someone the owner needs transfer_ownership: true. It changes who can open the file: do it only on the user's explicit go for this file and these people.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes as: a label from list_accounts (its editors section). Required; writes have no default. |
| expiration_time | string | – | – |
| file_id | string | yes | The file's id, or its URL. |
| permission_id | string | yes | The permission's id, from list_permissions. |
| remove_expiration | boolean | – | – |
| role | string | – | – |
| transfer_ownership | boolean | – | – |
No output schema declared.
No examples provided.
update_revision Keep or publish a revision ~162
keep_forever stops Drive pruning a revision of a file with bytes. published puts a Doc, Sheet or deck revision on the web for anyone at its publishedLink (publish_auto follows later revisions, published_outside_domain lets people outside the domain read it): only on the user's explicit go.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes as: a label from list_accounts (its editors section). Required; writes have no default. |
| file_id | string | yes | The file's id, or its URL. |
| keep_forever | boolean | – | – |
| publish_auto | boolean | – | – |
| published | boolean | – | – |
| published_outside_domain | boolean | – | – |
| revision_id | string | yes | The revision's id, from list_revisions. |
No output schema declared.
No examples provided.
update_task Update task ~166
Change a task's title, notes or due date. Only the fields given change, and only when they differ: an empty notes or due clears it. To mark it done use complete_task; to move it, move_task.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes to: a label from list_accounts. Required; writes have no default. |
| due | string | – | YYYY-MM-DD, or "" to clear the due date. |
| notes | string | – | New notes; "" clears them. |
| task_id | string | yes | The taskId from list_tasks. |
| task_list | string | – | The list's taskListId from list_task_lists or list_tasks; "@default" (the default) is the account's default list. |
| title | string | – | – |
No output schema declared.
No examples provided.
update_values Write cell values ~181
Values or formulas into several A1 ranges in one call (values.batchUpdate). Returns the cells updated per range (and what they now show, with include_values). write_range is the one-range variant that returns what the cells held before.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes as: a label from list_accounts (its editors section). Required; writes have no default. |
| data | array | yes | – |
| include_values | boolean | – | Return the written cells as Sheets now renders them. |
| major_dimension | string | – | – |
| spreadsheet_id | string | yes | The spreadsheet's id, or its URL. |
| value_input | string | – | USER_ENTERED parses as if typed ("=SUM(A:A)" a formula, "2026-10-08" a date, "12.5" a number); RAW stores strings as text. |
No output schema declared.
No examples provided.
upload_file Upload a file to Drive ~575
Put a file on Drive byte for byte and prove it: after the upload, Drive's own checksum of what it stored (or the bytes read back, when Drive reports none) is compared with the source's. A difference fails the call and is taken back: a replacement's damaged revision is deleted, a new file is trashed. The file goes as path (a file in your workspace folders (the roots this client shares with the server; without them /workdir); a bare name is taken from the first) or as content_base64 with its sha256. Never type or paste a file's base64 yourself: a retyped file can arrive changed. Give the path of a file in your workspace folders (the roots this client shares; without them /workdir), or have a script that read the file send content_base64 with its sha256. The folder is folder_id, else folder_path, else the root. A name already in the folder is refused unless if_exists says what to do. A file given by path keeps its modification time on Drive. Returns the stored file with its link, size, sha256, md5 and verifiedBy. With convert, an Office file (.docx, .doc, .xlsx, .xls, .csv, .pptx, .ppt) becomes a Google Doc, Sheet or deck instead, named without its extension; a converted file keeps no bytes to compare, so the check is that Drive made the Google type, and the result gives the source's size and sha256 under `source`.
| Name | Type | Req | Description |
|---|---|---|---|
| content_base64 | string | – | The bytes as standard base64, only as a script that read the file wrote them, never typed. Needs sha256 and filename. |
| convert | boolean | – | Upload an Office file as the Google Doc, Sheet or deck it converts to. Default false: the bytes as they are. |
| filename | string | – | The name on Drive; defaults to the file's (the same key a Gmail attachment takes). |
| folder_id | string | – | The destination folder's id. Takes precedence over folder_path. |
| folder_path | string | – | The destination folder's path under My Drive; empty is the root. |
| if_exists | string | – | A file of that name already there: "fail" (default), "replace" (new revision, same id), or "keep_both". |
| mime_type | string | – | Defaults to a guess from the name. |
| path | string | – | The file as a file in your workspace folders (the roots this client shares with the server; without them /workdir); a bare name is taken from the first. Links are refused. |
| sha256 | string | – | Hex SHA-256 of the source file. Required with content_base64, checked with path. |
No output schema declared.
No examples provided.
upsert_rows Upsert rows by key ~212
Update the rows whose `key` column matches (only the columns given change), append the rest. One atomic batch. A key on two sheet rows is refused.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes as: a label from list_accounts (its editors section). Required; writes have no default. |
| header_row | integer | – | The row that names the columns (1-based). |
| key | string | yes | The header name of the column that identifies a row. |
| rows | array | yes | Objects keyed by the header row's names. Numbers and booleans are stored as such, "=..." as a formula, "YYYY-MM-DD" (or with THH:MM) as a date, any other string as text; null clears a cell. A key the… |
| sheet | string | – | The sheet (tab) name, from list_sheets. Empty means the first sheet. |
| spreadsheet_id | string | yes | The spreadsheet's id, or its URL. |
No output schema declared.
No examples provided.
write_range Write a range ~173
Values or formulas into an A1 range that names its sheet ("Invoices!A2:C4"), parsed as if typed (USER_ENTERED): "=SUM(B2:B9)" is a formula, "28/09/2026" a date in the sheet's locale. Returns `before`, what those cells held (formulas as formulas), so the write can be undone by writing it back.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | yes | Which account this writes as: a label from list_accounts (its editors section). Required; writes have no default. |
| range | string | yes | A1 range with its sheet, e.g. "Sheet1!A1:D20". |
| spreadsheet_id | string | yes | The spreadsheet's id, or its URL. |
| values | array | yes | Rows of cells, top to bottom. |
No output schema declared.
No examples provided.
How do I install the Google Workspace MCP server?
Google Workspace runs locally as an npm package, launched with npx -y @foreverworks/mcp-google. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @foreverworks/mcp-google
claude mcp add com-foreverworks-google -- npx -y @foreverworks/mcp-google
What is the Google Workspace MCP server?
Google Workspace is an MCP server listed in the public MCP registry as com.foreverworks/google. Search and work in Gmail, Calendar, Drive, Docs, Sheets and Slides across several Google accounts. This page covers its npm package (@foreverworks/mcp-google).
Is the Google Workspace MCP server safe to use?
Google Workspace scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Google Workspace MCP server expose?
Google Workspace exposes 115 tools: add_chart, add_comment, agenda, append_rows, append_to_document, and 110 more. Their descriptions and schemas cost roughly 23,242 tokens of context every time the server is loaded.
Is the Google Workspace MCP server still maintained?
Google Workspace is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Google Workspace MCP server under?
Google Workspace declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.