io.github.moooonad/mcp-google-sheets-full
NPM · MCP-GOOGLE-SHEETS-FULL
Full Google Sheets MCP: 26 tools + run_sheets_script escape hatch. User OAuth, no service account.
Available components
Last scanned (19 hours ago)
Scores higher than 43% of npm servers
Category Data and Analytics
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 40 of 118 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 165 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3182 tokens (~122/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage88
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 65% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_sheet" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 −5
- Stability: pass → 0.63 functional
- 30 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 29 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −3
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. security
- 21 Oct 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/mcp-google-sheets-full@0.2.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 118 packages
| Packages resolved | 118 |
|---|---|
| Deprecated | 1 |
| Stale | 39 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_sheet ~105
Add a new tab (sheet) to the spreadsheet. Returns the new sheetId.
| Name | Type | Req | Description |
|---|---|---|---|
| column_count | number | – | Optional initial column count. |
| index | number | – | Optional 0-based position. |
| row_count | number | – | Optional initial row count. |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| title | string | yes | Tab name. |
No output schema declared.
No examples provided.
append_values ~93
Append rows to the end of a table. The range is used as the search hint.
| Name | Type | Req | Description |
|---|---|---|---|
| insert_data_option | string | – | – |
| range | string | yes | – |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| value_input_option | string | – | – |
| values | array | yes | – |
No output schema declared.
No examples provided.
auth_status ~64
Report the current auth configuration. Two modes: 'oauth' (default, interactive user account) or 'service_account' (GOOGLE_APPLICATION_CREDENTIALS env set, headless). Returns mode, expected file paths, and which files are present. Use to debug setup problems.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
batch_get_values ~69
Read multiple A1 ranges in one call.
| Name | Type | Req | Description |
|---|---|---|---|
| ranges | array | yes | – |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| value_render_option | string | – | – |
No output schema declared.
No examples provided.
batch_update ~143
Run a structural batchUpdate on the spreadsheet (add/delete sheets, formatting, merges, freeze, conditional formatting, etc.). 'requests' is the Google Sheets API batchUpdate request array. See https://developers.google.com/sheets/api/reference/rest/v4/spreadsheets/request.
| Name | Type | Req | Description |
|---|---|---|---|
| include_spreadsheet_in_response | boolean | – | – |
| requests | array | yes | Array of Request objects per the Sheets API. |
| response_include_grid_data | boolean | – | – |
| response_ranges | array | – | – |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
No output schema declared.
No examples provided.
batch_update_values ~78
Update multiple A1 ranges in one call. Each item is { range, values }.
| Name | Type | Req | Description |
|---|---|---|---|
| data | array | yes | – |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| value_input_option | string | – | – |
No output schema declared.
No examples provided.
clear_values ~77
Clear all values from one or more A1 ranges. Pass a single range or use ranges[].
| Name | Type | Req | Description |
|---|---|---|---|
| range | string | – | – |
| ranges | array | – | – |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
No output schema declared.
No examples provided.
create_spreadsheet ~56
Create a new spreadsheet owned by the authenticated user. Returns the new spreadsheetId and URL.
| Name | Type | Req | Description |
|---|---|---|---|
| sheet_titles | array | – | Optional initial tab names. If omitted, one default sheet is created. |
| title | string | yes | – |
No output schema declared.
No examples provided.
delete_columns ~117
Delete columns in range [start_index, end_index) (0-based, half-open).
| Name | Type | Req | Description |
|---|---|---|---|
| end_index | number | yes | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_index | number | yes | – |
No output schema declared.
No examples provided.
delete_rows ~117
Delete rows in range [start_index, end_index) (0-based, half-open).
| Name | Type | Req | Description |
|---|---|---|---|
| end_index | number | yes | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_index | number | yes | – |
No output schema declared.
No examples provided.
delete_sheet ~98
Delete a tab. Pass either sheet_id (gid) or sheet_name.
| Name | Type | Req | Description |
|---|---|---|---|
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
No output schema declared.
No examples provided.
duplicate_sheet ~126
Duplicate a tab within the same spreadsheet. Returns the new sheetId.
| Name | Type | Req | Description |
|---|---|---|---|
| insert_index | number | – | Optional 0-based position of the copy. |
| new_title | string | yes | Title for the duplicated tab. |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
No output schema declared.
No examples provided.
format_cells ~235
Apply a CellFormat to a range. Pass a partial CellFormat object as 'format' (e.g. { backgroundColor: { red: 1 }, textFormat: { bold: true, fontSize: 12 }, horizontalAlignment: 'CENTER', numberFormat: { type: 'NUMBER', pattern: '#,##0.00' } }). Only the provided keys are updated. See https://developers.google.com/sheets/api/reference/rest/v4/spreadsheets/cells#CellFormat.
| Name | Type | Req | Description |
|---|---|---|---|
| end_column | number | yes | – |
| end_row | number | yes | – |
| format | object | yes | Partial CellFormat. The keys you set determine the update mask. |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_column | number | yes | – |
| start_row | number | yes | – |
No output schema declared.
No examples provided.
get_spreadsheet ~125
Return spreadsheet metadata: title, list of sheets (tabs) with sheetId/title/index/gridProperties. Use this first when working on an unknown spreadsheet to discover tab names and gids. Set include_grid_data=true to also return cell data (large).
| Name | Type | Req | Description |
|---|---|---|---|
| include_grid_data | boolean | – | Include full grid data. Default false. |
| ranges | array | – | Optional A1 ranges to limit returned data. |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
No output schema declared.
No examples provided.
get_values ~109
Read values from an A1 range (e.g. 'Sheet1!A1:D100'). Returns a 2D array of cell values.
| Name | Type | Req | Description |
|---|---|---|---|
| range | string | yes | A1 range, e.g. 'Sheet1!A1:D100'. |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| value_render_option | string | – | Default FORMATTED_VALUE. |
No output schema declared.
No examples provided.
insert_columns ~119
Insert N empty columns starting at start_index (0-based).
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| inherit_from_before | boolean | – | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_index | number | yes | – |
No output schema declared.
No examples provided.
insert_rows ~159
Insert N empty rows starting at start_index (0-based, half-open: rows [start_index, start_index+count) are inserted).
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of rows to insert. |
| inherit_from_before | boolean | – | If true, formatting inherited from row above. Default false. |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_index | number | yes | 0-based row index where insertion begins. |
No output schema declared.
No examples provided.
list_spreadsheets ~124
List Google Sheets files in the user's Drive (most-recently-modified first). Returns id, name, modifiedTime, webViewLink. Use this when the user mentions a sheet by name without giving the ID.
| Name | Type | Req | Description |
|---|---|---|---|
| include_shared_drives | boolean | – | Include items in Shared Drives. Default true. |
| order_by | string | – | Drive 'orderBy' string, e.g. 'modifiedTime desc' (default), 'name', 'createdTime desc'. |
| page_size | number | – | Max results (1-1000, default 50). |
No output schema declared.
No examples provided.
merge_cells ~163
Merge a cell range. merge_type controls how: MERGE_ALL (default), MERGE_COLUMNS (merge each column), MERGE_ROWS (merge each row).
| Name | Type | Req | Description |
|---|---|---|---|
| end_column | number | yes | – |
| end_row | number | yes | 0-based exclusive. |
| merge_type | string | – | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_column | number | yes | – |
| start_row | number | yes | 0-based inclusive. |
No output schema declared.
No examples provided.
rename_sheet ~95
Rename a tab.
| Name | Type | Req | Description |
|---|---|---|---|
| new_title | string | yes | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
No output schema declared.
No examples provided.
resolve_url ~47
Parse a Google Sheets URL and extract spreadsheetId and gid (tab id). Convenience helper so the user can paste a URL and the caller can grab the IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | – |
No output schema declared.
No examples provided.
run_sheets_script ~261
Escape hatch: execute an arbitrary Node.js script with full Google Sheets/Drive access. Use when no dedicated tool covers the operation, or when multiple coordinated calls are needed. The script runs in a fresh Node process with these globals already prepared: `sheets` (Sheets v4 client), `drive` (Drive v3 client), `google` (googleapis namespace), `auth` (OAuth2Client), `spreadsheetId` (string). Use `await` freely — the harness wraps your code in an async IIFE. To return a structured value to the caller, assign to `result` (e.g. `result = { rows: 12 };`). console.log output is captured as stdout. The temp file is always deleted, even on error.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Node.js source code. Has access to: sheets, drive, google, auth, spreadsheetId. Use top-level await. Assign to `result` to return a value. |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| timeout_ms | number | – | Default 120000 (2 min). Max 600000. |
No output schema declared.
No examples provided.
search_spreadsheets ~138
Search spreadsheets in the user's Drive by name (substring, case-insensitive) and/or full-text content. At least one of `name_contains` or `full_text` is required. Use this when the user refers to a sheet by part of its title.
| Name | Type | Req | Description |
|---|---|---|---|
| full_text | string | – | Full-text search across spreadsheet content. |
| include_shared_drives | boolean | – | Default true. |
| name_contains | string | – | Substring of the file name. |
| order_by | string | – | Drive orderBy, default 'modifiedTime desc'. |
| page_size | number | – | Max results (1-1000, default 50). |
No output schema declared.
No examples provided.
set_borders ~222
Set borders on a range. Pass per-side Border objects in 'borders' (top/bottom/left/right/innerHorizontal/innerVertical). Each Border = { style: 'SOLID'|'DOTTED'|'DASHED'|'SOLID_MEDIUM'|'SOLID_THICK'|'DOUBLE'|'NONE', color?: { red,green,blue,alpha } }.
| Name | Type | Req | Description |
|---|---|---|---|
| borders | object | yes | Object with optional keys: top, bottom, left, right, innerHorizontal, innerVertical. |
| end_column | number | yes | – |
| end_row | number | yes | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_column | number | yes | – |
| start_row | number | yes | – |
No output schema declared.
No examples provided.
unmerge_cells ~126
Unmerge all merges within the given cell range.
| Name | Type | Req | Description |
|---|---|---|---|
| end_column | number | yes | – |
| end_row | number | yes | – |
| sheet_id | number | – | Numeric sheet (tab) ID, i.e. the gid. Preferred. |
| sheet_name | string | – | Tab name (used only if sheet_id is omitted). |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| start_column | number | yes | – |
| start_row | number | yes | – |
No output schema declared.
No examples provided.
update_values ~116
Write a 2D array of values into an A1 range. Use value_input_option='USER_ENTERED' to evaluate formulas, 'RAW' to write literal strings.
| Name | Type | Req | Description |
|---|---|---|---|
| range | string | yes | – |
| spreadsheetId | string | yes | Google Sheets spreadsheet ID (the string between /d/ and /edit in the URL). Always required and explicit — there is no default. |
| value_input_option | string | – | Default USER_ENTERED. |
| values | array | yes | 2D array of cell values (rows of columns). |
No output schema declared.
No examples provided.
How do I install the io.github.moooonad/mcp-google-sheets-full server?
io.github.moooonad/mcp-google-sheets-full runs locally as an npm package, launched with npx -y mcp-google-sheets-full. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mcp-google-sheets-full
claude mcp add moooonad-mcp-google-sheets-full -- npx -y mcp-google-sheets-full
What is the io.github.moooonad/mcp-google-sheets-full server?
io.github.moooonad/mcp-google-sheets-full is listed in the public MCP registry as io.github.moooonad/mcp-google-sheets-full. Full Google Sheets MCP: 26 tools + run_sheets_script escape hatch. User OAuth, no service account. This page covers its npm package (mcp-google-sheets-full).
Is the io.github.moooonad/mcp-google-sheets-full server safe to use?
io.github.moooonad/mcp-google-sheets-full scores 72 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.moooonad/mcp-google-sheets-full server expose?
io.github.moooonad/mcp-google-sheets-full exposes 26 tools: get_spreadsheet, get_values, batch_get_values, update_values, batch_update_values, and 21 more. Their descriptions and schemas cost roughly 3,182 tokens of context every time the server is loaded.
Is the io.github.moooonad/mcp-google-sheets-full server still maintained?
io.github.moooonad/mcp-google-sheets-full is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.moooonad/mcp-google-sheets-full server under?
io.github.moooonad/mcp-google-sheets-full declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.