Google Workplace Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Google Workplace Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that provides Cursor with tools to interact with Google Workspace: Gmail, Calendar, Drive, Docs, Sheets, Slides, Chat, and People.
Repository: github.com/Dave-Nguyen-PM/google-workplace-mcp
cd /path/to/google-workplace-mcp
npm install
npm run buildPlace the downloaded OAuth credentials file in one of these locations:
./credentials.json in the project root~/.google-workspace-mcp/credentials.jsonGOOGLE_CREDENTIALS_PATH environment variableAdd to your Cursor MCP settings (~/.cursor/mcp.json):
{
"mcpServers": {
"google-workspace": {
"command": "node",
"args": ["/path/to/google-workplace-mcp/dist/index.js"],
"env": {
"GOOGLE_CREDENTIALS_PATH": "/path/to/credentials.json"
}
}
}
}On the first request that requires Google auth, a browser window will open for OAuth consent. After authorizing, tokens are cached at ~/.google-workspace-mcp/tokens.json and auto-refreshed.
| Domain | Tools | Access |
|---|---|---|
| Auth | auth_clear, auth_refreshToken | - |
| Time | time_getCurrentDate, time_getCurrentTime, time_getTimeZone | Read |
| Drive | drive_search, drive_findFolder, drive_createFolder, drive_downloadFile, drive_moveFile, drive_trashFile, drive_renameFile, drive_getComments | Read/Write |
| Docs | docs_create, docs_getText, docs_writeText, docs_replaceText, docs_formatText, docs_getSuggestions | Read/Write |
| Sheets | sheets_getText, sheets_getRange, sheets_find, sheets_getMetadata | Read |
| Slides | slides_getText, slides_find, slides_getMetadata, slides_getImages, slides_getSlideThumbnail | Read |
| Calendar | calendar_list, calendar_createEvent, calendar_listEvents, calendar_getEvent, calendar_findFreeTime, calendar_updateEvent, calendar_respondToEvent, calendar_deleteEvent | Read/Write |
| Gmail | gmail_search, gmail_get, gmail_downloadAttachment, gmail_modify, gmail_batchModify, gmail_modifyThread, gmail_send, gmail_createDraft, gmail_sendDraft, gmail_listLabels, gmail_createLabel | Read/Write |
| Chat | chat_listSpaces, chat_findSpaceByName, chat_sendMessage, chat_getMessages, chat_sendDm, chat_findDmByEmail, chat_listThreads, chat_setUpSpace | Read/Write |
| People | people_getUserProfile, people_getMe, people_getUserRelations | Read |
Run with --debug to enable file logging to ~/.google-workspace-mcp/debug.log:
{
"mcpServers": {
"google-workspace": {
"command": "node",
"args": ["/path/to/dist/index.js", "--debug"]
}
}
}npm run dev # Watch mode (rebuilds on changes)
npm run build # Production build
npm start # Run the server directly~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.