Google Sheets Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Google Sheets Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Google Sheets - read, write, and query spreadsheet data.
Data questions: "How many open deals are in the pipeline?" or "What's our total Q3 revenue?" → reads the spreadsheet and answers directly.
Quick expense entry: Snap a photo of a receipt → extracts the details and appends a row to your expense tracker.
Cross-tool status sync: "Check all our vendor Slack channels and update the tracking spreadsheet with their latest updates" → reads Slack, updates the sheet.
Data analysis: "Break down the Salesforce figures by region and compare against our events calendar" → pulls data from multiple sources into a spreadsheet for analysis.
(These are just examples - any workflow that needs spreadsheet data can use this. Use in combination with google-drive-mcp for finding files, deleting, comments, and sharing permissions.)
http://localhost:3000/callback to Authorized redirect URIsGOOGLE_CLIENT_ID='your-client-id' \
GOOGLE_CLIENT_SECRET='your-client-secret' \
MCP_TRANSPORT=http \
npm startThe server runs on http://localhost:3000 by default. Change with PORT=3001.
claude mcp add --transport http google-sheets-mcp http://localhost:3000/mcpThis server acts as an OAuth proxy to Google:
graph LR
A[MCP client] <--> B[google-sheets-mcp] <--> C[Google OAuth/API]/.well-known/oauth-authorization-server/register returns the Google OAuth client credentials/authorize redirects to Google, encoding the client's callback URL in state/callback receives the code from Google and forwards to the client's callback/token proxies token requests to Google, injecting client credentials/mcp handles MCP requests, using the bearer token to call Google Sheets APIThe server holds no tokens or state - it just proxies OAuth to Google.
| Tool | Description |
|---|---|
| Spreadsheet | |
sheets_spreadsheet_get | Get spreadsheet metadata (title, sheets list, optionally cell data) |
sheets_spreadsheet_create | Create a new spreadsheet |
| Values | |
sheets_values_get | Read cell values from a range |
sheets_values_batch_get | Read cell values from multiple ranges |
sheets_values_update | Write cell values to a range (overwrites) |
sheets_values_batch_update | Write cell values to multiple ranges |
sheets_values_append | Append rows after existing data |
sheets_values_clear | Clear cell values from a range |
| Sheets (tabs) | |
sheets_sheets_list | List all sheets in a spreadsheet |
sheets_sheet_add | Add a new sheet (tab) |
sheets_sheet_delete | Delete a sheet (tab) |
| Advanced | |
sheets_batch_update | Execute batch operations (formatting, merging, filters, etc.) |
spreadsheets - Full read/write access to spreadsheetsPull requests are welcomed on GitHub! To get started:
npm installnpm run test to run testsnpm run buildVersions follow the semantic versioning spec.
To release:
npm version <major | minor | patch> to bump the versiongit push --follow-tags to push with tags~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.