Google Docs Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Google Docs Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A local stdio MCP server that handles Google OAuth2 locally and proxies authenticated requests to the Google Docs and Google Drive REST APIs.
This solves the problem where Cursor cannot complete OAuth for Google's hosted Workspace MCP servers (Google does not support the cursor:// redirect protocol).
Cursor Agent ──stdio JSON-RPC──► Local MCP Server ──Bearer──► docs.googleapis.com
│ └──► drive.googleapis.com
└──► OAuth2 Token Manager ──► Google OAuthhttps://www.googleapis.com/auth/documentshttps://www.googleapis.com/auth/drive— Desktop app clients allow http://127.0.0.1 redirects without pre-registration
npm installcp .env.example .envEdit .env and fill in your OAuth client credentials from Google Cloud Console:
GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-client-secretnpm run authThis opens your browser to Google's consent screen, completes the OAuth2 flow, and saves tokens to token.json (gitignored). You only need to do this once — tokens refresh automatically.
Headless alternative: Set GOOGLE_REFRESH_TOKEN=<your-refresh-token> in .env to skip the interactive flow entirely.
Add the following entry to ~/.cursor/mcp.json (under mcpServers):
"google-docs": {
"command": "node",
"args": [
"D:\\Documents\\_Projects\\google-docs-mcp\\node_modules\\tsx\\dist\\cli.mjs",
"D:\\Documents\\_Projects\\google-docs-mcp\\src\\index.ts"
]
}Restart Cursor after saving.
google_docs_requestMake any request to the Google Docs REST API.
| Parameter | Type | Description | ||||
|---|---|---|---|---|---|---|
path | string | Path after /v1/, e.g. documents/{id}:batchUpdate | ||||
method | GET \ | POST \ | PATCH \ | PUT \ | DELETE | HTTP method |
body | object (optional) | JSON request body | ||||
query | object (optional) | Query string params (string values) |
Examples:
Create a document:
{ "path": "documents", "method": "POST", "body": { "title": "My New Doc" } }Read a document:
{ "path": "documents/DOC_ID", "method": "GET" }Insert text via batchUpdate:
{
"path": "documents/DOC_ID:batchUpdate",
"method": "POST",
"body": {
"requests": [
{ "insertText": { "text": "Hello world\n", "location": { "index": 1 } } }
]
}
}google_drive_requestMake any request to the Google Drive REST API v3.
Same parameters; base URL is https://www.googleapis.com/drive/v3/.
Examples:
List files:
{ "path": "files", "method": "GET", "query": { "pageSize": "10" } }Search for docs:
{
"path": "files",
"method": "GET",
"query": { "q": "mimeType='application/vnd.google-apps.document'", "pageSize": "5" }
}npm run dev # tsx --watch (hot reload)
npm start # run once
npm run auth # re-authorize (if tokens are revoked).env and token.json are gitignored — never commit them.env, not in global mcp.json~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.