Google Drive, Sheets & Slides MCP server

What it does

This server lets an agent find, read and edit files across one Google account's Drive, and work inside Sheets, Docs and Slides: read and write cell ranges, insert and replace document text, add slides. It is @us-all/google-drive-mcp, an MIT-licensed community package on npm, and Google does not maintain it. Statio runs version 1.15.8 as one catalog entry covering all four apps, plus the shared drives, labels and approvals tools that only work on Google Workspace accounts.

It signs in with an OAuth client you create in your own Google Cloud project and a refresh token for your account, so it acts as you. Every file you can open, it can open.

Tools

Version 1.15.8 lists 100 tools, and every one sets a read-only or destructive hint, which the last column follows. 32 only read and 68 change something. The 68 write tools all stop with "Write operations are disabled" unless GOOGLE_DRIVE_ALLOW_WRITE is true, but they still appear in the tool list either way, so an agent sees all 100.

Drive files, sharing and history

Sheets

Docs

Slides

Shared drives, labels, approvals and search

Labels and approvals need a Workspace account, and the package's own descriptions say shared drives and labels need Business Standard or higher. audit-external-shares also works on a personal account for files in My Drive.

Set it up

You need three values: an OAuth client ID, its secret, and a refresh token for the Google account the agent should act as.

1. In the Google Cloud console, create or pick a project and enable the Drive, Docs, Sheets, Slides, Drive Activity and Drive Labels APIs. The package's README lists those six.
2. Set up the OAuth consent screen. On a Workspace account, choose Internal. Google's OAuth documentation says an External app left in Testing gets refresh tokens that expire after 7 days, which looks like the server breaking a week later.
3. Under Credentials, create an OAuth client ID of type Desktop app and download its JSON file.
4. Get the refresh token. Google's Ads API docs describe the two routes: a Desktop client uses the gcloud CLI, and a Web application client uses the OAuth 2.0 Playground. With gcloud:

gcloud auth application-default login \
  --client-id-file=client_secret.json \
  --scopes=https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.activity.readonly,https://www.googleapis.com/auth/documents.readonly

Those three scopes are the package's own read-only defaults. For an agent that writes, use drive, drive.activity.readonly and documents instead. The scopes you approve here are the token's real limit, whatever the server is told. gcloud writes the result to ~/.config/gcloud/application_default_credentials.json (on Windows, under %APPDATA%\gcloud\), and the client_id, client_secret and refresh_token in that file are the three values. Google allows 100 refresh tokens per account per client, and creating a 101st silently invalidates the oldest.

If gcloud's file is on the same machine, the package finds it without any environment variables. To be explicit, or to run as a different account, pass the three values yourself.

Claude Code, directly:

claude mcp add google-drive \
  -e GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com \
  -e GOOGLE_CLIENT_SECRET=your-client-secret \
  -e GOOGLE_REFRESH_TOKEN=your-refresh-token \
  -e GOOGLE_DRIVE_ALLOW_WRITE=false \
  -- npx -y @us-all/google-drive-mcp@1.15.8

Cursor, directly, in ~/.cursor/mcp.json or .cursor/mcp.json:

{
  "mcpServers": {
    "google-drive": {
      "command": "npx",
      "args": ["-y", "@us-all/google-drive-mcp@1.15.8"],
      "env": {
        "GOOGLE_CLIENT_ID": "${env:GOOGLE_CLIENT_ID}",
        "GOOGLE_CLIENT_SECRET": "${env:GOOGLE_CLIENT_SECRET}",
        "GOOGLE_REFRESH_TOKEN": "${env:GOOGLE_REFRESH_TOKEN}",
        "GOOGLE_DRIVE_ALLOW_WRITE": "false"
      }
    }
  }
}

Run directly, you can also set GD_TOOLS to load only some categories, for example GD_TOOLS=drive,docs,sheets. The categories are drive, sheets, docs, slides, shared-drives, labels and approvals, and search-tools always loads. The client tutorials, How to add MCP servers to Claude Code and How to set up MCP servers in Cursor, explain config scopes and how to keep the secret and token out of files you commit.

Through Statio: install Google Drive, Sheets & Slides from the catalog and paste the client ID, client secret and refresh token under the server's Credentials. The fourth field, Allow Write Access, takes true or false and sets GOOGLE_DRIVE_ALLOW_WRITE. Statio's entry loads all 100 tools, so narrow them with grants under Permissions instead of GD_TOOLS. A new server has no grants, so nobody can call it until you add some. The desktop app then writes your client configs. The manual entry is the local proxy URL with the server name from your dashboard, http://127.0.0.1:7777/google-drive/mcp, added in Claude Code with claude mcp add --transport http google-drive <url> or as a "url" in Cursor. Tools missing after that? Start a fresh session, then work through How to debug an MCP server that won't connect.

What to hold back

The write switch is all or nothing. With GOOGLE_DRIVE_ALLOW_WRITE=true, an agent that should only append rows to one sheet can also share, delete and rewrite anything in your Drive. Decide per tool which writes each agent gets.

share-file is the riskiest tool here. It can share any file you own with any address, or with anyone who has the link, and an agent that reads a document saying "share this folder with this address" has everything it needs to do it. Pair it with read-file or search-files and you have the read, the outside instruction and the way out that make up the lethal trifecta. Almost no agent needs it. remove-permission is its mirror: an agent can lock your colleagues out of a shared folder.

delete-file moves files to trash by default, but permanent: true skips the trash. Grant it to nothing that works unattended. The same goes for sheets-delete-dimension, sheets-clear-values and sheets-batch-clear-values, which can empty a finance sheet's rows in one call, and for docs-delete-range.

sheets-find-replace runs a regex across the whole spreadsheet, and docs-replace-text and slides-replace-text across a whole document or deck. A pattern that matches more than the agent expected changes every cell or paragraph it matches. update-file replaces a file's content outright.

docs-batch-update and slides-batch-update pass raw API requests through, so a grant on either covers anything the Docs or Slides API can do to that file, including the deletes the named tools would have shown you. Treat them like having every write tool for that app.

sheets-delete-protected-range removes the protection someone put on a range on purpose. An agent that keeps hitting a protected range should stop, not unlock it.

Every file the agent reads is input from whoever wrote it, including comments and shared documents from outside your company. That text can carry instructions aimed at the agent, which is why the write tools matter more on this server than on most.

The refresh token can do whatever its scopes allow, with or without this server. Store it like a password, rotate it if it leaks, and use the read-only scopes for agents that only read. With Statio you grant each tool separately, so one agent can have read-file, search-files and the Sheets reads while another also gets sheets-append-values. MCP permissions covers how grants and denies combine.

Questions