A Google Workspace integration for Claude Code.
概览
A Google Workspace integration for Claude Code. This is a fork of taylorwilsdon/google_workspace_mcp with dangerous operations removed to prevent data exfiltration via prompt injection attacks. See SECURITY.md for details. Enables Claude Code to interact with your Google Workspace: - : Read emails, create drafts (cannot send) - : Read/create files (cannot share externally) - : Read and edit documents - : Read and write spreadsheets - : View and create events (cannot add attendees) - : Read and create forms - : Read and edit presentations LLMs are vulnerable to prompt injection attacks—malicious instructions hidden in content the model processes. An attacker could embed instructions in an email or document that trick the AI into exfiltrating sensitive data.
README
以下为原文 README 节选，完整内容请查看原文。
Hardened Google Workspace MCP
A security-hardened Google Workspace integration for Claude Code.
This is a fork of taylorwilsdon/google_workspace_mcp with dangerous operations removed to prevent data exfiltration via prompt injection attacks. See SECURITY.md for details.
What This Does
Enables Claude Code to interact with your Google Workspace:
- Gmail: Read emails, create drafts (cannot send)
- Google Drive: Read/create files (cannot share externally)
- Google Docs: Read and edit documents
- Google Sheets: Read and write spreadsheets
- Google Calendar: View and create events (cannot add attendees)
- Google Forms: Read and create forms
- Google Slides: Read and edit presentations
Why “Hardened”?
LLMs are vulnerable to prompt injection attacks—malicious instructions hidden in content the model processes. An attacker could embed instructions in an email or document that trick the AI into exfiltrating sensitive data.
This fork removes dangerous operations — both exfiltration vectors and destructive actions:
- No email sending - Claude can draft emails, but you must manually send them from Gmail
- No file sharing - Claude cannot share files with external users
- No filter creation - Claude cannot create auto-forwarding rules
- No event attendees - Claude cannot add attendees to calendar events (invitations could exfiltrate data)
- No file trashing - Claude cannot move Drive files to trash
- No email trashing - Claude cannot trash or spam-label emails
- Secure credential storage - OAuth tokens stored in your platform’s native credential manager (macOS Keychain, Windows Credential Manager, or Linux SecretService/KWallet), not plaintext files
⚠️ This Reduces Risk, It Does NOT Eliminate It
Important: This hardening only affects the Google Workspace tools. Claude Code has access to many other tools that could be used for data exfiltration (web requests, file writes, code execution, other MCP servers).
You must stay vigilant:
- Always review tool calls before approving them
- Never disable permission prompts
- Be suspicious of unexpected web requests or file operations
- Monitor Claude’s behavior when processing external content
See SECURITY.md for the complete security model and additional risks.
Prerequisites
- Claude Code installed on your machine
- A Google Workspace or personal Google account
- Python 3.11+ installed
Quick Start
Step 1: Create OAuth Credentials
Follow OAUTH_SETUP.md to create Google Cloud OAuth credentials.
Step 2: Clone and Install
git clone https://github.com/c0webster/hardened-google-workspace-mcp.git ~/hardened-google-workspace-mcp
cd ~/hardened-google-workspace-mcp
uv sync
Note: If you don’t have
uvinstalled, run:curl -LsSf https://astral.sh/uv/install.sh | sh
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"hardened-workspace": {
"command": "uv",
"args": ["run", "--directory", "/Users/YOUR_USERNAME/hardened-google-workspace-mcp", "python", "-m", "main", "--single-user"],
"env": {
"GOOGLE_OAUTH_CLIENT_ID": "YOUR_CLIENT_ID",
"GOOGLE_OAUTH_CLIENT_SECRET": "YOUR_CLIENT_SECRET"
}
}
}
}