Workspace MCP

Quick Verdict

Workspace MCP is a community Google Workspace MCP server maintained by Taylor Wilsdon. It is MIT licensed, distributed as the workspace-mcp Python package, and was at PyPI version 1.22.0 for this review. The project brings Gmail, Drive, Calendar, Docs, Sheets, Slides, Forms, Chat, Apps Script, Tasks, Contacts, and Search into one server. It supports self-hosting and offers cloud-related options, making it much broader and more deployable than Google’s separate hosted Developer Preview servers.

That breadth is both its advantage and its main risk. The operator becomes responsible for the Google Cloud project, OAuth client, token storage, service selection, scopes, logging, attachment paths, network exposure, upgrades, and agent approval controls. Do not enable every service and tool merely because they are available. Start with selected services, read-only or granular permissions, and a dedicated test account. Teams that need only a narrow official endpoint should compare Gmail MCP Server, Google Drive MCP Server, or Google Sheets MCP Server. Teams preferring a managed third-party execution layer can assess Composio Google Super.

Best For

• Engineering teams that genuinely need workflows spanning several Google Workspace products.
• Organizations able to operate Python services, containers, HTTP endpoints, OAuth callbacks, secrets, and monitoring.
• Security teams that prefer auditable MIT-licensed source and deployment inside controlled infrastructure.
• Products that need to select services, tool tiers, read-only behavior, or granular per-service permissions.
• It is not ideal for users without OAuth and operations experience, teams unable to review broad scopes, or simple tasks that need only one read-only Google service.

Key Features

• Broad Workspace coverage: One project covers major communication, file, document, spreadsheet, presentation, task, contact, chat, script, and search workflows.
• MIT open source: The server code can be audited, modified, forked, redistributed, and commercially deployed under the license terms.
• Self-hosting and remote deployment: Run locally or deploy through HTTP, containers, and centralized multi-user patterns; cloud options require separate commercial and data review.
• Tool and service controls: Select applications, progressive tool tiers, read-only mode, or granular permissions instead of exposing everything.
• OAuth 2.0 and 2.1 patterns: Supports single-user and remote multi-user designs, but secure callback, state, token, key, and proxy configuration remains the operator’s responsibility.
• CLI and MCP use: The project can support agent clients and direct command-oriented workflows.

Use Cases

Workspace MCP makes sense when the workflow crosses product boundaries: find a Gmail attachment and store it in Drive, use Calendar events to prepare a meeting document, summarize a Sheets range into Docs, or create tasks from a reviewed conversation. A single service can reduce duplicated OAuth and deployment work compared with operating many separate servers. Mail, documents, cells, invitations, and contact notes are untrusted input. Indirect prompt injection can exploit cross-service authority to induce sending, sharing, overwriting, or deletion, so content instructions must not alter the user-approved workflow, account boundary, resource policy, or tool allowlist.

Rollout should proceed in the opposite direction from the feature list. Select one or two services, enable read-only or the lowest permission level, and test with a dedicated Workspace account. Add write tools only after the team has designed confirmations and recovery. Remote multi-user deployments require user isolation, secure redirect URIs, encrypted token storage, state validation, reverse-proxy controls, and audit logs. Sending email, changing sharing permissions, deleting files, and overwriting spreadsheet ranges are not equivalent risks; each deserves a separate policy and allowlist.

Pricing

The MIT-licensed source is free to use, and PyPI version 1.22.0 was the verifiable package version for the research date. That version will become outdated, so teams should review releases and pin a tested dependency. Self-hosting still incurs infrastructure, storage, monitoring, maintenance, and Google API or account costs.

The project also describes cloud or private managed options. Their prices and terms can change and should be confirmed directly rather than copied into a static review. This directory therefore classifies Workspace MCP as freemium: the open-source server is free, while hosting and managed operation can cost money.

Pros

• Broad coverage supports real cross-application Workspace workflows.
• MIT source can be audited, forked, self-hosted, and adapted to organizational controls.
• Service selection, tiers, read-only mode, and granular permissions help reduce exposure.
• Local and remote deployment options fit individual developers and centralized teams.
• Active packaging and deployment support make it more practical than a minimal code example.

Cons

• It is a community project, not a Google-operated or Google-supported MCP service.
• Broad OAuth access increases the amount of account data and the number of actions at risk.
• Self-hosters must secure client secrets, refresh tokens, callbacks, logs, attachments, dependencies, and network endpoints.
• A large tool catalog increases selection complexity and the chance of unintended writes or destructive calls.
• Security claims for self-hosted source do not automatically apply to a separate hosted service with a different data path.

Alternatives

FAQ

Is Workspace MCP an official Google project?

No. Taylor Wilsdon maintains this community project. It integrates with Google APIs but is not published or endorsed as Google’s official MCP server.

Is it free?

The MIT-licensed source is free to self-host. Infrastructure, operations, Google plans, and optional managed cloud services may cost money.

What is the package version?

The research snapshot for July 21, 2026 identified PyPI version 1.22.0. Check current releases and pin the version you have tested.

Does self-hosting make it automatically secure?

No. It gives you control over the path, but secrets, tokens, logs, attachments, network access, dependencies, and model retention still require protection.

Can I enable only Sheets or Gmail?

Yes. The project supports service and permission selection. Enabling only required services is safer than loading the complete catalog.

When should I choose an official Google server instead?

Choose a narrow official preview when Google hosting and a smaller scope matter more than self-hosting and multi-product breadth.

Bottom Line

Workspace MCP is the flexible choice for teams prepared to operate their own integration layer. It combines broad Workspace capability, MIT source visibility, and multiple deployment patterns. Those strengths do not reduce the need for disciplined OAuth and action controls; they increase it. Select the minimum services, start read-only, pin releases, protect tokens and logs, and introduce each write tool behind explicit confirmation. For a single Google product, a narrower official server may be easier to govern. For a real cross-Workspace workflow, Workspace MCP can be the better architecture when the team accepts operational ownership.