Skip to content
Status

Google Docs

Read and update Google Docs through Google's hosted Docs MCP server.

Sign in to console.cloud.google.com with an account that can select a Google Cloud project, enable APIs, configure the Google Auth platform, and create OAuth credentials. Google does not document a Google Docs MCP-specific paid plan or license requirement. Enabling APIs requires serviceusage.services.enable; Service Usage Admin provides this permission. Each account that will connect needs MCP Tool User (roles/mcp.toolUser) on the project and access to the Google Docs it will use. Obtain the approved support and contact addresses before you begin. If your organization restricts high-risk Drive and Docs scopes or unconfigured apps, you also need a Google Workspace administrator with the Service Settings administrator privilege.

Enable the Docs MCP APIs

  1. In the toolbar, open the resource selector.
  2. Select the Google Cloud project that will own the credentials.
  3. Open APIs & Services > Library.
  4. Open Google Docs API.
  5. Click Enable.
  6. Return to Library.
  7. Open Google Docs MCP API.
  8. Click Enable.

If Enable is unavailable, ask the project administrator for serviceusage.services.enable.

Open Google Auth platform > Branding.

Google says an OAuth consent screen cannot be removed after it is configured. Confirm the approved app name, support address, contact address, and audience before you click Get Started.

If the page says Google Auth Platform not configured yet:

  1. Click Get Started.
  2. Under App Information, enter Docs MCP Server in App name.
  3. Choose the approved User support email.
  4. Click Next.
  5. Under Audience, select Internal when it is available for your Google Workspace organization; otherwise select External.
  6. Click Next.
  7. Under Contact Information, enter the approved monitored address in Email address.
  8. Click Next.
  9. Under Finish, review the Google API Services User Data Policy.
  10. With organizational approval, select I agree to the Google API Services: User Data Policy.
  11. Click Continue.
  12. Click Create.

If the Google Auth platform is already configured, review the equivalent settings on Branding, Audience, and Data Access.

Add the required access:

  1. Open Data Access.

  2. Click Add or Remove Scopes.

  3. Under Manually add scopes, paste these four values:

    https://www.googleapis.com/auth/drive.readonly
    https://www.googleapis.com/auth/drive.file
    https://www.googleapis.com/auth/documents.readonly
    https://www.googleapis.com/auth/documents

  4. Click Add to Table.

  5. Click Update.

  6. Click Save.

If Audience is External and the app is in Testing, add every account that will make the first connection:

  1. Open Audience.
  2. Under Test users, click Add users.
  3. Enter the connecting accounts.
  4. Click Save.

Testing supports at most 100 test users, and each authorization expires after seven days.

Create the OAuth client

  1. Open Google Auth platform > Clients.

  2. Click Create client.

  3. Set Application type to Web application.

  4. In Name, enter a recognizable name such as Speakeasy AI Control Plane.

  5. Under Authorized redirect URIs, click + Add URI.

  6. In URIs, enter this value:

    https://app.getgram.ai/mcp/remote_login_callback

Prepare secure password storage before the next action. Google says the client secret in the next dialog can be copied only once.

  1. Click Create.

Keep OAuth 2.0 client created open.

Copy the client credentials

  1. In OAuth 2.0 client created, copy Client ID to secure storage.
  2. Under Client secrets, copy Client secret.
  3. Store the secret as a password alongside the Client ID.

If you lost the one-time secret, delete it and create a new secret before continuing.

If your organization restricts high-risk Drive and Docs scopes or blocks unconfigured apps, continue to Allow the OAuth client in restricted organizations. Otherwise, continue to Speakeasy setup.

Allow the OAuth client in restricted organizations

Complete this step only when your organization’s Workspace API controls restrict high-risk Drive and Docs scopes or block unconfigured apps.

  1. Sign in to admin.google.com with Service Settings administrator access.
  2. Open Security > Access and data control > API controls.
  3. Click Manage App Access.
  4. Under Configured apps, click Configure new app.
  5. Enter the Client ID copied in Copy the client credentials.
  6. Click Search.
  7. Select the matching app.
  8. Select the organizational units whose users will connect.
  9. Click Continue.
  10. Choose the access approved by the security owner:
    • Trusted
    • Specific Google data, with the Docs MCP scopes and any Google sign-in scopes the app requests
  11. Click Continue.
  12. Review the settings.
  13. Click Finish.

Changes can take up to 24 hours, though they usually apply sooner. Continue to Speakeasy setup.

Add the server in Speakeasy

  1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.

  2. Click Add new to open Add MCP server.

  3. Choose Hosted remotely.

  4. On New remote MCP server, paste this URL into MCP server URL:

    https://docsmcp.googleapis.com/mcp/v1

  5. Click Verify connectivity, then Save.

This creates the hosted MCP server and opens its Overview page. The Transport field is read-only.

Connect your credentials

Open the server’s Settings (from Overview for a hosted remote server, or Configure MCP settings after a catalog addition).

Choose an authentication provider

  • If Authentication is unconfigured, choose Use Discovered when available; otherwise choose Configure Manually.
  • If authentication is configured but no provider is attached, use Connected services > Add provider.
  • If the intended provider is already attached, use its existing controls. Do not attach a duplicate; check its client against the requirements below and skip Verify and attach.

In Attach Remote Identity Provider, the provider selector defaults to Select existing when the project has issuers. Select the appropriate existing Google provider and skip new-provider setup.

New provider only

  1. Choose Add new and enter Issuer URL:

    https://accounts.google.com/

  2. Confirm the auto-derived Slug is unique in the project.

  3. Discovery runs automatically for a seeded issuer URL. After typing or changing the URL, click Discover only if offered.

  4. Review the endpoints, or enter these Google OAuth values if discovery does not populate them.

    Authorization endpoint:

    https://accounts.google.com/o/oauth2/v2/auth

    Token endpoint:

    https://oauth2.googleapis.com/token

Choose a session client

  • Reuse: Under Session Client, choose Select existing when available and select the appropriate Google OAuth client. Skip credential entry; continue to Check client requirements.
  • Create: Choose Add new when available and set Client Type to Manual. For a new provider, complete the new-client form below.

New session client only

  1. In Client ID, paste the value you copied from Google.
  2. In Client Secret (optional), paste the secret you copied from Google. Google requires this value.

Check client requirements

For both new and reused clients, verify the Google app’s approved audience and publishing status. An External app in Testing must list each connecting account under Test users. Reusing a client does not require entering its credentials again.

Confirm the selected client includes the required scopes below. For a new client, configure Scope (override); for a reused client, inspect the read-only Scope value. If it does not match, choose Add new to create a correctly scoped client; the attach sheet cannot edit a reused client.

For a new client, enter this value:

https://www.googleapis.com/auth/drive.readonly, https://www.googleapis.com/auth/drive.file, https://www.googleapis.com/auth/documents.readonly, https://www.googleapis.com/auth/documents

Verify and attach

  1. Confirm that the callback URL registered with the provider is https://app.getgram.ai/mcp/remote_login_callback. For a new manual client, also compare it with the sheet’s displayed Redirect URI. The existing-client selection does not display that field; check the registered callback in the provider’s app settings instead.
  2. Click Attach Identity Provider.

For the provider-side callback setting, see created the OAuth client.

Complete Google’s browser authorization with the intended account. If the app is External and in Testing, that account must be listed under Test users.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Google’s Docs MCP documentation.