Google Drive

The Drive MCP server is available only through the Google Workspace Developer Preview Program, so the Google Cloud project must be registered in it. Use a Google Cloud project where you can enable services, configure the Google Auth platform, create credentials, and grant project roles. You need Service Usage Admin or Owner to enable the APIs and appropriate IAM administration access to grant MCP Tool User. Every connecting user needs a Google Account with access to the intended Drive files.

Sign in at console.cloud.google.com and select the project registered in the Developer Preview Program. It owns the APIs and credentials. If your organization restricts high-risk Drive scopes, arrange access to a Service Settings administrator and obtain an approved app-access setting from the application or cloud security owner.

Join the Google Workspace Developer Preview Program

1. Open developers.google.com/workspace/preview.
2. Review the Developer Preview Program Terms with the application or security owner.
3. Click Apply to join the Developer Preview Program.
4. In the application form, enter the requested Google Workspace account and Google Cloud project information.
5. Agree to the terms only with organizational approval.
6. Submit the form with the visible or equivalent submission control.
7. Wait for Google’s project-registration confirmation at the submitted email address. Google says this should complete within a couple of days.

Use the registered project for every Google Cloud step that follows.

Enable the Google Drive API

1. Open console.cloud.google.com/flows/enableapi?apiid=drive.googleapis.com.
2. Confirm the intended project if prompted.
3. Click Enable. If the API is already enabled, continue to the next section.

Enable the Google Drive MCP API

1. Open console.cloud.google.com/flows/enableapi?apiid=drivemcp.googleapis.com.
2. Confirm the intended project if prompted.
3. Click Enable. If the API is already enabled, continue to the next section.

Grant the MCP Tool User role

1. Open console.cloud.google.com/iam-admin/iam.
2. Select the same project.
3. Click Grant access.
4. In New principals, enter the Google Account email of a user who will connect from the Speakeasy AI Control Plane.
5. Click Select a role.
6. Search for MCP Tool User.
7. Select MCP Tool User.
8. Click Save.
9. Repeat these steps for every connecting user.

Existing Drive sharing and Workspace policy determine which files each user can access.

Configure the OAuth consent screen

Google does not permit an OAuth consent screen to be removed after it is configured.

Open console.cloud.google.com/auth/branding.

If Google Auth platform not configured yet appears, complete the first-time configuration:

1. Click Get Started.
2. Under App Information, enter Drive MCP Server in App name.
3. Select an approved User support email.
4. Click Next.
5. Under Audience, select Internal if every connecting account belongs to the project’s Workspace organization. Otherwise, select External.
6. Click Next.
7. Under Contact Information, enter an approved Email address.
8. Click Next.
9. Under Finish, review the Google API Services User Data Policy.
10. After obtaining organizational approval, select I agree to the Google API Services: User Data Policy.
11. Click Continue.
12. Click Create.

If the Google Auth platform was already configured, use its existing Branding, Audience, and Data Access pages.

1. Open Data Access.

2. Click Add or Remove Scopes.

3. Under Manually add scopes, paste these two scopes:

   https://www.googleapis.com/auth/drive.readonly
   https://www.googleapis.com/auth/drive.file

4. Click Add to Table.

5. Click Update.

6. Click Save.

If you selected External and the publishing status is Testing, add every connecting user:

1. Open Audience.
2. Under Test users, click Add users.
3. Enter every connecting user’s email.
4. Click Save.

Testing authorizations expire after seven days. For durable External use, hand publication, verification, and any required security assessment to the application or cloud security owner.

Create the OAuth client

1. Open console.cloud.google.com/auth/clients/create.

2. Set Application type to Web application.

3. In Name, enter a recognizable name such as Speakeasy AI Control Plane.

4. Under Authorized redirect URIs, click + Add URI.

5. Paste this value:

   https://ai.speakeasy.com/mcp/remote_login_callback

Do not add Authorized JavaScript origins. Before the next action, prepare an approved secret store: the next dialog permits the client secret to be copied only once.

6. Click Create.

Copy the client credentials

1. In OAuth 2.0 client created, copy the Client ID to your approved secret store.
2. Under Client secrets, copy the Client secret to the same location.
3. Keep both values ready for Speakeasy setup.

If you lose the client secret before connecting, delete it and create a new one.

Permit the OAuth app under Workspace policy if required

Complete this section only if Workspace app-access restrictions require approval of the OAuth client.

1. Sign in at admin.google.com as a Service Settings administrator.
2. Go to Security > Access and data control > API controls.
3. Click Manage App Access.
4. Under Configured apps, click Configure new app.
5. Enter the Client ID from Copy the client credentials.
6. Click Search.
7. Select the matching result.
8. Under Scope, keep the top-level organization selected, or use Select org units > Include organizations to select the covered units.
9. Click Continue.
10. Under Access to Google data, have the application or cloud security owner choose the approved setting. Trusted permits all requested services, Specific Google data limits access to selected scopes, and Limited cannot permit the required drive.readonly scope.
11. Click Continue.
12. Review the setting.
13. Click Finish.

Add the server in Speakeasy

1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.

2. Click Add new to open Add MCP server.

3. Choose Hosted remotely.

4. On New remote MCP server, paste this URL into MCP server URL:

   https://drivemcp.googleapis.com/mcp/v1

5. Leave User session issuer at its default.

6. Click Verify connectivity.

7. Under Identity, select User Identity. The page preselects No Identity for this server, so change it.

8. If Guardrails appears, leave it off.

9. Click Save.

Speakeasy saves the server as Disabled and says to finish setup in Settings > Identity. This is expected; the next section completes it.

Connect your credentials

1. Open the server’s Settings and find the Identity section.

2. Confirm that User Identity is selected.

3. In Choose an identity provider, confirm that the preselected provider is Google (https://accounts.google.com/). If another provider is shown, open the picker, search in Search identity providers…, and choose the Google provider. A provider badged Will be created is created when you save.

4. Choose Manual.

5. In Client ID, paste the Client ID from Copy the client credentials.

6. In Client secret, paste the Client secret from the same section. Google requires it even though the field says “Optional”.

7. Open Advanced. In Scope, enter this value on one line:

   https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.file

   Do not leave Scope blank. A blank value requests every scope the server advertises, including full Drive access, which the consent screen does not grant.

8. Click Save.

9. Open Settings > Danger Zone > Server Availability and turn on Enable MCP server so it shows Enabled.

When a person first uses the server, Google’s browser authorization prompt appears. They must sign in with an account granted MCP Tool User. If the app’s audience is External and in Testing, the account must also be listed under Test users.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Google’s Drive MCP documentation.