Skip to content
Status

Google Drive

Connect Google's hosted Drive MCP server to read and create files under each user's existing Drive permissions.

Use a Google Cloud project where you can enable services, configure the Google Auth platform, create credentials, and grant project roles. You need Service Usage Admin or Owner to enable the APIs and appropriate IAM administration access to grant MCP Tool User. Every connecting user needs a Google Account with access to the intended Drive files.

Sign in at console.cloud.google.com and select the project that will own the APIs and credentials. If your organization restricts high-risk Drive scopes, arrange access to a Service Settings administrator and obtain an approved app-access setting from the application or cloud security owner.

Enable the Google Drive API

  1. Open console.cloud.google.com/flows/enableapi?apiid=drive.googleapis.com.
  2. Confirm the intended project if prompted.
  3. Click Enable. If the API is already enabled, continue to the next section.

Enable the Google Drive MCP API

  1. Open console.cloud.google.com/flows/enableapi?apiid=drivemcp.googleapis.com.
  2. Confirm the intended project if prompted.
  3. Click Enable. If the API is already enabled, continue to the next section.

Grant the MCP Tool User role

  1. Open console.cloud.google.com/iam-admin/iam.
  2. Select the same project.
  3. Click Grant access.
  4. In New principals, enter the Google Account email of a user who will connect from the Speakeasy AI Control Plane.
  5. Click Select a role.
  6. Search for MCP Tool User.
  7. Select MCP Tool User.
  8. Click Save.
  9. Repeat these steps for every connecting user.

Existing Drive sharing and Workspace policy determine which files each user can access.

Google does not permit an OAuth consent screen to be removed after it is configured.

Open console.cloud.google.com/auth/branding.

If Google Auth platform not configured yet appears, complete the first-time configuration:

  1. Click Get Started.
  2. Under App Information, enter Drive MCP Server in App name.
  3. Select an approved User support email.
  4. Click Next.
  5. Under Audience, select Internal if every connecting account belongs to the project’s Workspace organization. Otherwise, select External.
  6. Click Next.
  7. Under Contact Information, enter an approved Email address.
  8. Click Next.
  9. Under Finish, review the Google API Services User Data Policy.
  10. After obtaining organizational approval, select I agree to the Google API Services: User Data Policy.
  11. Click Continue.
  12. Click Create.

If the Google Auth platform was already configured, use its existing Branding, Audience, and Data Access pages.

  1. Open Data Access.

  2. Click Add or Remove Scopes.

  3. Under Manually add scopes, paste these two scopes:

    https://www.googleapis.com/auth/drive.readonly
    https://www.googleapis.com/auth/drive.file

  4. Click Add to Table.

  5. Click Update.

  6. Click Save.

If you selected External and the publishing status is Testing, add every connecting user:

  1. Open Audience.
  2. Under Test users, click Add users.
  3. Enter every connecting user’s email.
  4. Click Save.

Testing authorizations expire after seven days. For durable External use, hand publication, verification, and any required security assessment to the application or cloud security owner.

Create the OAuth client

  1. Open console.cloud.google.com/auth/clients/create.

  2. Set Application type to Web application.

  3. In Name, enter a recognizable name such as Speakeasy AI Control Plane.

  4. Under Authorized redirect URIs, click + Add URI.

  5. Paste this value:

    https://app.getgram.ai/mcp/remote_login_callback

Do not add Authorized JavaScript origins. Before the next action, prepare an approved secret store: the next dialog permits the client secret to be copied only once.

  1. Click Create.

Copy the client credentials

  1. In OAuth 2.0 client created, copy the Client ID to your approved secret store.
  2. Under Client secrets, copy the Client secret to the same location.
  3. Keep both values ready for Speakeasy setup.

If you lose the client secret before connecting, delete it and create a new one.

Permit the OAuth app under Workspace policy if required

Complete this section only if Workspace app-access restrictions require approval of the OAuth client.

  1. Sign in at admin.google.com as a Service Settings administrator.
  2. Go to Security > Access and data control > API controls.
  3. Click Manage App Access.
  4. Under Configured apps, click Configure new app.
  5. Enter the Client ID from Copy the client credentials.
  6. Click Search.
  7. Select the matching result.
  8. Under Scope, keep the top-level organization selected, or use Select org units > Include organizations to select the covered units.
  9. Click Continue.
  10. Under Access to Google data, have the application or cloud security owner choose the approved setting. Trusted permits all requested services, Specific Google data limits access to selected scopes, and Limited cannot permit the required drive.readonly scope.
  11. Click Continue.
  12. Review the setting.
  13. Click Finish.

Add the server in Speakeasy

  1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.

  2. Click Add new to open Add MCP server.

  3. Choose Hosted remotely.

  4. On New remote MCP server, paste this URL into MCP server URL:

    https://drivemcp.googleapis.com/mcp/v1

  5. Click Verify connectivity, then Save.

This creates the hosted MCP server and opens its Overview page.

Connect your credentials

Open the server’s Settings (from Overview for a hosted remote server, or Configure MCP settings after a catalog addition).

Choose an authentication provider

  • If Authentication is unconfigured, choose Use Discovered when available; otherwise choose Configure Manually.
  • If authentication is configured but no provider is attached, use Connected services > Add provider.
  • If the intended provider is already attached, use its existing controls. Do not attach a duplicate; check its client against the requirements below and skip Verify and attach.

In Attach Remote Identity Provider, the provider selector defaults to Select existing when the project has issuers. Select the appropriate existing Google provider and skip new-provider setup.

New provider only

  1. Choose Add new and enter Issuer URL:

    https://accounts.google.com/

  2. Confirm the auto-derived Slug is unique in the project.

  3. Discovery runs automatically for a seeded issuer URL. After typing or changing the URL, click Discover only if offered.

  4. Review the endpoints, or enter these Google OAuth values if discovery does not populate them.

    Authorization endpoint:

    https://accounts.google.com/o/oauth2/v2/auth

    Token endpoint:

    https://oauth2.googleapis.com/token

Choose a session client

  • Reuse: Under Session Client, choose Select existing when available and select the appropriate Google OAuth client. Skip credential entry; continue to Check client requirements.
  • Create: Choose Add new when available and set Client Type to Manual. For a new provider, complete the new-client form below.

New session client only

  1. Paste the Client ID from Copy the client credentials.
  2. Paste the Client Secret (optional) from the same section. Google’s Web application flow requires the generated secret despite the optional field label.

Check client requirements

For both new and reused clients, verify the Google app’s approved audience and publishing status. An External app in Testing must list each connecting account under Test users. Reusing a client does not require entering its credentials again.

Confirm the selected client includes the required scopes below. For a new client, configure Scope (override); for a reused client, inspect the read-only Scope value. If it does not match, choose Add new to create a correctly scoped client; the attach sheet cannot edit a reused client.

Configure these two scopes as required:

https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive.file

Verify and attach

  1. Confirm that the callback URL registered with the provider is https://app.getgram.ai/mcp/remote_login_callback. For a new manual client, also compare it with the sheet’s displayed Redirect URI. The existing-client selection does not display that field; check the registered callback in the provider’s app settings instead.
  2. Click Attach Identity Provider.

For the provider-side callback setting, see Create the OAuth client.

For more information, see Google’s Drive MCP documentation.