# Google Drive

Use a Google Cloud project where you can enable services, configure the Google Auth platform, create credentials, and grant project roles. You need **Service Usage Admin** or **Owner** to enable the APIs and appropriate IAM administration access to grant **MCP Tool User**. Every connecting user needs a Google Account with access to the intended Drive files.

Sign in at `https://console.cloud.google.com` and select the project that will own the APIs and credentials. If your organization restricts high-risk Drive scopes, arrange access to a **Service Settings administrator** and obtain an approved app-access setting from the application or cloud security owner.

### Enable the Google Drive API
1. Open `https://console.cloud.google.com/flows/enableapi?apiid=drive.googleapis.com`.
2. Confirm the intended project if prompted.
3. Click **Enable**. If the API is already enabled, continue to the next section.

<!-- screenshot: Google Drive API with Enable, or its enabled state -->

### Enable the Google Drive MCP API
1. Open `https://console.cloud.google.com/flows/enableapi?apiid=drivemcp.googleapis.com`.
2. Confirm the intended project if prompted.
3. Click **Enable**. If the API is already enabled, continue to the next section.

<!-- screenshot: Google Drive MCP API with Enable, or its enabled state -->

### Grant the MCP Tool User role
1. Open `https://console.cloud.google.com/iam-admin/iam`.
2. Select the same project.
3. Click **Grant access**.
4. In **New principals**, enter the Google Account email of a user who will connect from the Speakeasy AI Control Plane.
5. Click **Select a role**.
6. Search for `MCP Tool User`.
7. Select **MCP Tool User**.
8. Click **Save**.
9. Repeat these steps for every connecting user.

Existing Drive sharing and Workspace policy determine which files each user can access.

<!-- screenshot: Grant access with the principal and MCP Tool User -->

### Configure the OAuth consent screen
Google does not permit an OAuth consent screen to be removed after it is configured.

Open `https://console.cloud.google.com/auth/branding`.

If **Google Auth platform not configured yet** appears, complete the first-time configuration:

1. Click **Get Started**.
2. Under **App Information**, enter `Drive MCP Server` in **App name**.
3. Select an approved **User support email**.
4. Click **Next**.
5. Under **Audience**, select **Internal** if every connecting account belongs to the project's Workspace organization. Otherwise, select **External**.
6. Click **Next**.
7. Under **Contact Information**, enter an approved **Email address**.
8. Click **Next**.
9. Under **Finish**, review the Google API Services User Data Policy.
10. After obtaining organizational approval, select **I agree to the Google API Services: User Data Policy**.
11. Click **Continue**.
12. Click **Create**.

If the Google Auth platform was already configured, use its existing **Branding**, **Audience**, and **Data Access** pages.

1. Open **Data Access**.
2. Click **Add or Remove Scopes**.
3. Under **Manually add scopes**, paste `https://www.googleapis.com/auth/drive.readonly`.
4. Paste `https://www.googleapis.com/auth/drive.file`.
5. Click **Add to Table**.
6. Click **Update**.
7. Click **Save**.

If you selected **External** and the publishing status is **Testing**, add every connecting user:

1. Open **Audience**.
2. Under **Test users**, click **Add users**.
3. Enter every connecting user's email.
4. Click **Save**.

Testing authorizations expire after seven days. For durable External use, hand publication, verification, and any required security assessment to the application or cloud security owner.

<!-- screenshot: Data Access with both Drive scopes selected -->

### Create the OAuth client
1. Open `https://console.cloud.google.com/auth/clients/create`.
2. Set **Application type** to **Web application**.
3. In **Name**, enter a recognizable name such as `Speakeasy AI Control Plane`.
4. Under **Authorized redirect URIs**, click **+ Add URI**.
5. Paste `https://app.getgram.ai/mcp/remote_login_callback`.

Do not add **Authorized JavaScript origins**. Before the next action, prepare an approved secret store: the next dialog permits the client secret to be copied only once.

6. Click **Create**.

<!-- screenshot: Create client with the Web application type and redirect URI populated -->

### Copy the client credentials
1. In **OAuth 2.0 client created**, copy the **Client ID** to your approved secret store.
2. Under **Client secrets**, copy the **Client secret** to the same location.
3. Keep both values ready for [Speakeasy setup](#connect-speakeasy-credentials).

If you lose the client secret before connecting, delete it and create a new one.

<!-- screenshot-exception: do not capture live credentials -->

### Permit the OAuth app under Workspace policy if required
Complete this section only if Workspace app-access restrictions require approval of the OAuth client.

1. Sign in at `https://admin.google.com` as a **Service Settings administrator**.
2. Go to **Security** > **Access and data control** > **API controls**.
3. Click **Manage App Access**.
4. Under **Configured apps**, click **Configure new app**.
5. Enter the Client ID from [Copy the client credentials](#copy-client-credentials).
6. Click **Search**.
7. Select the matching result.
8. Under **Scope**, keep the top-level organization selected, or use **Select org units** > **Include organizations** to select the covered units.
9. Click **Continue**.
10. Under **Access to Google data**, have the application or cloud security owner choose the approved setting. **Trusted** permits all requested services, **Specific Google data** limits access to selected scopes, and **Limited** cannot permit the required `drive.readonly` scope.
11. Click **Continue**.
12. Review the setting.
13. Click **Finish**.

<!-- screenshot: the review screen with client identity, covered units, and approved access setting, without credential values -->

### Add the server in Speakeasy
1. In the Speakeasy AI Control Plane sidebar, under **Connect**, select **Sources**.
2. Click **Add Source**.
3. Choose **Custom remote server**.
4. On **Add a custom remote MCP server**, paste `https://drivemcp.googleapis.com/mcp/v1` into **Remote MCP server URL**.
5. Click **Add server**.

This creates the hosted MCP server and opens its **Overview** page.

<!-- screenshot: Add Source with Custom remote server selected -->

### Connect your credentials
1. From **Overview**, open **Settings**.
2. Under **Authentication**, click **Configure Manually**. If **Use Discovered** is offered, you may select it instead.
3. In **Attach Remote Identity Provider**, set **Client Type** to **Manual**.
4. Confirm that **Redirect URI** matches the `https://app.getgram.ai/mcp/remote_login_callback` value registered in [Create the OAuth client](#create-oauth-client).
5. Paste the **Client ID** from [Copy the client credentials](#copy-client-credentials).
6. Paste the **Client Secret (optional)** from the same section. Google's Web application flow requires the generated secret despite the optional field label.
7. Configure `https://www.googleapis.com/auth/drive.readonly` as a required scope.
8. Configure `https://www.googleapis.com/auth/drive.file` as a required scope.
9. Click **Attach Identity Provider**.

<!-- screenshot: the identity-provider sheet with credentials redacted -->

For more information, see Google's Drive MCP documentation at https://developers.google.com/workspace/drive/api/guides/configure-mcp-server.