Google People

You need a Google Cloud project and access to the Google Cloud console. To enable the People API, you need serviceusage.services.enable, normally through Service Usage Admin or Owner. To grant project roles, you need Project IAM Admin. Each connecting user must already have access to the intended Google profile, contacts, and directory data. Google documents that application developers are responsible for screening prompts and responses for malicious content or prompt injection; Model Armor is one documented option.

Enable the People API

Sign in to the Google Cloud console.
In the console toolbar, use the resource selector to select the project that will own this configuration.
Open APIs & Services > API Library.
In Search for APIs & Services, search for People API.
Open People API.
Click Enable. If the API is already enabled, continue to the next section.

Grant MCP Tool User access

Repeat these steps for every person who will connect Google People.

Open the project’s IAM page.
Confirm that the same project is selected.
Click Grant access.
In New principals, enter the connecting user’s Google Account email.
Click Select a role.
Search for MCP Tool User.
Select MCP Tool User.
Click Save.

Google does not allow an OAuth consent screen to be removed after it is configured. Confirm that you are using the intended project before continuing.

Open Google Auth platform > Branding.
If the page shows Google Auth platform not configured yet, click Get Started.

If Google Auth platform was already configured, retain its approved Branding. Retain its Audience only if it covers every intended connecting account. Internal qualifies only when all those accounts are in the Google Cloud organization associated with the project; otherwise use an approved External configuration. Then continue at step 14. Otherwise, complete the first-time wizard:

Under App Information, enter People API MCP Server in App name.
Select a monitored User support email.
Click Next.
Under Audience, select Internal only if every intended connecting account is in the Google Cloud organization associated with the project. Otherwise, use an approved External configuration.
Click Next.
Under Contact Information, enter a monitored Email address.
Click Next.
Under Finish, review the Google API Services User Data Policy with the application or security owner.
With their approval, select I agree to the Google API Services: User Data Policy.
Click Continue.
Click Create.
Open Data Access.
Click Add or Remove Scopes.

Under Manually add scopes, paste these three scope URLs:

https://www.googleapis.com/auth/directory.readonly
https://www.googleapis.com/auth/userinfo.profile
https://www.googleapis.com/auth/contacts.readonly

Click Add to Table.
Click Update.
Click Save.

An External app in Testing supports no more than 100 test users. Use this branch only when every intended connecting account fits within that ceiling:

Open Audience.
Under Test users, click Add users.
Enter each connecting user’s email.
Click Save.

Create the OAuth client

Open Google Auth platform > Clients.
Click Create client.
In Application type, select Web application.
In Name, enter a recognizable name such as Speakeasy AI Control Plane.
Under Authorized redirect URIs, click + Add URI.

In URIs, enter this value:

https://app.getgram.ai/mcp/remote_login_callback

Prepare an approved secret store before the next step. The next dialog allows the client secret to be copied only once.

Click Create. This opens OAuth 2.0 client created.

Copy the OAuth credentials

In OAuth 2.0 client created, copy Client ID to the approved secret store.
Under Client secrets, copy Client secret to the same store.
Keep both values for connecting your credentials.
Return to the Speakeasy AI Control Plane.

If you miss the one-time secret, return to Google Auth platform > Clients. Delete the affected OAuth client using its visible or equivalent delete control. Repeat Create the OAuth client and this credential-copy section before continuing.

Add the server in Speakeasy

In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.
Click Add new to open Add MCP server.

If Google People is in the catalog:
1. Choose From the catalog.
2. On the MCP Catalog page, find Google People in Search MCP servers….
3. Open the matching entry.
4. Click Add.
5. In Add to Project, click Add to Project.
If no matching catalog entry is available:
1. Choose Hosted remotely.
2. On New remote MCP server, paste this URL into MCP server URL:
```
https://people.googleapis.com/mcp/v1
```
3. Click Verify connectivity, then Save.

For the catalog path, click Configure MCP settings on the completion screen to open the server, then open Settings. The Hosted remotely path opens Overview after Save; open Settings there.

Connect your credentials

Open the server’s Settings (from Overview for a hosted remote server, or Configure MCP settings after a catalog addition).

Choose an authentication provider

If Authentication is unconfigured, choose Use Discovered when available; otherwise choose Configure Manually.
If authentication is configured but no provider is attached, use Connected services > Add provider.
If the intended provider is already attached, use its existing controls. Do not attach a duplicate; check its client against the requirements below and skip Verify and attach.

In Attach Remote Identity Provider, the provider selector defaults to Select existing when the project has issuers. Select the appropriate existing Google provider and skip new-provider setup.

New provider only

Choose Add new and enter Issuer URL:
```
https://accounts.google.com/
```
Confirm the auto-derived Slug is unique in the project.
Discovery runs automatically for a seeded issuer URL. After typing or changing the URL, click Discover only if offered.
Review the endpoints, or enter these Google OAuth values if discovery does not populate them.

Authorization endpoint:
```
https://accounts.google.com/o/oauth2/v2/auth
```
Token endpoint:
```
https://oauth2.googleapis.com/token
```

Choose a session client

Reuse: Under Session Client, choose Select existing when available and select the appropriate Google OAuth client. Skip credential entry; continue to Check client requirements.
Create: Choose Add new when available and set Client Type to Manual. For a new provider, complete the new-client form below.

New session client only

Paste the Client ID from the OAuth credentials.
Paste the Client Secret (optional) from the OAuth credentials. Google requires this secret even though the field is labeled optional.

Check client requirements

For both new and reused clients, verify the Google app’s approved audience and publishing status. An External app in Testing must list each connecting account under Test users. Reusing a client does not require entering its credentials again.

Confirm the selected client includes the required scopes below. For a new client, configure Scope (override); for a reused client, inspect the read-only Scope value. If it does not match, choose Add new to create a correctly scoped client; the attach sheet cannot edit a reused client.

For a new client, enter these three identifiers using the field’s visible or equivalent multi-scope format:

https://www.googleapis.com/auth/directory.readonly
https://www.googleapis.com/auth/userinfo.profile
https://www.googleapis.com/auth/contacts.readonly

Verify and attach

Confirm that the callback URL registered with the provider is https://app.getgram.ai/mcp/remote_login_callback. For a new manual client, also compare it with the sheet’s displayed Redirect URI. The existing-client selection does not display that field; check the registered callback in the provider’s app settings instead.
Click Attach Identity Provider.

For the provider-side callback setting, see created the OAuth client.

At first connection, follow Google’s visible or equivalent browser authorization controls with an account that has MCP Tool User access.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Google’s People API MCP documentation.