Google People

The People API MCP server is in the Google Workspace Developer Preview Program. You need a Google Workspace account that can be added to Google Groups and a Google Cloud project that your organization can register in the program. To enable the People API, you need serviceusage.services.enable, normally through Service Usage Admin or Owner. To grant project roles, you need Project IAM Admin. Each connecting user must already have access to the intended Google profile, contacts, and directory data. Google documents that application developers are responsible for screening prompts and responses for malicious content or prompt injection; Model Armor is one documented option.

Join the Google Workspace Developer Preview Program

1. Open developers.google.com/workspace/preview.
2. Review the Developer Preview Program Terms with the application or security owner.
3. Click Apply to join the Developer Preview Program.
4. In the current application form, enter the requested Google Workspace account and Google Cloud project information.
5. Agree to the terms only with organizational approval.
6. Submit the form with the visible or equivalent submission control. Google verifies the Workspace account, adds it to the program group, and then registers the Cloud project.
7. Wait for the final project-registration confirmation at the submitted email address. Google says this should complete within a couple of days.

Enable the People API

1. Sign in to the Google Cloud console.
2. In the console toolbar, use the resource selector to select the project registered in the Developer Preview Program.
3. Open APIs & Services > API Library.
4. In Search for APIs & Services, search for People API.
5. Open People API.
6. Click Enable. If the API is already enabled, continue to the next section.

Grant MCP Tool User access

Repeat these steps for every person who will connect Google People.

1. Open the project’s IAM page.
2. Confirm that the same project is selected.
3. Click Grant access.
4. In New principals, enter the connecting user’s Google Account email.
5. Click Select a role.
6. Search for MCP Tool User.
7. Select MCP Tool User.
8. Click Save.

Configure the OAuth consent screen

Google does not allow an OAuth consent screen to be removed after it is configured. Confirm that you are using the intended project before continuing.

1. Open Google Auth platform > Branding.
2. If the page shows Google Auth platform not configured yet, click Get Started.

If Google Auth platform was already configured, retain its approved Branding. Retain its Audience only if it covers every intended connecting account. Internal qualifies only when all those accounts are in the Google Cloud organization associated with the project; otherwise use an approved External configuration. Then continue at step 14. Otherwise, complete the first-time wizard:

3. Under App Information, enter People API MCP Server in App name.

4. Select a monitored User support email.

5. Click Next.

6. Under Audience, select Internal only if every intended connecting account is in the Google Cloud organization associated with the project. Otherwise, use an approved External configuration.

7. Click Next.

8. Under Contact Information, enter a monitored Email address.

9. Click Next.

10. Under Finish, review the Google API Services User Data Policy with the application or security owner.

11. With their approval, select I agree to the Google API Services: User Data Policy.

12. Click Continue.

13. Click Create.

14. Open Data Access.

15. Click Add or Remove Scopes.

16. Under Manually add scopes, paste these three scope URLs:

    https://www.googleapis.com/auth/directory.readonly
    https://www.googleapis.com/auth/userinfo.profile
    https://www.googleapis.com/auth/contacts.readonly

17. Click Add to Table.

18. Click Update.

19. Click Save.

An External app in Testing supports no more than 100 test users. Use this branch only when every intended connecting account fits within that ceiling:

20. Open Audience.
21. Under Test users, click Add users.
22. Enter each connecting user’s email.
23. Click Save.

Create the OAuth client

1. Open Google Auth platform > Clients.

2. Click Create client.

3. In Application type, select Web application.

4. In Name, enter a recognizable name such as Speakeasy AI Control Plane.

5. Under Authorized redirect URIs, click + Add URI.

6. In URIs, enter this value:

   https://ai.speakeasy.com/mcp/remote_login_callback

Prepare an approved secret store before the next step. The next dialog allows the client secret to be copied only once.

7. Click Create. This opens OAuth 2.0 client created.

Copy the OAuth credentials

1. In OAuth 2.0 client created, copy Client ID to the approved secret store.
2. Under Client secrets, copy Client secret to the same store.
3. Keep both values for connecting your credentials.
4. Return to the Speakeasy AI Control Plane.

If you miss the one-time secret, return to Google Auth platform > Clients. Delete the affected OAuth client using its visible or equivalent delete control. Repeat Create the OAuth client and this credential-copy section before continuing.

Add the server in Speakeasy

1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.
2. Click Add new to open Add MCP server.

• If Google People is in the catalog:
  1. Choose From the catalog.
  2. On the MCP Catalog page, find Google People in Search MCP servers….
  3. Open the matching entry.
  4. Click Add.
  5. In Add to Project, under Identity, select User Identity.
  6. Click Add to Project. If a Guardrails step appears, click Skip for now.
  7. When the dialog finishes, the result reads “Added, but disabled until identity is set up.” Click Finish setup to open the server’s Settings.
• If no matching catalog entry is available:

  1. Choose Hosted remotely.

  2. On New remote MCP server, paste this URL into MCP server URL:

     https://people.googleapis.com/mcp/v1

  3. Leave User session issuer at its default.

  4. Click Verify connectivity.

  5. Under Identity, select User Identity. The page preselects No Identity for this server, so change it.

  6. If Guardrails appears, leave it off.

  7. Click Save.

Either way, Speakeasy keeps the new server Disabled and says to finish setup in Settings > Identity. This is expected for Google People; the next section finishes it.

Connect your credentials

Open the server’s Settings and find the Identity section.

1. Select User Identity.

2. In Choose an identity provider, confirm that the preselected provider is Google’s issuer, https://accounts.google.com/. It is badged Will be created when the project has no Google provider yet. If another provider is selected, open the picker, search in Search identity providers…, and choose the Google provider.

3. Under the provider, choose Manual. If Existing client is preselected, switch to Manual.

4. Paste the Client ID from the OAuth credentials into Client ID.

5. Paste the Client Secret from the OAuth credentials into Client secret. Google requires the secret even though the field shows “Optional”.

6. Open Advanced. In Scope, enter this value on one line:

   https://www.googleapis.com/auth/directory.readonly https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/contacts.readonly

7. Click Save. If Speakeasy asks you to confirm, click Save changes.

8. Open Settings > Danger Zone > Server Availability.

9. Turn on Enable MCP server so the switch shows Enabled.

The callback Speakeasy uses is the https://ai.speakeasy.com/mcp/remote_login_callback value you registered in Create the OAuth client.

At first connection, follow Google’s visible or equivalent browser authorization controls with an account that has MCP Tool User access.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Google’s People API MCP documentation.