Skip to content
Status

Google Sheets

Connect Google Sheets data through Google's hosted Sheets MCP server.

Use a Google Cloud project where you can enable services, grant project IAM roles, configure the Google Auth platform, and create OAuth credentials. You normally need Service Usage Admin or Owner to enable the APIs and Project IAM Admin to grant access. Each person who will connect needs access to the intended spreadsheets. Before setup, have the application or security owner configure prompt and response screening for malicious content or prompt injection.

Sign in to the Google Cloud console. In the console toolbar, use the resource selector to choose the project that will own this configuration. Keep the same project selected throughout setup.

Enable the Google Sheets APIs

  1. Open APIs & Services > API Library.
  2. In Search for APIs & Services, enter Google Sheets API.
  3. Open Google Sheets API.
  4. Click Enable. If the service is already enabled, leave it enabled.
  5. Reopen APIs & Services > API Library.
  6. In Search for APIs & Services, enter Google Sheets MCP API.
  7. Open Google Sheets MCP API.
  8. Click Enable. If the service is already enabled, leave it enabled.

Grant MCP Tool User access

  1. Go to IAM.
  2. Confirm that the same project is selected.
  3. Click Grant access.
  4. In New principals, enter the Google Account email address of a person who will connect through the Speakeasy AI Control Plane.
  5. Click Select a role.
  6. Search for MCP Tool User.
  7. Select MCP Tool User.
  8. Click Save.
  9. Repeat these steps for every person who will connect.

Google does not allow you to remove the OAuth consent screen after you configure it. Before continuing, confirm that you are working in the correct project.

  1. Open Google Auth platform > Branding.
  2. If Google Auth platform not configured yet appears, click Get Started.
  3. Under App Information, enter Sheets MCP Server in App name.
  4. In User support email, select a monitored email address. Obtain the correct value from the application or security owner if needed.
  5. Click Next.
  6. Under Audience, select Internal if every connecting user belongs to the project’s organization. Otherwise, select External.
  7. Click Next.
  8. Under Contact Information, enter a monitored Email address.
  9. Click Next.
  10. Under Finish, review the Google API Services User Data Policy with the application or security owner.
  11. If the owner approves the policy, select I agree to the Google API Services: User Data Policy.
  12. Click Continue.
  13. Click Create.

If the Google Auth platform was already configured, retain the approved Branding and Audience settings.

  1. Open Data Access.

  2. Click Add or Remove Scopes.

  3. Under Manually add scopes, paste these four URLs:

    https://www.googleapis.com/auth/drive.readonly
    https://www.googleapis.com/auth/drive.file
    https://www.googleapis.com/auth/spreadsheets.readonly
    https://www.googleapis.com/auth/spreadsheets

  4. Click Add to Table.

  5. Click Update.

  6. Click Save.

  7. If you selected an External audience in Testing, open Audience.

  8. Under Test users, click Add users.

  9. Enter each connecting user’s email address.

  10. Click Save.

An External audience in Testing supports up to 100 test users. Each authorization expires seven days after consent. When it expires, the user must complete browser authorization again.

Create the OAuth client

  1. Open Google Auth platform > Clients.

  2. Click Create client.

  3. In Application type, select Web application.

  4. In Name, enter a recognizable name such as Speakeasy AI Control Plane.

  5. Under Authorized redirect URIs, click + Add URI.

  6. In URIs, enter this value:

    https://app.getgram.ai/mcp/remote_login_callback

Before you click Create, prepare an approved secret store. The next dialog displays a client secret that can be copied only once.

  1. Click Create.

This opens OAuth 2.0 client created.

Copy the OAuth credentials

  1. In OAuth 2.0 client created, copy the Client ID to your approved secret store.
  2. Under Client secrets, copy the Client secret to the same store.

If you miss the one-time Client secret, delete it and create a new one before continuing.

Keep both values available, then connect your credentials in the Speakeasy AI Control Plane.

Add the server in Speakeasy

  1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.

  2. Click Add new to open Add MCP server.

  3. Choose Hosted remotely.

  4. On New remote MCP server, paste this URL into MCP server URL:

    https://sheetsmcp.googleapis.com/mcp/v1

  5. Click Verify connectivity, then Save.

This creates the hosted MCP server and opens its Overview page.

Connect your credentials

Open the server’s Settings (from Overview for a hosted remote server, or Configure MCP settings after a catalog addition).

Choose an authentication provider

  • If Authentication is unconfigured, choose Use Discovered when available; otherwise choose Configure Manually.
  • If authentication is configured but no provider is attached, use Connected services > Add provider.
  • If the intended provider is already attached, use its existing controls. Do not attach a duplicate; check its client against the requirements below and skip Verify and attach.

In Attach Remote Identity Provider, the provider selector defaults to Select existing when the project has issuers. Select the appropriate existing Google provider and skip new-provider setup.

New provider only

  1. Choose Add new and enter Issuer URL:

    https://accounts.google.com/

  2. Confirm the auto-derived Slug is unique in the project.

  3. Discovery runs automatically for a seeded issuer URL. After typing or changing the URL, click Discover only if offered.

  4. Review the endpoints, or enter these Google OAuth values if discovery does not populate them.

    Authorization endpoint:

    https://accounts.google.com/o/oauth2/v2/auth

    Token endpoint:

    https://oauth2.googleapis.com/token

Choose a session client

  • Reuse: Under Session Client, choose Select existing when available and select the appropriate Google OAuth client. Skip credential entry; continue to Check client requirements.
  • Create: Choose Add new when available and set Client Type to Manual. For a new provider, complete the new-client form below.

New session client only

  1. In Client ID, paste the Client ID from Copy the OAuth credentials.
  2. In Client Secret (optional), paste the Client secret from the same step. Google requires this generated secret.

Check client requirements

For both new and reused clients, verify the Google app’s approved audience and publishing status. An External app in Testing must list each connecting account under Test users. Reusing a client does not require entering its credentials again.

Confirm the selected client includes the required scopes below. For a new client, configure Scope (override); for a reused client, inspect the read-only Scope value. If it does not match, choose Add new to create a correctly scoped client; the attach sheet cannot edit a reused client.

For a new client, enter this value:

https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/spreadsheets.readonly,https://www.googleapis.com/auth/spreadsheets

Verify and attach

  1. Confirm that the callback URL registered with the provider is https://app.getgram.ai/mcp/remote_login_callback. For a new manual client, also compare it with the sheet’s displayed Redirect URI. The existing-client selection does not display that field; check the registered callback in the provider’s app settings instead.
  2. Click Attach Identity Provider.

For the provider-side callback setting, see Create the OAuth client.

At first connection, complete Google’s browser authorization with an account granted MCP Tool User and access to the intended spreadsheets.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Google’s Sheets MCP documentation.