MCP server for the Google Apps Script API: projects, code, versions, deployments and executions.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
GOOGLE_APPS_SCRIPT_CLIENT_SECRETOAuth appoptionalGoogle OAuth2 client secret (refresh-token flow). Treat it as a secret.
GOOGLE_APPS_SCRIPT_REFRESH_TOKENOAuth appoptionalGoogle OAuth2 refresh token, exchanged for access tokens automatically. Treat it as a secret.
GOOGLE_APPS_SCRIPT_ACCESS_TOKENAPI keyoptionalStatic OAuth2 access token (~1h lifetime) — alternative to the refresh-token trio, mostly for testing.
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
manage_deploymentsNo description publishedThis tool published no description. Forge does not invent one.
run_functionNo description publishedThis tool published no description. Forge does not invent one.
list_processesNo description publishedThis tool published no description. Forge does not invent one.
create_projectNo description publishedThis tool published no description. Forge does not invent one.
get_projectReturns the project's metadata: title, scriptId, parentId (present only for bound projects), creator, lastModifyUser, createTime and updateTime. No code is included — use get_project_content for the files. Useful to verify a scriptId exists and check whether the project is standalone or bound.Returns the project's metadata: title, scriptId, parentId (present only for bound projects), creator, lastModifyUser, createTime and updateTime. No code is included — use get_project_content for the files. Useful to verify a scriptId exists and check whether the project is standalone or bound.
No input schema was published for this tool.
get_project_contentReturns the project's full file set: files[] with name (no extension), type (SERVER_JS = .gs code, HTML, JSON = the "appsscript" manifest), source, and per-file update info. By default HEAD (the latest saved code) is returned; version_number returns the content of that immutable version instead. Ca…Returns the project's full file set: files[] with name (no extension), type (SERVER_JS = .gs code, HTML, JSON = the "appsscript" manifest), source, and per-file update info. By default HEAD (the latest saved code) is returned; version_number returns the content of that immutable version instead. Ca…
No input schema was published for this tool.
update_project_contentNo description publishedThis tool published no description. Forge does not invent one.
get_project_metricsReturns execution metrics for the project: activeUsers, totalExecutions and failedExecutions as time series ({ value, startTime, endTime }; value is absent when zero). granularity daily covers the last 7 days, weekly aggregates by week. deployment_id narrows the numbers to one deployment. A rising…Returns execution metrics for the project: activeUsers, totalExecutions and failedExecutions as time series ({ value, startTime, endTime }; value is absent when zero). granularity daily covers the last 7 days, weekly aggregates by week. deployment_id narrows the numbers to one deployment. A rising…
No input schema was published for this tool.
raw_requestNo description publishedThis tool published no description. Forge does not invent one.
setup_instructionsNo description publishedThis tool published no description. Forge does not invent one.
create_versionSnapshots the project's current HEAD content as a new immutable version and returns it (versionNumber, description, createTime). Versions cannot be edited or deleted, and version numbers only grow — every call creates a NEW version, so do not re-send after an ambiguous failure without checking list…Snapshots the project's current HEAD content as a new immutable version and returns it (versionNumber, description, createTime). Versions cannot be edited or deleted, and version numbers only grow — every call creates a NEW version, so do not re-send after an ambiguous failure without checking list…
No input schema was published for this tool.
list_versionsLists the project's immutable versions (versionNumber, description, createTime), newest first. Paginate with page_token from nextPageToken. Use it to pick a versionNumber for manage_deployments or to read old code via get_project_content with version_number.Lists the project's immutable versions (versionNumber, description, createTime), newest first. Paginate with page_token from nextPageToken. Use it to pick a versionNumber for manage_deployments or to read old code via get_project_content with version_number.
No input schema was published for this tool.
get_versionFetches one immutable version by its number: versionNumber, description and createTime. For the code of that version call get_project_content with version_number instead — this endpoint returns metadata only.Fetches one immutable version by its number: versionNumber, description and createTime. For the code of that version call get_project_content with version_number instead — this endpoint returns metadata only.
No input schema was published for this tool.
6 of 13 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
MCP server for the Google Apps Script API: projects, code, versions, deployments and executions.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
55 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+43 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.