# mcp-google-multi Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 6.1.0 - **Author:** io.github.bakissation - **License:** MIT - **npm:** mcp-google-multi - **Source:** https://github.com/bakissation/mcp-google-multi - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** warnings - **Scanned:** 2026-10-22T07:30:23.317Z - **Version scanned:** 6.1.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `reports_activities_list` — List Admin Activity audit log entries. Filter by application (login, drive, gmail, admin, token, etc.), user, date range, event. The single most useful admin en - `admin_users_list` — List users in the Workspace customer. Filter by domain or customer=my_customer. - `admin_users_get` — Get a single Workspace user by email or user ID - `admin_users_update` — Update a Workspace user (PATCH semantics). Gated by write-control (a CUD tool). - `admin_groups_list` — List groups in the Workspace customer - `admin_group_members_list` — List members of a Workspace group - `analytics_account_summaries` — List every Google Analytics (GA4) account and property this Google account can access, with their numeric property IDs. The starting point for any Analytics que - `analytics_run_report` — Run a Google Analytics (GA4) report: metrics over a date range, optionally grouped by dimensions — the workhorse for questions like "how many users last week, b - `analytics_run_realtime_report` — Run a GA4 realtime report: who is on the site right now (last 30 minutes). Realtime supports a restricted set of names, e.g. metrics activeUsers, screenPageView - `analytics_get_metadata` — List every valid dimension and metric API name for a GA4 property, including its custom definitions. Call this before analytics_run_report when unsure which nam - `calendar_list_calendars` — List all calendars for a Google account - `calendar_list_events` — List events from a Google Calendar (trimmed view: descriptions capped, created/updated and empty fields omitted — use calendar_get_event for a full event) - `calendar_get_event` — Get a single Google Calendar event by ID - `calendar_create_event` — Create a Google Calendar event - `calendar_update_event` — Update a Google Calendar event - `calendar_respond_event` — RSVP to a calendar event as this account (accepted/declined/tentative) without touching any other attendee - `calendar_delete_event` — Delete a Google Calendar event - `calendar_quick_add` — Create a calendar event from a natural language string. Google parses date, time, title, and guests automatically. - `calendar_move_event` — Move an event from one calendar to another - `calendar_list_instances` — List all occurrences of a recurring calendar event (trimmed view like calendar_list_events — use calendar_get_event for a full event) - `calendar_get_freebusy` — Check free/busy times for one or more calendars within a time window. Returns only busy blocks, not event details. - `calendar_create_calendar` — Create a new calendar under the account - `chat_spaces_list` — List Google Chat spaces the user is a member of - `chat_spaces_get` — Get details about a single Chat space - `chat_messages_create` — Send a message into a Chat space. Supply plain text or a Card v2 in cardsV2. - `chat_messages_list` — List messages in a Chat space - `contacts_search` — Search contacts by name, email, phone, or organization - `contacts_resolve` — Resolve a free-text name/alias to ONE canonical email address (ranked + tie-broken), so you need not hand-expand transliteration OR-queries. Returns a single co - `contacts_get` — Get a single contact by resource name - `contacts_list` — List all contacts (paginated) - `contacts_create` — Create a new contact - `contacts_update` — Update an existing contact (reads current etag automatically) - `contacts_delete` — Delete a contact (permanent, cannot be undone) - `contacts_groups_list` — List all contact groups (labels) - `contacts_group_members` — List members of a contact group - `contacts_group_create` — Create a new contact group (label) - `docs_create` — Create a new Google Docs document - `docs_get` — Get document metadata (title, revision, named ranges). Optionally include tab content and choose a suggestionsViewMode. - `docs_read` — Read document content as plain text with a heading index (returns up to maxChars characters per call). Pass heading or headingIndex to read one section, tabId t - `docs_insert_text` — Insert text into a document at a specific position or at the end ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp-google-multi\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"mcp-google-multi\"\n ],\n \"env\": {\n \"GOOGLE_CLIENT_SECRET\": \"\",\n \"MASTER_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `GOOGLE_CLIENT_SECRET` — Google Client Secret (required) - `MASTER_KEY` — Master Key (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 2 credentials (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Critical blast radius — deletes data; holds an oauth grant. - Floor 61, ceiling 61 (tier: critical) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/mcp-google-multi - Install plan: https://forgeregistry.com/api/v1/packages/mcp-google-multi/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/mcp-google-multi - HTML page: https://forgeregistry.com/registry/mcp-google-multi - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.