Google Workspace MCP serverLive
A self-hosted Model Context Protocol server that gives Claude scoped, multi-account access to Gmail and Calendar — with encrypted tokens, dry-run-by-default bulk actions, and a click-to-add account flow.
Off-the-shelf MCP servers for Google usually assume one account and store tokens in plain files. This one was written from scratch to be the connector a security person would be comfortable running.
Design
- Streamable HTTP transport at a single
/mcpendpoint, which is what Claude's custom connectors require. Guarded by a bearer token. - Multi-account from day one. Each Google account is a row in SQLite with its refresh token encrypted at rest under AES-256-GCM. Access tokens are minted on demand and never persisted.
- Onboarding is a web page. A password-protected
/setuppage lists connected accounts and runs the OAuth consent flow. Adding the Nth account is a click, not a redeploy. - Every tool takes an
accountparameter that accepts a specific account, orallto fan out and merge results with source tags. - Read, write, and destructive tiers. Bulk operations are dry-run by default and return what they would do before they do it. Query construction is guarded against injection through tool arguments.
- Minimum scopes, centralized in one place so adding a service is one edit.
Where it runs
On the same Mac mini as Athena, behind a Cloudflare Tunnel, with the human-facing setup path protected by Cloudflare Access and the machine-facing endpoint protected by the bearer token. Athena consumes it over loopback for its calendar and inbox collectors; Claude consumes it as a connector for scheduling and mailbox cleanup.
Why it matters for clients
It is the template for every "let the assistant touch a real system" engagement: strict schemas, scoped credentials, encrypted storage, an audit trail, and a way for a non-engineer to onboard without a terminal.