google-mcp

Multi-account Google MCP server exposing Gmail and Calendar read tools over stdio.

Security notes

• credentials.json is local-only and must never be committed.
• Copy credentials.template.json to credentials.json and fill it with your local OAuth client values.
• Refresh tokens are stored in your OS keychain (keyring), not in source control.

Setup

1. Install dependencies:
   • uv sync
2. Create local OAuth client config:
   • cp credentials.template.json credentials.json
3. Set expected account emails (optional but recommended for auth safety checks):
   • export GOOGLE_MCP_PERSONAL_EMAIL="you@example.com"
   • export GOOGLE_MCP_WORK_EMAIL="you@company.com"
4. Optionally set a specific work calendar filter:
   • export GOOGLE_MCP_WORK_CALENDAR="calendar-id-or-summary"
5. Authorize each account:
   • uv run auth_setup.py personal
   • uv run auth_setup.py work

Run server

• uv run server.py

Integration tests

These hit real Google APIs.

• Basic live tests:
  • RUN_LIVE_TESTS=1 uv run integration_smoke.py
• Include destructive keychain mutation test:
  • RUN_LIVE_TESTS=1 RUN_DESTRUCTIVE_TESTS=1 uv run integration_smoke.py

Publish safety checks

• Run local security guardrail:
  • python scripts/security_check.py
• Optional pre-commit integration:
  • uv tool install pre-commit
  • pre-commit install
  • pre-commit run --all-files
• CI runs the same script on every push/PR via .github/workflows/security-check.yml.