Google Drive MCP server

google-drive-mcp

Google Drive as MCP tools. Find, organise, share and move files, and follow what changed.

A single Go binary that speaks Model Context Protocol over stdio. It runs as a subprocess of your client, on your own machine, one Google account per profile: find files and know where they live and who can see them, organise folders, move and copy, get content in and out, share without widening access by accident, follow what changed, and manage shared drives.

Why google-drive-mcp

Drive is where the file lives, and most of what goes wrong with a file is about the boundary rather than the contents: where it sits, who can already see it, what widening a share would actually widen, and what changed since you last looked. This server works at that boundary and stops there — what is inside a Doc, Sheet or Slides deck belongs to servers built on those APIs, and this one says so rather than guessing through an export.

It runs as you, against a Google Cloud project you own, so nothing here is tied to any particular organisation or account. Every tool below is verified against a real Google Workspace account as well as against the in-memory Drive the tests use — the five that remove something for good included, which run inside a shared drive the live driver creates and destroys again. Four paths are not, because each needs a second account or an administrator to exercise: handing over ownership, opening a link-shared file that needs its resource key, a share an organisation's policy refuses, and applying a label. §17a of docs/architecture.md says what stands in for each.

Install

go install github.com/mmedum/google-drive-mcp/cmd/google-drive-mcp@latest

That puts the binary in Go's bin directory, which is often not on your PATH. If the next command says command not found, either use the full path or add the directory once:

"$(go env GOPATH)/bin/google-drive-mcp" --version    # check it landed
export PATH="$(go env GOPATH)/bin:$PATH"             # or add it to your shell profile

Or take a signed archive from the latest release — Linux, macOS and Windows, on amd64 and arm64 — and put the binary on your PATH. Every archive carries the binary, LICENSE and this README. Nothing about a release has to be taken on trust:

# --ignore-missing, because checksums.txt covers every archive and you
# will have downloaded one of them.
sha256sum -c checksums.txt --ignore-missing

# checksums.txt is signed with a keyless Sigstore certificate tied to the
# release workflow's identity; the bundle carries the signature and the
# certificate together.
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp '^https://github.com/mmedum/google-drive-mcp' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# And each archive carries build provenance naming the workflow and tag
# that produced it.
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

Every archive also ships an SBOM, so you can see what is inside a binary you did not build.

Claude Desktop

Shortened. The full README is on GitHub.