Independent service identity: This is Workspace MCP by Robinson AI Systems, an independently operated connector for Google Workspace™; it is not made, operated, sponsored or endorsed by Google LLC. The stable native remote MCP URL is https://workspace.robinsonaisystems.com/api/mcp with service-owned OAuth. See direct client setup, brand decisions and pending verification. Existing connected client credentials and technical identifiers are not renamed. Public directory publication has not been approved.
Workspace MCP by Robinson AI Systems
v1 early-release fast track: The immediate target is a secure, verified standalone MCP product for invited, authorized Google users. v1 release readiness and pending original acceptance are separate from the ongoing exhaustive API coverage roadmap. Neither v1 nor public self-service is yet certified. No Hub runtime connection is required for standalone Workspace acceptance.
Hub compatibility: This server remains independently usable. Its coding agents should follow the shared Hub compatibility checklist and the linked canonical Hub RTC contract; Hub initiates discovery and keeps provider schemas out of the agent's default tool menu.
Roadmap status: P9 user authority and P10 parallel multi-user Google sign-in. P9 and P10-1..5/7 source engineering is merged; real P10-6 Google two-user custom-MCP pilot and public publication remain unaccepted. Owner and existing Hub TEST connections remain supported. The public pilot is OFF by default; do not interpret this README as launch approval. See P10 owner setup and pilot readiness.
A Claude connector that gives Claude real, working control over your Google Workspace — not just email and calendar, but the admin side too: creating/suspending users, managing groups, adding domains and aliases, pushing Chrome policies, running security audits, and more. a registry-verified tool catalog across every major Google Workspace service, and it can hold sign-ins for more than one mailbox (e.g. one per business on the same Workspace), with each Claude connection bound to the one you pick.
Built for one goal: you should be able to tell Claude what you want done in Google Workspace — in plain English — and have it actually happen, without you opening the admin console.
Roadmap and how to contribute
The implementation plan lives in docs/plan/: current
architecture, ordered task cards with acceptance checks, the test strategy,
and a paste-ready prompt for the implementing model (Claude Sonnet 5.5). Start
with docs/plan/README.md.
Developing
Use Node 24 (the version used by GitHub CI and the hosted Vercel project).
npm ci # install
npm run check # syntax check every source file, plus the "every changing tool is safe" check
npm test # unit tests (no real Google or production database calls)
npm run test:db # database tests; needs TEST_DATABASE_URL pointing at disposable local/CI Postgres
- Tests never call Google or the real database.
test/helpers/fake-google.js stands in for the Google clients and test/helpers/fake-db.js for src/db.js; test/contract/db-contract.js runs the same checks against both so the fake cannot drift from the real thing. Database tests work inside their own temporary schema and clean up after themselves.
- Never put a real token, passphrase or key in a test or a log. Tests use obviously fake values.
- Database changes must be additive (
IF NOT EXISTS); old and new code run against the same database at once.
- Keep pull requests coherent and keep the ledger row in
docs/plan/TASKS.md current in the same PR. Tightly related cards may be grouped when that reduces CI churn without weakening review or acceptance checks. The full rules are in docs/plan/.
- GitHub runs check, unit tests and database tests (on a throwaway Postgres) on every pull request.
Actual registered tool catalog
387 registered tools from the assembled server registry. The names below include read-only operations, guarded writes and five protected meta-tools; listing a tool does not grant permission to call it. For current descriptions, required inputs and account restrictions, use workspace_describe_tool.
| Area | Registered tools |
|---|
| admin | 112 |
| calendar | 24 |
| chat | 8 |
| chrome | 3 |
| datatransfer | 3 |
| dns | 3 |
| domain | 3 |
| files | 103 |
| identity | 5 |
| mail | 60 |
| people | 9 |
| tasks | 14 |
| workflows | 12 |
| workspace | 28 |
admin (112)
admin_action_chrome_deviceadmin_action_mobile_deviceadmin_add_domainadmin_add_domain_aliasadmin_add_group_aliasadmin_add_group_memberadmin_add_user_aliasadmin_create_buildingadmin_create_calendar_resourceadmin_create_featureadmin_create_groupadmin_create_orgunitadmin_create_roleadmin_create_role_assignmentadmin_create_schemaadmin_create_useradmin_delete_alertadmin_delete_aspadmin_delete_buildingadmin_delete_calendar_resourceadmin_delete_domainadmin_delete_domain_aliasadmin_delete_featureadmin_delete_groupadmin_delete_group_aliasadmin_delete_mobile_deviceadmin_delete_orgunitadmin_delete_roleadmin_delete_role_assignmentadmin_delete_schemaadmin_delete_tokenadmin_delete_useradmin_delete_user_aliasadmin_get_2sv_statusadmin_get_alertadmin_get_available_privilegesadmin_get_buildingadmin_get_calendar_resourceadmin_get_chrome_deviceadmin_get_customer_infoadmin_get_domainadmin_get_groupadmin_get_group_settingsadmin_get_mobile_deviceadmin_get_orgunitadmin_get_roleadmin_get_schemaadmin_get_token
calendar (24)
calendar_add_attendeecalendar_create_calendarcalendar_create_eventcalendar_create_recurring_eventcalendar_create_video_meetingcalendar_delete_calendarcalendar_delete_eventcalendar_dev_snapshotcalendar_get_eventcalendar_get_freebusycalendar_get_settingscalendar_list_aclcalendar_list_calendarscalendar_list_event_colorscalendar_list_event_instancescalendar_list_eventscalendar_move_eventcalendar_quick_addcalendar_set_event_colorcalendar_share_calendarcalendar_unshare_calendarcalendar_update_calendarcalendar_update_eventcalendar_verify_calendar_deletion
chat (8)
chat_add_memberchat_create_spacechat_delete_messagechat_get_spacechat_list_memberschat_list_messageschat_list_spaceschat_send_message
chrome (3)
chrome_list_policy_schemaschrome_resolve_policieschrome_set_policy
datatransfer (3)
datatransfer_get_transfer_statusdatatransfer_list_transfersdatatransfer_start_transfer
dns (3)
dns_add_recorddns_delete_recorddns_list_records
domain (3)
domain_confirm_verificationdomain_get_verification_tokendomain_list_verified
files (103)
docs_append_paragraphdocs_batch_updatedocs_create_documentdocs_create_named_rangedocs_delete_contentdocs_export_as_docxdocs_export_as_htmldocs_export_as_pdfdocs_get_documentdocs_get_textdocs_insert_imagedocs_insert_tabledocs_insert_textdocs_list_headingsdocs_replace_textdrive_copy_filedrive_create_docdrive_create_drive_label_assignmentdrive_create_folderdrive_create_shared_drivedrive_create_shortcutdrive_create_spreadsheetdrive_delete_filedrive_delete_revisiondrive_delete_shared_drivedrive_download_filedrive_empty_trashdrive_export_as_pdfdrive_export_filedrive_get_aboutdrive_get_filedrive_get_revisiondrive_get_shared_drivedrive_get_start_page_tokendrive_get_storage_quotadrive_list_changesdrive_list_filesdrive_list_permissionsdrive_list_recent_filesdrive_list_revisionsdrive_list_shared_drivesdrive_list_shared_with_medrive_list_starreddrive_list_trashdrive_move_filedrive_remove_permissiondrive_rename_filedrive_restore_from_trashdrive_search_files
identity (5)
identity_check_membershipidentity_get_security_settingsidentity_list_group_transitive_membershipidentity_list_policiesidentity_policy_audit
mail (60)
gmail_add_delegategmail_add_forwarding_addressgmail_batch_deletegmail_create_draftgmail_create_filtergmail_create_labelgmail_create_send_asgmail_delete_draftgmail_delete_filtergmail_delete_labelgmail_delete_messagegmail_delete_send_asgmail_delete_threadgmail_find_unansweredgmail_forward_messagegmail_get_attachmentgmail_get_draftgmail_get_filtergmail_get_forwarding_settingsgmail_get_imap_settingsgmail_get_labelgmail_get_messagegmail_get_message_bodygmail_get_pop_settingsgmail_get_profilegmail_get_threadgmail_get_vacation_settingsgmail_inbox_summarygmail_list_delegatesgmail_list_draftsgmail_list_filtersgmail_list_forwarding_addressesgmail_list_historygmail_list_labelsgmail_list_messagesgmail_list_send_asgmail_list_threadsgmail_mark_readgmail_mark_unreadgmail_modify_messagegmail_modify_threadgmail_remove_delegategmail_reply_to_threadgmail_searchgmail_send_draftgmail_send_emailgmail_send_with_attachmentgmail_trash_messagegmail_trash_thread
people (9)
contacts_createcontacts_deletecontacts_getcontacts_listcontacts_list_groupscontacts_searchcontacts_updatedirectory_list_peopledirectory_search_people
tasks (14)
tasks_clear_completedtasks_create_tasktasks_create_tasklisttasks_delete_tasktasks_delete_tasklisttasks_get_tasktasks_get_tasklisttasks_list_taskliststasks_list_taskstasks_move_tasktasks_replace_tasktasks_replace_tasklisttasks_update_tasktasks_update_tasklist
workflows (12)
workflow_add_domain_and_start_verificationworkflow_add_staff_memberworkflow_audit_external_sharingworkflow_brand_mailboxworkflow_email_healthworkflow_health_reportworkflow_offboard_employeeworkflow_onboard_employeeworkflow_search_presence_checkworkflow_security_snapshotworkflow_set_up_businessworkflow_weekly_digest
workspace (28)
workspace_admin_console_capabilitiesworkspace_admin_console_verifyworkspace_admin_overviewworkspace_batchworkspace_bulk_operationworkspace_business_calendarworkspace_business_foldersworkspace_callworkspace_delegation_statusworkspace_describe_toolworkspace_dev_check_integrationworkspace_dev_cleanupworkspace_dev_create_fixturesworkspace_dev_get_runworkspace_dev_list_runsworkspace_get_resultworkspace_list_accountsworkspace_list_connectionsworkspace_plan_summaryworkspace_recent_changesworkspace_remove_accountworkspace_revoke_connectionworkspace_search_toolsworkspace_set_allowed_domainsworkspace_set_default_accountworkspace_undo_changeworkspace_where_is_settingworkspace_whoami
The "workflow_*" tools are the ones worth knowing about specifically: instead of you (or Claude) stringing together six separate admin calls to offboard someone, workflow_offboard_employee does the whole checklist — suspend, sign out everywhere, revoke third-party app access, revoke app passwords, transfer their files, remove from all groups — in one call.
For a plain-English list of what to ask Claude for, see docs/OWNER-GUIDE.md.
How it runs
It runs hosted, on Vercel, with your login token stored in Neon (Postgres), so claude.ai can reach it from your phone, browser, anywhere. Setup is in DEPLOY.md. (The old "run on one computer" mode was retired; nothing in the hosted setup needed it.)
How it signs in to Google
- Your own sign-in (OAuth) — you log in once as yourself. If that account is a Workspace super admin, every admin tool works too.
- A separate robot identity (service account with domain-wide delegation) — lets a few tools act inside other people's mailboxes, calendars and Drive without each person logging in. Setup, including the exact permission list to paste into the Admin console, is in
DEPLOY.md (Part 5).
A few things worth knowing
-
Each connection stays in its own business. The admin tools (users, groups, domains, licenses, data transfer, Vault) refuse to touch an address or domain outside the domains allowed for the account the connection acts as. By default that is the account's own domain, so the Appliance Rentals connection cannot casually change AI Systems users. If a business has more than one domain, or you really want one connection to reach another, run workspace_set_allowed_domains (needs confirm: true), or pass crossDomain: true on a single call. It checks the addresses and domain names you give; a bare user ID or a list-everything call carries no domain and is not checked.
-
Safety on every tool that changes things. Guarded mutation tools accept dryRun: true for previews, and destructive or otherwise sensitive ones (everything that deletes, sends email or chat messages, suspends, resets, changes forwarding, access, roles, domains, security or licences) do nothing until you pass confirm: true. The assembled-registry semantic CI gate fails closed for unreviewed tool behavior rather than trusting a name or dryRun field. Some general tools only need confirm for risky uses: admin_update_user when it suspends, resets a password or changes admin rights; drive_share_file for public links; admin_update_group_settings when it opens a group to outsiders or the whole internet, switches message approval off or lets spam straight through; gmail_create_filter when it forwards; the bulk document/sheet/slide/form editors when they delete. confirmed in the result is true only if Google really shows what was asked for (null when nothing could be read back). After a change the tool asks Google what it now holds and returns that (plus whether it could confirm), and the change goes in the change log (workspace_recent_changes; previews are hidden unless includeDryRuns: true). The full list is the table in src/tools/guards.js.
-
Nothing here is placeholder code. Every tool calls the real Google API method it claims to. A handful of things Google's public APIs genuinely cannot do (some settings only exist in the admin console UI) are left out rather than faked. workspace_where_is_setting gives the console clicks for those.
-
Alert Center uses separate service-account authorization. Its tools require Google Admin domain-wide delegation for https://www.googleapis.com/auth/apps.alerts and the runtime opt-in described in DEPLOY.md. Google provides this API to all Workspace customers; ordinary user OAuth cannot authorize it. The scope permits read and write, so enabling it requires explicit owner approval. TEST read-only and guarded-write controls still apply. reports unavailable alert coverage when authorization is absent.
Robinson's Toolkit Hub / RTC 1
This standalone server retains its original POST /api/mcp and Google
OAuth interface. Its additional RTC 1 HTTPS doors expose
GET /api/contract, GET /api/tools, GET /api/tools/{name},
POST /api/tools/{name}, POST /api/tools/_batch,
GET /api/results/{handle}, GET /api/whoami and
GET /api/openapi.json. HTTPS requires a short-lived, owner-created
hashed TEST read-only pass. Existing MCP tool names are unchanged; HTTPS
uses collision-safe workspace_ aliases.
The RTC integration and shared conformance suites run in CI. Actual Hub
D-4 acceptance is complete: native audited Hub read, separate local direct,
GitHub-only encrypted relay and Vercel Sandbox direct routes passed, with
same-pass issuer revocation and temporary-infrastructure cleanup verified.
See the final route evidence
and Phase 8 ledger for exact revisions, UTC results and
retained limitations. These RTC meta/owner tools are additional to the
historical service-category counts above.
Developer integration readiness
For a connected app builder, workspace_dev_check_integration
checks requested Google API availability, currently granted OAuth
scopes, connected service-account client ID and declared delegated
scopes, plus optional Calendar IDs, Gmail labels/messages/threads, exact Drive
file/folder IDs, individual Tasks/list pairs, Chat space resource names,
Contacts/People resource names, and Docs/Sheets/Slides/Forms IDs, plus explicit Calendar reader/writer roles,
Google Drive folder capabilities, shared-drive membership roles, Gmail send-as
verification and exact Calendar free/busy windows, without changing Google data.
Only status findings are returned: message bodies, permissions details and busy
slots are not included. Each resource probe uses the existing scoped account,
metadata-only reads and exact provider-ID agreement; a mismatch, permission
denial or unavailable optional API is not declared ready. At most 24 additional
exact app resources and 24 explicit permission/capability requirements can be
probed in one call, plus up to 12 narrow Calendar availability windows. The
response includes total/ready/missing/not-readable counts, per-resource-type
and API-area breakdowns, and a bounded list of trusted Google Console remediation
links. Unsupported or unobservable authorizations remain not_readable. It returns observed ready, missing
and not_readable findings; Admin-console-only permissions remain
unverified until separately checked. This is a complete read-only
integration check, not fixture creation/cleanup; all three P8-7 fixture families are now implemented with exact-ID cleanup and crash reconciliation tests. Authorized Google TEST fixture acceptance and full Hub routes are accepted in the ledger; documented no-resource and owner-excluded live cases retain their stated limits.
Protected owner console readback (P8-8)
workspace_admin_console_capabilities helps an owner browse the 50 mapped Google Admin settings by category, search term and approved readback eligibility, without contacting Google or changing anything. All 24 existing reviewed readback mappings are eligible only when their exact required inputs, scope, profile and per-account restrictions pass; other topics stay manual. Discovery returns a reconciled per-category coverage table for the whole review set, not just the visible page. This inventory does not report that a console policy is active. workspace_admin_console_verify can then inspect up to 10 exact selected topics using guarded child reads, with independently enforced profile/area and explicit owner intent for customer-wide or other-business data. Use dryRun: true to preview eligibility without provider calls.
An owner may provide optional, reviewed boolean expectations for the selected mailbox settings; a matching exact read becomes matches_expected, and a mismatch becomes needs_attention without changing Google. A successful provider result is recorded as a narrow observed read, or observed_partial for customer-wide or bounded pages. Neither means the Admin console's effective organizational-unit policy, bought seats, external notification rules or every user was proven correct. Bad provider shapes, missing account permissions, foreign identifiers or unsupported topics are not green, and Google object data is never returned by the composed check. No settings can be changed through these two workflows.
Gmail Postmaster (read-only, owner-approved scope)
postmaster_list_domains and postmaster_list_traffic_stats use Google's Gmail Postmaster Tools v1 read-only API. They require the explicitly approved postmaster.readonly permission, which existing accounts must separately grant by reconnecting at /api/google/authorize; registration in the catalog is not consent or proof that a sending domain is verified. Missing traffic can reflect low volume or provider restrictions. A signed-in business-domain boundary is enforced for domain-targeted statistics. No Gmail message content is read, no delegated service-account scope was added, and no mail is sent.
Cloud Identity policy inspection (P7-2, read-only)
identity_list_policies lists explicitly configured organization policies; identity_policy_audit compares selected Gmail, Drive, Calendar and Chat settings against 21 documented, editable security/operations checks across seven areas in src/data/policy-baseline.json. Mismatches trigger attention, but missing, inherited, inaccessible or incomplete policy data is marked not_readable, never green. Policies apply to the Workspace customer, not directly to an email domain, and organizational-unit/group overrides matter. Consequently a business-restricted connection needs explicit crossDomain: true and owner authorization before reading customer-wide policies. Google requires a Super Admin, a supported Policy API setup, and new OAuth consent to cloud-identity.policies.readonly. The previously approved scope is not proof that any account has connected, or that an effective per-domain baseline has been verified.
Machine-readable read-only results (RTC P8-1)
Nine implemented read workflows now advertise validated MCP outputSchema and return structuredContent on full successful JSON responses. Added typed responses cover Reports multi-application activity, Postmaster registered domains and delivery metrics, Cloud Identity policy list and the policy baseline audit. Explicit fields projection still returns the selected JSON fields without pretending a partial object fulfills the full typed schema; detail: full keeps complete results, and large payloads use connection-owned, expiring retrieval handles. Error or missing-provider conditions cannot turn into typed success. The current source registry includes 387 tools after merged Tasks parity; count does not certify method completeness, a released revision, or live Google/provider acceptance.
Coding-agent development access (2026-10-13)
The implementing agent uses a renewable native OAuth connection, not a new copied RTC
pass for every retest. rtool developer-connect ALIAS --profile full prepares one mobile
link using the custom service. Choose the intended account/resources and authorize once;
return to chat without copying secrets. The agent reruns the command to finish privately,
then uses developer-check, developer-tools and developer-call. Existing original service
write previews, owner approvals and resource guards still apply. This developer workflow
does not reduce the finished product's tool capabilities.
On a managed POSIX cloud runner, configure RTOOL_DEVELOPER_VAULT_DIR to an absolute private
folder outside every Git checkout. The CLI creates a separate 0600 encryption key and
AES-GCM encrypted connection files in a 0700 folder; keep that private runner state for
resumes. OS credential managers remain the desktop default. Neither option places secrets
in chats, prompts, Git or shared artifacts. Initial provider consent or an expired/revoked
underlying authorization can still require a new owner sign-in. Source/tests are not
proof that the new deployed workflow has been exercised against the real provider.
