Skip to content

Commit ea1b30a

Browse files
walker-txwalker-tx
authored
Merge pull request #71 from speakeasy-api/guide/issue-68-google-drive
guide: Google Drive
2 parents bfa7c24 + a9a784d commit ea1b30a

6 files changed

Lines changed: 897 additions & 0 deletions

File tree

‎guides/google-drive/external.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
setup_version: 1
3+
---
4+
5+
# Set up Google Drive
6+
7+
Use a Google Cloud project where you can enable services, configure the Google Auth platform, create credentials, and grant project roles. You need **Service Usage Admin** or **Owner** to enable the APIs and appropriate IAM administration access to grant **MCP Tool User**. Every connecting user needs a Google Account with access to the intended Drive files.
8+
9+
Sign in at `https://console.cloud.google.com` and select the project that will own the APIs and credentials. If your organization restricts high-risk Drive scopes, arrange access to a **Service Settings administrator** and obtain an approved app-access setting from the application or cloud security owner.
10+
11+
### Enable the Google Drive API {#enable-drive-api}
12+
13+
1. Open `https://console.cloud.google.com/flows/enableapi?apiid=drive.googleapis.com`.
14+
2. Confirm the intended project if prompted.
15+
3. Click **Enable**. If the API is already enabled, continue to the next section.
16+
17+
<!-- screenshot: Google Drive API with Enable, or its enabled state -->
18+
19+
### Enable the Google Drive MCP API {#enable-drive-mcp-api}
20+
21+
1. Open `https://console.cloud.google.com/flows/enableapi?apiid=drivemcp.googleapis.com`.
22+
2. Confirm the intended project if prompted.
23+
3. Click **Enable**. If the API is already enabled, continue to the next section.
24+
25+
<!-- screenshot: Google Drive MCP API with Enable, or its enabled state -->
26+
27+
### Grant the MCP Tool User role {#grant-mcp-tool-user}
28+
29+
1. Open `https://console.cloud.google.com/iam-admin/iam`.
30+
2. Select the same project.
31+
3. Click **Grant access**.
32+
4. In **New principals**, enter the Google Account email of a user who will connect from the Speakeasy AI Control Plane.
33+
5. Click **Select a role**.
34+
6. Search for `MCP Tool User`.
35+
7. Select **MCP Tool User**.
36+
8. Click **Save**.
37+
9. Repeat these steps for every connecting user.
38+
39+
Existing Drive sharing and Workspace policy determine which files each user can access.
40+
41+
<!-- screenshot: Grant access with the principal and MCP Tool User -->
42+
43+
### Configure the OAuth consent screen {#configure-oauth-consent}
44+
45+
Google does not permit an OAuth consent screen to be removed after it is configured.
46+
47+
Open `https://console.cloud.google.com/auth/branding`.
48+
49+
If **Google Auth platform not configured yet** appears, complete the first-time configuration:
50+
51+
1. Click **Get Started**.
52+
2. Under **App Information**, enter `Drive MCP Server` in **App name**.
53+
3. Select an approved **User support email**.
54+
4. Click **Next**.
55+
5. Under **Audience**, select **Internal** if every connecting account belongs to the project's Workspace organization. Otherwise, select **External**.
56+
6. Click **Next**.
57+
7. Under **Contact Information**, enter an approved **Email address**.
58+
8. Click **Next**.
59+
9. Under **Finish**, review the Google API Services User Data Policy.
60+
10. After obtaining organizational approval, select **I agree to the Google API Services: User Data Policy**.
61+
11. Click **Continue**.
62+
12. Click **Create**.
63+
64+
If the Google Auth platform was already configured, use its existing **Branding**, **Audience**, and **Data Access** pages.
65+
66+
1. Open **Data Access**.
67+
2. Click **Add or Remove Scopes**.
68+
3. Under **Manually add scopes**, paste `https://www.googleapis.com/auth/drive.readonly`.
69+
4. Paste `https://www.googleapis.com/auth/drive.file`.
70+
5. Click **Add to Table**.
71+
6. Click **Update**.
72+
7. Click **Save**.
73+
74+
If you selected **External** and the publishing status is **Testing**, add every connecting user:
75+
76+
1. Open **Audience**.
77+
2. Under **Test users**, click **Add users**.
78+
3. Enter every connecting user's email.
79+
4. Click **Save**.
80+
81+
Testing authorizations expire after seven days. For durable External use, hand publication, verification, and any required security assessment to the application or cloud security owner.
82+
83+
<!-- screenshot: Data Access with both Drive scopes selected -->
84+
85+
### Create the OAuth client {#create-oauth-client}
86+
87+
1. Open `https://console.cloud.google.com/auth/clients/create`.
88+
2. Set **Application type** to **Web application**.
89+
3. In **Name**, enter a recognizable name such as `Speakeasy AI Control Plane`.
90+
4. Under **Authorized redirect URIs**, click **+ Add URI**.
91+
5. Paste `{{ gram.oauth.callback_url }}`.
92+
93+
Do not add **Authorized JavaScript origins**. Before the next action, prepare an approved secret store: the next dialog permits the client secret to be copied only once.
94+
95+
6. Click **Create**.
96+
97+
<!-- screenshot: Create client with the Web application type and redirect URI populated -->
98+
99+
### Copy the client credentials {#copy-client-credentials}
100+
101+
1. In **OAuth 2.0 client created**, copy the **Client ID** to your approved secret store.
102+
2. Under **Client secrets**, copy the **Client secret** to the same location.
103+
3. Keep both values ready for [Speakeasy setup](speakeasy.md#connect-speakeasy-credentials).
104+
105+
If you lose the client secret before connecting, delete it and create a new one.
106+
107+
<!-- screenshot-exception: do not capture live credentials -->
108+
109+
### Permit the OAuth app under Workspace policy if required {#permit-workspace-app}
110+
111+
Complete this section only if Workspace app-access restrictions require approval of the OAuth client.
112+
113+
1. Sign in at `https://admin.google.com` as a **Service Settings administrator**.
114+
2. Go to **Security** > **Access and data control** > **API controls**.
115+
3. Click **Manage App Access**.
116+
4. Under **Configured apps**, click **Configure new app**.
117+
5. Enter the Client ID from [Copy the client credentials](#copy-client-credentials).
118+
6. Click **Search**.
119+
7. Select the matching result.
120+
8. Under **Scope**, keep the top-level organization selected, or use **Select org units** > **Include organizations** to select the covered units.
121+
9. Click **Continue**.
122+
10. Under **Access to Google data**, have the application or cloud security owner choose the approved setting. **Trusted** permits all requested services, **Specific Google data** limits access to selected scopes, and **Limited** cannot permit the required `drive.readonly` scope.
123+
11. Click **Continue**.
124+
12. Review the setting.
125+
13. Click **Finish**.
126+
127+
<!-- screenshot: the review screen with client identity, covered units, and approved access setting, without credential values -->

‎guides/google-drive/meta.yaml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# yaml-language-server: $schema=../../schema/guide.v1.schema.json
2+
schema_version: 1
3+
slug: google-drive
4+
title: Google Drive
5+
summary: Connect Google's hosted Drive MCP server to read and create files under each user's existing Drive permissions.
6+
credential_setup:
7+
options:
8+
- id: oauth-client
9+
kind: oauth
10+
client_registration: manual
11+
fields:
12+
- id: client-id
13+
label: OAuth client ID
14+
setup:
15+
- external.md#create-oauth-client
16+
- external.md#copy-client-credentials
17+
- id: client-secret
18+
label: OAuth client secret
19+
setup:
20+
- external.md#create-oauth-client
21+
- external.md#copy-client-credentials
22+
requirements:
23+
- id: google-cloud-project
24+
description: A Google Cloud project whose administrator can enable the Google Drive API and Google Drive MCP API, configure the Google Auth platform, create OAuth credentials, and grant connecting users the MCP Tool User role
25+
- id: workspace-policy-access
26+
description: Google accounts with access to the intended Drive files and, when high-risk Drive scopes are restricted, a Workspace Service Settings administrator who can approve the OAuth client
27+
documentation:
28+
external: external.md
29+
speakeasy: speakeasy.md
30+
remotes:
31+
- id: hosted
32+
url: https://drivemcp.googleapis.com/mcp/v1
33+
transport: streamable-http
34+
authentication:
35+
- oauth-client
36+
provenance:
37+
- source: provider-documentation
38+
locator: https://developers.google.com/workspace/drive/api/guides/configure-mcp-server
39+
name: Configure the Drive MCP server
40+
classification: official
41+
observed_at: "2026-07-29T20:37:22Z"
42+
- source: provider-documentation
43+
locator: https://developers.google.com/workspace/drive/api/reference/mcp
44+
name: Google Drive MCP reference
45+
classification: official
46+
observed_at: "2026-07-29T20:37:22Z"
47+
- source: provider-documentation
48+
locator: https://docs.cloud.google.com/mcp/supported-products
49+
name: Supported products
50+
classification: official
51+
observed_at: "2026-07-29T20:37:22Z"
52+
- source: endpoint-observation
53+
locator: https://drivemcp.googleapis.com/mcp/v1
54+
name: Google Drive MCP endpoint
55+
classification: official
56+
observed_at: "2026-07-29T20:37:22Z"
57+
- source: endpoint-observation
58+
locator: https://drivemcp.googleapis.com/.well-known/oauth-protected-resource/mcp/v1
59+
name: Google Drive MCP protected-resource metadata
60+
classification: official
61+
observed_at: "2026-07-29T20:37:22Z"
62+
provenance:
63+
- source: provider-documentation
64+
locator: https://developers.google.com/workspace/drive/api/guides/configure-mcp-server
65+
name: Configure the Drive MCP server
66+
classification: official
67+
observed_at: "2026-07-29T20:37:22Z"
68+
- source: provider-documentation
69+
locator: https://developers.google.com/workspace/drive/api/reference/mcp
70+
name: Google Drive MCP reference
71+
classification: official
72+
observed_at: "2026-07-29T20:37:22Z"
73+
- source: provider-documentation
74+
locator: https://developers.google.com/workspace/drive/api/guides/api-specific-auth
75+
name: Choose Google Drive API scopes
76+
classification: official
77+
observed_at: "2026-07-29T20:37:22Z"
78+
- source: provider-documentation
79+
locator: https://developers.google.com/workspace/drive/api/guides/drive-mcp-server-file-eligibility
80+
name: Drive MCP file eligibility
81+
classification: official
82+
observed_at: "2026-07-29T20:37:22Z"
83+
- source: provider-documentation
84+
locator: https://developers.google.com/workspace/guides/configure-oauth-consent
85+
name: Configure the OAuth consent screen and choose scopes
86+
classification: official
87+
observed_at: "2026-07-29T20:37:22Z"
88+
- source: provider-documentation
89+
locator: https://developers.google.com/workspace/guides/create-credentials#oauth-client-id
90+
name: Create access credentials
91+
classification: official
92+
observed_at: "2026-07-29T20:37:22Z"
93+
- source: provider-documentation
94+
locator: https://developers.google.com/identity/protocols/oauth2#expiration
95+
name: Using OAuth 2.0 to Access Google APIs
96+
classification: official
97+
observed_at: "2026-07-29T20:37:22Z"
98+
- source: provider-documentation
99+
locator: https://docs.cloud.google.com/mcp/supported-products
100+
name: Supported products
101+
classification: official
102+
observed_at: "2026-07-29T20:37:22Z"
103+
- source: provider-documentation
104+
locator: https://docs.cloud.google.com/mcp/set-up-authentication-mcp-servers
105+
name: Set up authentication to Google and Google Cloud MCP servers
106+
classification: official
107+
observed_at: "2026-07-29T20:37:22Z"
108+
- source: provider-documentation
109+
locator: https://docs.cloud.google.com/mcp/manage-mcp-servers
110+
name: Manage MCP servers
111+
classification: official
112+
observed_at: "2026-07-29T20:37:22Z"
113+
- source: provider-documentation
114+
locator: https://docs.cloud.google.com/service-usage/docs/enable-disable
115+
name: Enable and disable services
116+
classification: official
117+
observed_at: "2026-07-29T20:37:22Z"
118+
- source: provider-documentation
119+
locator: https://docs.cloud.google.com/iam/docs/grant-role-console
120+
name: Grant an IAM role by using the Google Cloud console
121+
classification: official
122+
observed_at: "2026-07-29T20:37:22Z"
123+
- source: provider-documentation
124+
locator: https://support.google.com/cloud/answer/15549945
125+
name: Manage App Audience
126+
classification: official
127+
observed_at: "2026-07-29T20:37:22Z"
128+
- source: provider-documentation
129+
locator: https://support.google.com/cloud/answer/15549135
130+
name: Manage App Data Access
131+
classification: official
132+
observed_at: "2026-07-29T20:37:22Z"
133+
- source: provider-documentation
134+
locator: https://support.google.com/a/answer/7281227
135+
name: Control which apps access Google Workspace data
136+
classification: official
137+
observed_at: "2026-07-29T20:37:22Z"
138+
- source: endpoint-observation
139+
locator: https://drivemcp.googleapis.com/mcp/v1
140+
name: Google Drive MCP endpoint
141+
classification: official
142+
observed_at: "2026-07-29T20:37:22Z"
143+
- source: endpoint-observation
144+
locator: https://drivemcp.googleapis.com/.well-known/oauth-protected-resource/mcp/v1
145+
name: Google Drive MCP protected-resource metadata
146+
classification: official
147+
observed_at: "2026-07-29T20:37:22Z"
148+
- source: endpoint-observation
149+
locator: https://accounts.google.com/.well-known/oauth-authorization-server
150+
name: Google authorization-server metadata
151+
classification: official
152+
observed_at: "2026-07-29T20:37:22Z"
153+
- source: repository-doctrine
154+
locator: doctrine/speakeasy-setup.md
155+
name: Speakeasy setup canonical section
156+
classification: official
157+
observed_at: "2026-07-29T20:37:22Z"

0 commit comments

Comments
 (0)