diff --git a/guides/google-calendar/external.md b/guides/google-calendar/external.md index 54c3078..7547c4b 100644 --- a/guides/google-calendar/external.md +++ b/guides/google-calendar/external.md @@ -4,15 +4,26 @@ setup_version: 1 # Google Calendar setup -Use a Google Cloud project where you can enable services, grant project roles, configure **Google Auth platform**, and create OAuth credentials. Enabling services requires `serviceusage.services.enable`, normally provided by **Service Usage Admin** or **Owner**; another predefined or custom role can provide it. Google's IAM procedure names **Project IAM Admin** for granting project roles. Each connecting user must have access to the calendars and events they will use. +The Calendar MCP server is in the Google Workspace Developer Preview Program. Use a Google Workspace account that can be added to Google Groups and a Google Cloud project that your organization can register in the program. Under the Developer Preview Program Terms, each connecting user must belong to the applicant's domain or company unless Google permits otherwise. You need permission to enable services, grant project roles, configure **Google Auth Platform**, and create OAuth credentials. Enabling services requires `serviceusage.services.enable`, normally provided by **Service Usage Admin** or **Owner**. Google's IAM procedure uses **Project IAM Admin** for granting project roles. Each connecting user must have `mcp.tools.call` on the project and access to the calendars and events they will use. **MCP Tool User** (`roles/mcp.toolUser`) is the normal predefined grant, but another predefined or custom role is sufficient if it contains `mcp.tools.call`. If Calendar is **Restricted** or the new app requires approval, you also need a Google Workspace administrator with the **Service Settings** privilege. -Before you begin, have the application or security owner configure prompt and response screening for malicious content or prompt injection. +Before you begin, have the application or security owner configure prompt and response screening for malicious content or prompt injection. If the organization does not use Google Model Armor, document the alternative screening and the accepted risk. You will open the Google Cloud console after Google confirms project registration. -1. Sign in at [console.cloud.google.com](https://console.cloud.google.com). -2. In the console toolbar, use the resource selector to select the project that will own this configuration. +### Join the Google Workspace Developer Preview Program {#join-developer-preview} + +1. Open [developers.google.com/workspace/preview](https://developers.google.com/workspace/preview). +2. Review the **Developer Preview Program Terms** with the application or security owner. +3. Click **Apply to join the Developer Preview Program**. +4. In the current application form, enter the requested Google Workspace account and Google Cloud project information. +5. Agree to the terms only with organizational approval. +6. Submit the form with the visible or equivalent submission control. Google verifies the Workspace account, adds it to the program group, and then registers the Cloud project; no post-submission Google Groups acceptance action is documented. +7. Wait for the final project-registration confirmation at the submitted email address. Google says this should complete within a couple of days. +8. After confirmation, open the [Google Cloud console](https://console.cloud.google.com/) and sign in. +9. In the toolbar resource selector, select the registered project. Keep that project selected throughout the Google Cloud steps. + + ### Enable the Google Calendar APIs {#enable-google-calendar-apis} 1. Open **APIs & Services** > **API Library**. @@ -20,34 +31,33 @@ Keep that project selected throughout the Google Cloud steps. 3. Open **Google Calendar API**. 4. Click **Enable**. If the API is already enabled, continue. 5. Reopen **APIs & Services** > **API Library**. -6. In **Search for APIs & Services**, search for `Google Calendar MCP API`. -7. Open **Google Calendar MCP API**. +6. In **Search for APIs & Services**, search for `Calendar MCP API`. +7. Open **Calendar MCP API**. 8. Click **Enable**. If the API is already enabled, continue. -9. Open the project's **IAM** page. +9. Open [console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam) for the project's **IAM** page. - + ### Grant MCP Tool User access {#grant-mcp-tool-user} -1. Go to [console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam). -2. Confirm that the same project is selected. -3. Click **Grant access**. -4. In **New principals**, enter a connecting user's Google Account email. -5. Click **Select a role**. -6. Search for `MCP Tool User`. -7. Select **MCP Tool User**. -8. Click **Save**. -9. Repeat these steps for each connecting user. +1. On the project's **IAM** page, confirm that the same project is selected. +2. Click **Grant access**. +3. In **New principals**, enter a connecting user's Google Account email. +4. Click **Select a role**. +5. Search for `MCP Tool User`. +6. Select **MCP Tool User**. +7. Click **Save**. +8. Repeat these steps for each connecting user. - + ### Configure the OAuth consent screen {#configure-oauth-consent} -Google says an OAuth consent screen cannot be removed after you configure it. Obtain approval from the application or security owner before accepting the user data policy. +Obtain approval from the application or security owner before accepting the user data policy. -1. Open **Google Auth platform** > **Branding**. +1. Open **Google Auth Platform** > **Branding**. 2. If you see **Google Auth platform not configured yet**, click **Get Started**. Otherwise, retain the approved **Branding** and **Audience**, then continue at **Data Access** below. -3. Under **App Information**, enter `Calendar MCP Server` in **App name**. +3. Under **App Information**, enter a recognizable app name, such as `Calendar MCP Server`, in **App name**. 4. In **User support email**, choose a monitored address. 5. Click **Next**. 6. Under **Audience**, select **Internal** if every connecting user belongs to the project's organization. Otherwise, select **External**. @@ -72,21 +82,21 @@ Google says an OAuth consent screen cannot be removed after you configure it. Ob 18. Click **Update**. 19. Click **Save**. -If you selected **External** and the app is in **Testing**, add every connecting account: +If you selected **External** and the app is in **Testing**, add each eligible connecting account. Do not add a user outside the Developer Preview applicant's domain or company unless Google has permitted that access: 1. Open **Audience**. 2. Under **Test users**, click **Add users**. 3. Enter each connecting user's email. 4. Click **Save**. -**Testing** permits at most 100 test users. Each authorization expires seven days after consent; when it expires, the user must complete browser authorization again. +Each **Testing** authorization expires seven days after consent. When it expires, the user must complete browser authorization again. ### Create the OAuth client {#create-oauth-client} -1. Open **Google Auth platform** > **Clients**. -2. Click **Create client**. +1. Open **Google Auth Platform** > **Clients**. +2. Click **Create Client**. 3. In **Application type**, select **Web application**. 4. In **Name**, enter a recognizable name such as `Speakeasy AI Control Plane`. 5. Under **Authorized redirect URIs**, click **+ Add URI**. @@ -96,55 +106,43 @@ If you selected **External** and the app is in **Testing**, add every connecting {{ gram.oauth.callback_url }} ``` -Prepare an approved secret store before the next step. The dialog that opens after you create the client permits the client secret to be copied only once. +Prepare an approved secret store before the next step. Google shows the client secret after creation and does not make it accessible again. 7. Click **Create**. This opens **OAuth 2.0 client created**. - + ### Copy the OAuth credentials {#copy-oauth-credentials} -1. In **OAuth 2.0 client created**, copy **Client ID** to the approved secret store. -2. Under **Client secrets**, copy **Client secret** to the same store. +1. In **OAuth 2.0 client created**, copy **Client ID** to the approved credential handoff or password manager. +2. Copy **Client Secret** to the approved secret store before closing the dialog. Keep both values for [connecting your credentials](speakeasy.md#connect-speakeasy-credentials). -If you miss the one-time secret: - -1. Reopen **Google Auth platform** > **Clients**. -2. Confirm that the same project is selected. -3. Under **OAuth 2.0 Client IDs**, click the client you created. -4. Under **Client secrets**, find the missed secret. -5. Click **Disable**. -6. Click the delete button next to the disabled secret. - -Prepare the approved secret store before the next action. The new secret is visible only when it is created. - -7. Click **Add Secret**. -8. Immediately copy the new secret to the approved secret store. +If you close the dialog before storing the secret, return to **Google Auth Platform** > **Clients** and repeat [Create the OAuth client](#create-oauth-client) to create a new web client with the same callback URL. Store and use the new **Client ID** and newly shown **Client Secret**; Google will not make the original secret accessible again. If Workspace app approval is required, approve the new Client ID in the next step. - + ### Permit the OAuth app under Workspace policy if required {#permit-workspace-app} -Confirm the applicable Calendar app-access policy with the Workspace security owner. Complete this step only if the policy restricts Google Calendar access for unconfigured or limited apps. +Before skipping this step, confirm with the Workspace security owner whether Calendar is **Restricted** or the new app requires approval. To complete it, you need the Google Workspace **Service Settings** administrator privilege. -1. Sign in at `https://admin.google.com` with the **Service Settings administrator** privilege. +1. Open [admin.google.com](https://admin.google.com/) and sign in to the Google Admin console. 2. Open **Security** > **Access and data control** > **API controls**. 3. Click **Manage App Access**. 4. Under **Configured apps**, click **Configure new app**. 5. Enter the **Client ID** you copied in [Copy the OAuth credentials](#copy-oauth-credentials). 6. Click **Search**. -7. Select the matching app. -8. Select the organizational units whose users will connect. +7. Select the matching OAuth app. +8. Select the organizational units that contain the connecting users. 9. Click **Continue**. -10. Under **Access to Google data**, have the application or security owner choose **Trusted** or **Specific Google data**. +10. Under **Access to Google data**, have the application or security owner choose **Trusted**. Do not choose **Limited** for restricted Calendar access. 11. Click **Continue**. 12. Review the settings. 13. Click **Finish**. Return to the Speakeasy AI Control Plane. - + diff --git a/guides/google-calendar/meta.yaml b/guides/google-calendar/meta.yaml index 9bcc4c7..c35b2a4 100644 --- a/guides/google-calendar/meta.yaml +++ b/guides/google-calendar/meta.yaml @@ -2,7 +2,8 @@ schema_version: 1 slug: google-calendar title: Google Calendar -summary: Connect Google Calendar data through Google's hosted Calendar MCP server. +summary: Connect Google Calendar through Google's hosted Calendar MCP server with a Google Cloud OAuth client. +speakeasy_add_server: auto credential_setup: options: - id: oauth-client @@ -11,22 +12,26 @@ credential_setup: upstream_setup: provider-steps fields: - id: client-id - label: OAuth client ID + label: Client ID setup: - external.md#create-oauth-client - external.md#copy-oauth-credentials - id: client-secret - label: OAuth client secret + label: Client Secret setup: - external.md#create-oauth-client - external.md#copy-oauth-credentials requirements: + - id: developer-preview + description: Google has confirmed the intended Google Workspace account and registered the Google Cloud project in the Google Workspace Developer Preview Program; each connecting user belongs to the applicant's domain or company unless Google permits otherwise - id: google-cloud-project - description: A Google Cloud project where administrators can enable both Calendar services, grant project IAM roles, configure Google Auth platform, and create OAuth credentials; enabling services requires serviceusage.services.enable, normally provided by Service Usage Admin or Owner but also available through another predefined or custom role + description: An administrator can enable Google Calendar API and Calendar MCP API in the registered project, configure Google Auth Platform, create OAuth credentials, and change project IAM; enabling services requires serviceusage.services.enable - id: connecting-user-access - description: Each connecting user has MCP Tool User on the project, access to the intended calendars, and permission under applicable Workspace app-access policy + description: Each Developer Preview-eligible connecting user has mcp.tools.call on the project, normally through MCP Tool User though another predefined or custom role containing that permission suffices, access to the intended calendars, and applicable External-audience test-user status + - id: workspace-app-approval + description: If Calendar is Restricted or the new app requires approval, a Google Workspace administrator with the Service Settings privilege can approve the app under Workspace API controls - id: prompt-injection-screening - description: An application or security owner has configured prompt and response screening for malicious content or prompt injection + description: An application or security owner has configured prompt and response screening for malicious content or prompt injection and documented the accepted risk when not using Google Model Armor documentation: external: external.md speakeasy: speakeasy.md @@ -41,104 +46,79 @@ remotes: locator: https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server name: Configure the Calendar MCP server classification: official - observed_at: "2026-07-29T22:37:27Z" - - source: endpoint-observation - locator: https://calendarmcp.googleapis.com/mcp/v1 - name: Google Calendar MCP endpoint - classification: official - status: MCP initialize returned HTTP 200 - version: "2025-03-26" - observed_at: "2026-07-29T22:37:27Z" - - source: endpoint-observation + observed_at: "2026-08-29T15:13:24Z" + - source: provider-metadata locator: https://calendarmcp.googleapis.com/.well-known/oauth-protected-resource/mcp/v1 name: Google Calendar MCP protected-resource metadata classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" provenance: - source: provider-documentation locator: https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server name: Configure the Calendar MCP server classification: official - observed_at: "2026-07-29T22:37:27Z" - - source: provider-documentation - locator: https://developers.google.com/workspace/guides/configure-mcp-servers - name: Configure the Google Workspace MCP servers - classification: official - observed_at: "2026-07-29T22:37:27Z" - - source: provider-documentation - locator: https://developers.google.com/workspace/calendar/api/auth - name: Choose Google Calendar API scopes - classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation - locator: https://developers.google.com/workspace/guides/configure-oauth-consent - name: Configure the OAuth consent screen and choose scopes + locator: https://developers.google.com/workspace/preview + name: Google Workspace Developer Preview Program classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation - locator: https://developers.google.com/workspace/guides/configure-mcp-security - name: Configure security for Google Workspace MCP servers + locator: https://docs.cloud.google.com/mcp/authenticate-mcp + name: Authenticate to Google and Google Cloud MCP servers classification: official - observed_at: "2026-07-29T22:37:27Z" - - source: provider-documentation - locator: https://developers.google.com/workspace/release-notes - name: Google Workspace developer release notes - classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation locator: https://docs.cloud.google.com/mcp/set-up-authentication-mcp-servers - name: Set up authentication to Google and Google Cloud MCP servers + name: Set up authentication for Google Cloud MCP servers classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation locator: https://cloud.google.com/service-usage/docs/enable-disable name: Enable and disable services classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation locator: https://docs.cloud.google.com/iam/docs/grant-role-console name: Grant an IAM role by using the Google Cloud console classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation - locator: https://support.google.com/cloud/answer/15549945 + locator: https://support.google.com/cloud/answer/15549945?hl=en name: Manage App Audience classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation - locator: https://support.google.com/cloud/answer/15549135 + locator: https://support.google.com/cloud/answer/15549135?hl=en name: Manage App Data Access classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation - locator: https://support.google.com/cloud/answer/15549257 + locator: https://support.google.com/cloud/answer/15549257?hl=en name: Manage OAuth Clients classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: provider-documentation - locator: https://support.google.com/a/answer/7281227 + locator: https://support.google.com/a/answer/7281227?hl=en name: Control which apps access Google Workspace data classification: official - observed_at: "2026-07-29T22:37:27Z" - - source: endpoint-observation - locator: https://calendarmcp.googleapis.com/mcp/v1 - name: Google Calendar MCP endpoint - classification: official - status: MCP initialize returned HTTP 200 - version: "2025-03-26" - observed_at: "2026-07-29T22:37:27Z" - - source: endpoint-observation + observed_at: "2026-08-29T15:13:24Z" + - source: provider-metadata locator: https://calendarmcp.googleapis.com/.well-known/oauth-protected-resource/mcp/v1 name: Google Calendar MCP protected-resource metadata classification: official - observed_at: "2026-07-29T22:37:27Z" - - source: endpoint-observation + observed_at: "2026-08-29T15:13:24Z" + - source: provider-metadata locator: https://accounts.google.com/.well-known/oauth-authorization-server - name: Google authorization-server metadata + name: Google OAuth authorization-server metadata classification: official - observed_at: "2026-07-29T22:37:27Z" + observed_at: "2026-08-29T15:13:24Z" - source: repository-doctrine locator: doctrine/speakeasy-setup.md - name: Speakeasy setup canonical section - classification: official - observed_at: "2026-07-29T22:37:27Z" + name: Speakeasy setup canonical file + observed_at: "2026-08-29T15:13:24Z" + - source: pulsemcp + locator: credential-free Pulse snapshot for Google Calendar + name: Google Calendar catalog lookup + status: ready; no Google Calendar catalog entry found + observed_at: "2026-08-29T15:13:24Z" diff --git a/guides/google-calendar/research.md b/guides/google-calendar/research.md index 22dcb9e..7983a20 100644 --- a/guides/google-calendar/research.md +++ b/guides/google-calendar/research.md @@ -1,283 +1,406 @@ --- research_version: 1 slug: google-calendar -researched_at: 2026-07-29T22:37:27Z +researched_at: 2026-08-29T15:13:24Z --- # Google Calendar — Research Dossier ## Server facts -- Remote URL: `https://calendarmcp.googleapis.com/mcp/v1`. -- Transport: `streamable-http`. Google labels it **HTTP**. An MCP - `initialize` request over HTTPS POST returned HTTP 200 and protocol version - `2025-03-26` during this run. -- Launch stage: **Developer Preview**, announced in Google's April 22, 2026 - Workspace developer release notes. No separate preview-enrollment step is - documented. -- Enable **Google Calendar API** (`calendar-json.googleapis.com`) and - **Google Calendar MCP API** (`calendarmcp.googleapis.com`) in one Google - Cloud project. -- Authentication Option: OAuth 2.0 with a manually registered - **Web application** client, **Client ID**, and **Client secret**. Google MCP - servers do not support Dynamic Client Registration or OAuth Client ID - Metadata Documents. -- Each connecting user needs **MCP Tool User** (`roles/mcp.toolUser`) on the - project and access to the intended calendars. -- Google's setup page requires: +- Google publishes a hosted Google Calendar MCP server at + `https://calendarmcp.googleapis.com/mcp/v1`. This is a single shared public + endpoint, not a region-, organization-, or instance-specific endpoint, so + the remote is not tenanted. +- Google describes the transport as **HTTP**. Map this to the guide schema's + `streamable-http` transport. +- The Calendar MCP server remains in the Google Workspace Developer Preview + Program. The program page lists **Calendar MCP server** under **Latest + features** and requires program application, a Google Workspace account that + can be added to Google Groups, account verification, and Google Cloud project + registration before use. The Developer Preview Program Terms restrict access + to pre-GA offerings outside the applicant's domain or company unless Google + permits otherwise; every connecting user must pass this eligibility gate. +- The registered Google Cloud project must have **Google Calendar API** + (`calendar-json.googleapis.com`) and **Calendar MCP API** + (`calendarmcp.googleapis.com`) enabled. +- For Speakeasy, use OAuth 2.0 with a manually registered **Web application** + client, **Client ID**, and **Client Secret**. Google's shared MCP + authentication documentation supports OAuth client ID and secret for + third-party applications and states that Google remote MCP servers do not + support Dynamic Client Registration or OAuth Client ID Metadata Documents. +- Each connecting user must have `mcp.tools.call` on the project and access to + the Calendar resources they will use. **MCP Tool User** + (`roles/mcp.toolUser`) is the normal predefined grant, but another predefined + or custom role is sufficient if it contains `mcp.tools.call`. +- Google's Calendar setup procedure requires these OAuth scopes: - `https://www.googleapis.com/auth/calendar.calendarlist.readonly` - `https://www.googleapis.com/auth/calendar.events.freebusy` - `https://www.googleapis.com/auth/calendar.events.readonly` -- Protected-resource metadata identifies Google as the authorization server - and advertises those scopes among a broader set of Calendar scopes. -- Google requires prompt and response screening for malicious content or - prompt injection. Model Armor is one option; another solution can be used if - the risk is documented for users. -- If Workspace sets Calendar access to **Restricted**, configure the OAuth - client as **Trusted** or **Specific Google data** in **API controls**. -- Speakeasy MCP Catalog lookup was absent for `google-calendar` and - `google calendar`. Render only **Custom remote server**; catalog presence is - not an open question. +- Google requires prompts and responses to be screened for malicious content + or prompt injection. Google Model Armor is one option; an organization's own + solution is acceptable when its use is documented so users can accept the + risk. +- If a Google Workspace administrator has set Calendar access to + **Restricted**, only apps configured as **Trusted** or **Specific Google + data** can access Calendar data. **Limited** is insufficient in that case. +- The coordinator's credential-free Pulse snapshot was `ready` at + `2026-08-29T15:13:24Z` and contained no Google Calendar catalog entry. With + the non-tenanted remote and `speakeasy_add_server: auto`, the snapshot + resolves the current guide to the **Custom remote server** path. This is + snapshot evidence, not a permanent claim that the catalog cannot gain an + entry and not a reason to force `speakeasy_add_server: custom-remote`. ## Credential flow -A Google Cloud project administrator enables both APIs, grants connecting -users **MCP Tool User**, configures Google Auth platform, and creates one OAuth -2.0 **Web application** client. The operator who enables services must have -`serviceusage.services.enable`. **Service Usage Admin** and **Owner** normally -provide this permission, but neither role is strictly required; another -predefined or custom role can provide it. Google's IAM procedure names -**Project IAM Admin** for granting project roles. +An administrator first registers the intended Google Cloud project for the +Google Workspace Developer Preview Program and waits for Google's confirmation. +In that registered project, the administrator enables both services, grants +each connecting user `mcp.tools.call`—normally through **MCP Tool User**—configures +**Google Auth Platform**, and creates one OAuth 2.0 **Web application** client. -Paste `{{ gram.oauth.callback_url }}` directly into **Authorized redirect -URIs** in {#create-oauth-client}. The Speakeasy AI Control Plane later shows -the same **Redirect URI** for confirmation. +The service-enabling operator needs `serviceusage.services.enable`; Google +documents **Service Usage Admin** as the role to request and notes that project +**Owner** commonly has the permission. The role-granting operator needs +permission to change project IAM policy; Google's console procedure uses +**Project IAM Admin**. -| Value | Google origin | +Enter `{{ gram.oauth.callback_url }}` directly under **Authorized redirect +URIs** while creating the OAuth client in {#create-oauth-client}. The +Speakeasy AI Control Plane later displays the same **Redirect URI** for +confirmation; there is no Speakeasy-first callback-copy detour. + +| Speakeasy value | Google origin | | --- | --- | -| Client ID | **OAuth 2.0 client created** in {#copy-oauth-credentials} | -| Client Secret | **Client secrets** in {#copy-oauth-credentials}; copyable once | +| Client ID | **OAuth 2.0 client created** after {#create-oauth-client} | +| Client Secret | **OAuth 2.0 client created** after {#create-oauth-client}; copy it in {#copy-oauth-credentials} because Google says it is shown only after creation and cannot be viewed again | -For an **External** audience in **Testing**, add each connecting account under -**Test users**. Testing permits at most 100 test users and authorizations -expire seven days after consent. **Internal** is limited to the project's -Google Cloud organization. +For an **External** audience, add each eligible connecting account under **Test +users** while the app is in **Testing**. Do not add a user outside the Developer +Preview applicant's domain or company unless Google has permitted that access. +Because the Calendar scopes are outside the profile-only exception, Testing +authorizations expire after seven days and the user must authorize again. An +**Internal** audience is available only when the users belong to the Google +Cloud project's organization. ## Console walkthrough -Sign in at `https://console.cloud.google.com`. Use the toolbar resource -selector to select the project that will own the configuration and keep it -selected. +### Join the Google Workspace Developer Preview Program {#join-developer-preview} + +- Open Google's **Google Workspace Developer Preview Program** page and review + the published **Developer Preview Program Terms** with the organization's + application or security owner. The terms restrict access to pre-GA offerings + outside the applicant's domain or company unless Google permits otherwise. +- Before applying, confirm that the submitted Google Workspace account can be + added to Google Groups, as required by the program. +- Click **Apply to join the Developer Preview Program**. In the current + application form, provide the requested Google Workspace account and Google + Cloud project information, agree to the terms only with organizational + approval, and submit the form. Google does not publish the form's exact field + labels on the program page. +- Google verifies the Workspace account, adds it to the program group, and then + registers the Cloud project; the source documents no post-submission + Google Groups acceptance action. +- Wait for the final project-registration confirmation at the submitted email + address before continuing. Google says the process should complete within a + couple of days. +- Values entered: organization-specific Workspace account and Cloud project + information requested by Google's current form. Values copied: none. +- Screenshot note: the program page with **Calendar MCP server** listed under + **Latest features**; do not capture application-form account or project data. +- Transition: open the provider-documented Google Cloud console entry URL, + `https://console.cloud.google.com/`, sign in, and select the registered project + in the toolbar resource selector. Keep that project selected. ### Enable the Google Calendar APIs {#enable-google-calendar-apis} - Open **APIs & Services** > **API Library**. - In **Search for APIs & Services**, search for `Google Calendar API`, open - **Google Calendar API**, and click **Enable**. Continue if already enabled. -- Reopen **API Library**, search for `Google Calendar MCP API`, open - **Google Calendar MCP API**, and click **Enable**. Continue if already + **Google Calendar API**, and click **Enable**. Continue if it is already enabled. -- Permission gate: `serviceusage.services.enable`. **Service Usage Admin** and - **Owner** normally provide it, but another predefined or custom role can - provide it. -- Values entered: both API names. Values copied: none. -- Screenshot note: **Google Calendar MCP API** in its enabled state. -- Transition: open the project's **IAM** page. +- Reopen **API Library**, search for `Calendar MCP API`, open **Calendar MCP + API**, and click **Enable**. Continue if it is already enabled. +- Permission gate: `serviceusage.services.enable`; request **Service Usage + Admin** if the operator does not already have that permission. +- Values entered: the two API names. Values copied: none. +- Screenshot note: **Calendar MCP API** in its enabled state. +- Transition: open the registered project's **IAM** page at + `https://console.cloud.google.com/iam-admin/iam`. ### Grant MCP Tool User access {#grant-mcp-tool-user} -- Go to `https://console.cloud.google.com/iam-admin/iam` and confirm the same - project. -- Click **Grant access**. +- On the project's **IAM** page, click **Grant access**. - In **New principals**, enter a connecting user's Google Account email. -- Click **Select a role**, search for `MCP Tool User`, select - **MCP Tool User**, and click **Save**. -- Repeat for every connecting user. -- Values entered: user emails and **MCP Tool User**. Values copied: none. -- Screenshot note: **Grant access** with the principal and role visible. -- Transition: open **Google Auth platform**. +- Click **Select a role**, search for `MCP Tool User`, select **MCP Tool User**, + and click **Save**. +- Repeat for every connecting user. A custom or other predefined role is also + sufficient only if it contains `mcp.tools.call`; the documented path uses + **MCP Tool User**. +- Values entered: connecting-user email addresses and **MCP Tool User**. Values + copied: none. +- Screenshot note: **Grant access** with a non-sensitive test principal and the + role visible. +- Transition: open **Google Auth Platform** > **Branding** for the same project. ### Configure the OAuth consent screen {#configure-oauth-consent} -- Warning: Google says the consent screen cannot be removed after - configuration. -- Open **Google Auth platform** > **Branding**. If - **Google Auth platform not configured yet** appears, click **Get Started**. -- In the first-time wizard: - 1. Under **App Information**, enter `Calendar MCP Server` in **App name**, - choose a monitored **User support email**, and click **Next**. - 2. Under **Audience**, select **Internal** when all connecting users belong - to the project's organization; otherwise select **External**. Click - **Next**. - 3. Under **Contact Information**, enter a monitored **Email address** and - click **Next**. - 4. Under **Finish**, review the Google API Services User Data Policy. With - approval, select **I agree to the Google API Services: User Data Policy**, - click **Continue**, and click **Create**. -- For an existing configuration, retain approved **Branding** and - **Audience** values. -- Open **Data Access** and click **Add or Remove Scopes**. Under - **Manually add scopes**, paste all three scopes from Server facts. Click - **Add to Table**, **Update**, and **Save**. -- For an External app in Testing, open **Audience**. Under **Test users**, - click **Add users**, enter each connecting user's email, and click **Save**. -- Values entered: app/contact details, audience, scopes, and applicable test - users. Values copied: none. -- Screenshot note: **Data Access** with all three scopes selected. -- Recovery: after a Testing authorization expires, the user must authorize - again. -- Transition: open **Google Auth platform** > **Clients**. +- If **Google Auth Platform not configured yet** appears, click **Get Started**. +- In the first-time wizard, under **App Information**, enter a recognizable + **App name** such as `Calendar MCP Server`, select a monitored **User support + email**, and click **Next**. +- Under **Audience**, select **Internal** only when all connecting users belong + to the project's organization; otherwise select **External**, then click + **Next**. +- Under **Contact Information**, enter a monitored **Email address** and click + **Next**. +- Under **Finish**, review the Google API Services User Data Policy. With + organizational approval, select **I agree to the Google API Services: User + Data Policy**, click **Continue**, and click **Create**. +- For a project whose Google Auth platform is already configured, retain the + organization's approved **Branding** and **Audience** values rather than + replacing them. +- Open **Data Access** and click **Add or Remove Scopes**. Under **Manually add + scopes**, enter all three scopes from Server facts, click **Add to Table**, + click **Update**, and on **Data Access** click **Save**. +- If the audience is **External** and the app is in **Testing**, open + **Audience**. Under **Test users**, click **Add users**, enter each eligible + connecting user's email address, and click **Save**. Do not add users outside + the Developer Preview applicant's domain or company unless Google has + permitted their access. +- Values entered: organization-approved app/contact details, audience, the + three documented scopes, and applicable test-user emails. Values copied: + none. +- Screenshot note: **Data Access** with the three documented Calendar scopes + selected. +- Transition: open **Google Auth Platform** > **Clients**. ### Create the OAuth client {#create-oauth-client} -- Click **Create client**. +- Click **Create Client**. - Set **Application type** to **Web application**. - In **Name**, enter a recognizable name such as `Speakeasy AI Control Plane`. - Under **Authorized redirect URIs**, click **+ Add URI** and enter `{{ gram.oauth.callback_url }}` in **URIs**. The Calendar procedure does not - require an **Authorized JavaScript origin**. -- Warning: prepare an approved secret store before clicking **Create** because - the next dialog permits the secret to be copied only once. -- Click **Create** to open **OAuth 2.0 client created**. -- Values entered: application type, name, and callback URL. -- Screenshot note: **Create client** with the callback template populated. + require an **Authorized JavaScript origin** for this server connection. +- Before clicking **Create**, prepare an approved secret store: Google says the + client secret is visible only after creation and is not accessible again. +- Click **Create**. This opens **OAuth 2.0 client created**. +- Values entered: application type, client name, and callback URL. Values + copied: none. +- Screenshot note: **Create Client** immediately before creation with the + callback template populated. ### Copy the OAuth credentials {#copy-oauth-credentials} -- Copy **Client ID** to the approved secret store. -- Under **Client secrets**, copy **Client secret** to the same store. -- Keep both for {#connect-speakeasy-credentials}. -- Screenshot exception: do not capture a one-time secret. -- Recovery: if the secret is missed, reopen **Google Auth platform** > - **Clients**, select the same project, and click the client under **OAuth 2.0 - Client IDs**. On the client details page, find the missed secret under - **Client secrets**, click **Disable**, and click the delete button next to - the disabled secret. Click **Add Secret**, then immediately copy the new - secret to the approved secret store before continuing. -- Transition: if Workspace restricts Calendar access, complete the conditional - step; otherwise return to the Speakeasy AI Control Plane. +- In **OAuth 2.0 client created**, copy **Client ID** to the approved credential + handoff or password manager. +- Copy **Client Secret** to the approved secret store before closing the + dialog. Never place the secret in the guide or a screenshot. +- If the dialog was closed before the secret was stored, return to **Google + Auth Platform** > **Clients** and repeat {#create-oauth-client} to create a new + web client with the same callback URL. Store the new **Client ID** and newly + shown **Client Secret**, and use that pair in Speakeasy; Google does not make + the original secret visible again. +- Values copied: **Client ID** and **Client Secret**. Values entered: none. +- Screenshot note: omit this secret-bearing dialog; use the client list with + identifiers redacted if a screenshot is required. +- Transition: when Workspace policy permits the app, return to Speakeasy; when + Calendar is restricted, continue to {#permit-workspace-app}. ### Permit the OAuth app under Workspace policy if required {#permit-workspace-app} -- Before deciding whether to complete this step, confirm with the Workspace - security owner whether the applicable Calendar app-access policy restricts - unconfigured or limited apps. -- Sign in at `https://admin.google.com` with **Service Settings - administrator** privilege. -- Go to **Security** > **Access and data control** > **API controls**. -- Click **Manage App Access**. Under **Configured apps**, click - **Configure new app**. -- Enter the Client ID from {#copy-oauth-credentials}, click **Search**, and - select the matching app. -- Select covered organizational units and click **Continue**. -- Under **Access to Google data**, have the application or security owner - choose **Trusted** or **Specific Google data**. **Limited** cannot access a - restricted Calendar service. +- Before skipping this conditional step, confirm with the Workspace security + owner whether Calendar is **Restricted** or the new app requires approval. The + step requires the Google Workspace **Service Settings** administrator + privilege. +- Open the Google Admin console at `https://admin.google.com/`, then go to + **Security** > **Access and data control** > **API controls** and click + **Manage App Access**. Under **Configured apps**, + click **Configure new app**. +- Enter the **Client ID** from {#copy-oauth-credentials}, click **Search**, and + select the matching OAuth app. +- Select the organizational units that contain the connecting users and click + **Continue**. +- Under **Access to Google data**, have the application or security owner choose + **Trusted**. Do not choose **Limited** for a restricted Calendar service. This + walkthrough omits the alternate **Specific Google data** branch rather than + prescribing its required scope-selection flow without recorded support. - Click **Continue**, review the settings, and click **Finish**. -- Screenshot note: the review screen without credential values. +- Values entered: Client ID, covered organizational units, and the + organization-approved access setting. Values copied: Client ID. +- Screenshot note: the review screen with identifiers and user data redacted. - Transition: return to the Speakeasy AI Control Plane. ## Speakeasy setup Transcluded from `doctrine/speakeasy-setup.md`, observed at -`2026-07-29T22:37:27Z`. Fixed anchors are carried verbatim. +`2026-08-29T15:13:24Z`. Fixed anchors are carried verbatim. ### Add the server in Speakeasy {#add-server-in-speakeasy} In the Speakeasy AI Control Plane sidebar, under **Connect**, select **Sources**, then click **Add Source**. -Choose **Custom remote server**. On **Add a custom remote MCP server**, paste -`https://calendarmcp.googleapis.com/mcp/v1` into **Remote MCP server URL** and -click **Add server**. This opens the server's **Overview** page. +Choose **Custom remote server**. On the **Add a custom remote MCP server** +page, paste the following value into **Remote MCP server URL**, then click +**Add server**: + +```text +https://calendarmcp.googleapis.com/mcp/v1 +``` + +This creates the hosted MCP server and opens its Overview page. Per-guide values: remote URL -`https://calendarmcp.googleapis.com/mcp/v1`; transport `streamable-http` -(the **Transport** field is read-only); Authentication Option `oauth-client`; -Custom remote only because both catalog queries were absent. +`https://calendarmcp.googleapis.com/mcp/v1`; transport `streamable-http`; +Authentication Option `oauth-client`; `speakeasy_add_server: auto`. The +Custom remote path is resolved by the coordinator's ready Pulse snapshot with +no Google Calendar entry, not by a tenanted remote or forced override. ### Connect your credentials {#connect-speakeasy-credentials} -From **Overview**, open **Settings**. Under **Authentication**, click -**Configure Manually** or **Use Discovered** when offered. In **Attach Remote -Identity Provider**, set **Client Type** to **Manual**. - -Confirm **Redirect URI** matches the template entered in -{#create-oauth-client}. Paste **Client ID** and **Client Secret (optional)** -from {#copy-oauth-credentials}; Google requires the generated secret despite -the optional Speakeasy label. - -In **Scope (override)**, enter these comma-separated values: -`https://www.googleapis.com/auth/calendar.calendarlist.readonly`, -`https://www.googleapis.com/auth/calendar.events.freebusy`, -`https://www.googleapis.com/auth/calendar.events.readonly`. Click -**Attach Identity Provider**. - -At first connection, authorize with an account granted **MCP Tool User**, -included as a test user when applicable, and permitted by Workspace policy. -Google does not document the provider-specific authorization-prompt labels. - -Screenshot note: the Manual identity-provider sheet with secrets redacted. - -Further-reading URL: -`https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server`. - -## Open questions - -- Google's Calendar MCP page describes mutating event behavior but requires - only calendar-list read, event free/busy, and event read scopes. Public - documentation does not explain how mutating operations receive write - authorization. -- Protected-resource metadata advertises more Calendar scopes than the - product-specific setup page. Public documentation does not confirm whether - **Use Discovered** narrows the request automatically; the documented - three-scope manual override is used here. +From the server's **Overview**, open **Settings**. Under **Authentication**, +click **Configure Manually** (or **Use Discovered** when offered). Google +publishes protected-resource and authorization-server metadata, but does not +support dynamic client registration, so in **Attach Remote Identity Provider** +set **Client Type** to **Manual**. The sheet shows **Redirect URI** with a copy +button. + +Confirm **Redirect URI** matches the `{{ gram.oauth.callback_url }}` value +entered in {#create-oauth-client}. Paste **Client ID** and **Client Secret +(optional)** from {#copy-oauth-credentials}; despite the optional label in the +Control Plane, this manual Google web client uses the generated secret. + +**Scope (override)** must contain these three provider-documented scopes. +Speakeasy's public setup material does not document how the field separates +multiple values, so follow the current field guidance rather than assuming a +delimiter, then click **Attach Identity Provider**: + +- `https://www.googleapis.com/auth/calendar.calendarlist.readonly` +- `https://www.googleapis.com/auth/calendar.events.freebusy` +- `https://www.googleapis.com/auth/calendar.events.readonly` + +At first connection, authorize with an intended Google account that has +`mcp.tools.call` on the project, access to the required calendars, applicable +**Test user** status, and Workspace API-control approval when required. The +normal predefined grant for `mcp.tools.call` is **MCP Tool User**. Google does not document +the exact Calendar authorization-prompt button labels, so the Writer must name +the purpose and use the labels shown rather than inventing chrome. + + + +This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see [Google's MCP documentation](https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server). + +## Research limitations + +- The public Developer Preview page documents the application action, required + Workspace account and Cloud project information, Google Groups precondition, + verification sequence, and expected confirmation, but not the current + application form's exact field or final-button labels. It documents no + post-submission Google Groups acceptance control. The walkthrough preserves + the documented identifiers and tells the reader to complete the current form + without inventing UI chrome. +- The Calendar MCP page says the server can create, update, and delete events, + but its setup procedure lists only calendar-list read, event free/busy, and + event read scopes. Public documentation does not explain how write + authorization is obtained. This does not block first connection: use the + three scopes in the product-specific setup procedure and do not promise write + behavior. +- Protected-resource metadata advertises a broader set of Calendar scopes than + the product-specific setup page. Use the product-specific three-scope set for + setup; do not guess that **Use Discovered** will narrow it. +- Google does not publish the exact labels of the end-user Calendar OAuth + authorization prompt. Use a resilient instruction to authorize the requested + access with the intended account. +- Speakeasy's public setup material names **Scope (override)** but does not + document the accepted syntax for multiple scope values. Present the required + values separately and direct the reader to use the current multi-value + control rather than inventing a delimiter. +- The Pulse result proves only that the ready credential-free snapshot at + `2026-08-29T15:13:24Z` had no Google Calendar entry. It does not establish + permanent catalog absence; `auto` preserves future catalog resolution. + +## Operator decisions + +None. The public documentation and supplied snapshot resolve every material +first-connection decision. The documentation gaps above are presentation or +provider-behavior limitations that an operator cannot resolve with private +organizational knowledge. ## Provenance -Documentation-property sweep: - -- `developers.google.com`: Calendar and shared Workspace MCP setup, Calendar - scopes, OAuth consent, MCP security, and release notes. Drawn from. - `/llms.txt` returned 404. -- `docs.cloud.google.com` and `cloud.google.com`: MCP authentication, Service - Usage, and IAM. Drawn from. -- `support.google.com/cloud`: Auth platform Audience, Data Access, and OAuth - client management. Drawn from. -- `support.google.com/a`: Workspace API controls. Drawn from. -- Google Workspace Codelabs and Google Cloud Blog: swept, not drawn from; - current product/admin documentation was preferred. - -All entries were observed at `2026-07-29T22:37:27Z`: +### Source inventory + +- Google for Developers (`developers.google.com`): Calendar MCP setup, the + Google Workspace Developer Preview Program, shared Workspace MCP guidance, + OAuth consent guidance, Calendar scopes, and MCP security guidance. The + Calendar setup and preview pages were primary. Exa could not retrieve a + Workspace `/llms.txt` index. +- Google Cloud Documentation (`cloud.google.com` and + `docs.cloud.google.com`): shared MCP authentication, Service Usage, and IAM + administration. These pages supplied the cross-product MCP role, registration + limitation, API-enablement permission, and IAM console labels. Exa could not + retrieve the tested Cloud `/llms.txt` index. +- Google Cloud Platform Console Help (`support.google.com/cloud`): Google Auth + platform audience, data-access, and OAuth-client administration. Drawn from + for Testing behavior and one-time client-secret visibility. +- Google Workspace Admin Help (`support.google.com/a`): Workspace OAuth app + access controls. Drawn from for the conditional restricted-Calendar path. +- Google Help's root `https://support.google.com/llms.txt` was available as a + broad product index but did not replace the product-specific support pages. +- Google Workspace Codelabs and Google Cloud Blog were represented in search + results but not drawn from because current product, admin, and support + documentation was available. + +### Sources + +All public sources below were observed at `2026-08-29T15:13:24Z`. - `https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server` - — endpoint, APIs, OAuth, scopes, client creation, and security requirement. -- `https://developers.google.com/workspace/guides/configure-mcp-servers` — - shared endpoints, enablement, scopes, and authentication. -- `https://developers.google.com/workspace/calendar/api/auth` — scope meanings. -- `https://developers.google.com/workspace/guides/configure-oauth-consent` — - consent wizard, audience, test users, and irreversibility. -- `https://developers.google.com/workspace/guides/configure-mcp-security` — - screening requirement. -- `https://developers.google.com/workspace/release-notes` — April 22, 2026 - Developer Preview announcement. + — hosted endpoint; HTTP transport label; required services and scopes; exact + Google Auth platform and OAuth-client labels; manual client ID/secret + configuration; first-connection test; and mandatory prompt-injection + screening. +- `https://developers.google.com/workspace/preview` — current Developer Preview + status for **Calendar MCP server**, program terms, application action, account + and project verification, Google Groups requirement, project registration, + eligible-user terms, and confirmation sequence. +- `https://docs.cloud.google.com/mcp/authenticate-mcp` — OAuth client ID/secret + support and lack of Dynamic Client Registration and OAuth Client ID Metadata + Documents. - `https://docs.cloud.google.com/mcp/set-up-authentication-mcp-servers` — - MCP Tool User, manual registration, one-time secret, and DCR limitation. -- `https://cloud.google.com/service-usage/docs/enable-disable` — API Library, - enablement labels, and permission. -- `https://docs.cloud.google.com/iam/docs/grant-role-console` — IAM labels. -- `https://support.google.com/cloud/answer/15549945` — Audience and Testing. -- `https://support.google.com/cloud/answer/15549135` — Data Access controls. -- `https://support.google.com/cloud/answer/15549257` — OAuth client details, - one-time secret visibility, and controls for replacing a missed secret. -- `https://support.google.com/a/answer/7281227` — Workspace API controls. -- `https://calendarmcp.googleapis.com/mcp/v1` — successful MCP initialize. + **MCP Tool User**, `mcp.tools.call`, and the connecting user's separate + resource-access requirement. +- `https://cloud.google.com/service-usage/docs/enable-disable` — **Service + Usage Admin**, `serviceusage.services.enable`, project selection, **APIs & + Services** > **API Library**, search, service selection, and **Enable**. +- `https://docs.cloud.google.com/iam/docs/grant-role-console` — **Project IAM + Admin**, **Grant access**, **New principals**, **Select a role**, and **Save**. +- `https://support.google.com/cloud/answer/15549945?hl=en` — **Internal** and + **External** audiences, **Testing**, test users, 100-user cap, and seven-day + authorization expiry outside the profile-only exception. +- `https://support.google.com/cloud/answer/15549135?hl=en` — Auth platform + **Data Access** and scope administration. +- `https://support.google.com/cloud/answer/15549257?hl=en` — **Google Auth + Platform** > **Clients**, **Create Client**, application types, and the warning + that a client secret is shown only after creation and cannot be viewed again. +- `https://support.google.com/a/answer/7281227?hl=en` — **Security** > **Access + and data control** > **API controls**, **Manage App Access**, **Configured + apps**, **Configure new app**, **Trusted**, + **Specific Google data**, **Limited**, Calendar's Restricted behavior, and the + **Service Settings** privilege. - `https://calendarmcp.googleapis.com/.well-known/oauth-protected-resource/mcp/v1` - — protected-resource metadata. -- `https://accounts.google.com/.well-known/oauth-authorization-server` — - OAuth endpoints and no registration endpoint. -- `doctrine/speakeasy-setup.md` — canonical Speakeasy labels and anchors. -- `doctrine/personas/it-admin.md` — achievability requirements. + — protected-resource metadata for the remote endpoint, Google authorization + server, bearer-header support, and the broader advertised Calendar scope set. +- `https://accounts.google.com/.well-known/oauth-authorization-server` — Google + authorization and token endpoint metadata and supported client-secret token + authentication methods. +- `https://support.google.com/llms.txt` — broad Google Help source inventory. +- `doctrine/speakeasy-setup.md` — observed 2026-08-29T15:13:24Z; fixed + Speakeasy anchors, Custom remote and manual-OAuth labels, transitions, and + closing-pointer contract. +- Coordinator operator note — observed 2026-08-29T15:13:24Z; credential-free + Pulse snapshot status `ready` with no Google Calendar catalog entry. diff --git a/guides/google-calendar/speakeasy.md b/guides/google-calendar/speakeasy.md index 985af47..20aad2a 100644 --- a/guides/google-calendar/speakeasy.md +++ b/guides/google-calendar/speakeasy.md @@ -13,7 +13,7 @@ 5. Click **Add server**. -This opens the server's **Overview** page. **Transport** is read-only. +This creates the hosted MCP server and opens its Overview page. @@ -21,19 +21,19 @@ This opens the server's **Overview** page. **Transport** is read-only. 1. From **Overview**, open **Settings**. 2. Under **Authentication**, click **Configure Manually** or **Use Discovered** when offered. -3. In **Attach Remote Identity Provider**, set **Client Type** to **Manual**. +3. In **Attach Remote Identity Provider**, set **Client Type** to **Manual**. The sheet shows **Redirect URI** with a copy button. 4. Confirm that **Redirect URI** matches `{{ gram.oauth.callback_url }}` entered when you [created the OAuth client](external.md#create-oauth-client). 5. Paste the **Client ID** from [Copy the OAuth credentials](external.md#copy-oauth-credentials). -6. Paste the **Client secret** into **Client Secret (optional)**. Google requires this value despite the optional Speakeasy label. -7. In **Scope (override)**, enter this value: +6. Paste the **Client Secret** from [Copy the OAuth credentials](external.md#copy-oauth-credentials) into **Client Secret (optional)**. Google requires this value despite the optional Speakeasy label. +7. Make **Scope (override)** contain all three required scopes below. Speakeasy's public setup material does not document how the field separates multiple values, so follow the current field guidance rather than assuming a delimiter: - ``` - https://www.googleapis.com/auth/calendar.calendarlist.readonly,https://www.googleapis.com/auth/calendar.events.freebusy,https://www.googleapis.com/auth/calendar.events.readonly - ``` + - `https://www.googleapis.com/auth/calendar.calendarlist.readonly` + - `https://www.googleapis.com/auth/calendar.events.freebusy` + - `https://www.googleapis.com/auth/calendar.events.readonly` 8. Click **Attach Identity Provider**. -9. At first connection, authorize with an account granted **MCP Tool User**, included as a test user when applicable, and permitted by Workspace policy. +9. At first connection, authorize the requested access with an intended Google account that is eligible under the Developer Preview terms, has `mcp.tools.call` on the project, access to the required calendars, applicable **Test user** status, and Workspace API-control approval when required. **MCP Tool User** is the normal predefined grant for `mcp.tools.call`, but another role containing the permission can suffice. Use the visible controls on Google's authorization screen. - + -This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see [Google's Calendar MCP documentation](https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server). +This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see [Google's MCP documentation](https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server).