Skip to main content
tai42-connector-google registers the google connector: one OAuth connection per alias, each unlocking three MCP sub-services — Gmail, Calendar, and Drive. The connector package is pure descriptor data; the runtime’s connector engine runs the OAuth flow, seals the tokens, and launches the sub-services.

​
Install and register it

manifest.yml

​
Create the Google OAuth client

Create a Web application OAuth 2.0 client in the Google Cloud console and enable the APIs behind the services you intend to offer — Gmail API, Google Calendar API, and Google Drive API. Add this exact redirect URI, where {origin} is your deployment’s public origin (or CONNECTORS_OAUTH_BRIDGE_URL when you run a shared bridge):
Then set the client credentials on the API process:

​
Configure the connector engine

The engine’s own settings apply to every connector, not just this one: The origin you registered with Google must appear in CONNECTORS_REDIRECT_URI_ALLOWLIST, and it must be https for anything but a local host.

​
Services and scopes

Each service requests its own scope set, so a user consents only to what the service they connect actually needs. The authorize request adds access_type=offline, prompt=consent, and include_granted_scopes=true, so a refresh token comes back and previously granted scopes are carried forward.
Google classifies two of these scopes as restricted — gmail.readonly and drive.readonly — which means app verification plus an annual third-party security assessment before external users may consent. gmail.send and calendar.events are sensitive and need app verification. openid, email, and drive.file need neither.

​
Connect an account

Once the client is registered, the connect flow runs from the Studio or the CLI exactly as the OAuth provider guide describes. Each sub-service is launched by the engine as a stdio MCP server — a local child process of the API process, run through uvx against the entry points tai-mcp-google-gmail, -calendar, and -drive.
uvx must therefore be on the PATH of the process that launches sub-services.
Disconnecting revokes the token at Google’s revocation endpoint.

​
See also