> [!WARNING] > **Developer Preview:** Available as part of the [Google Workspace Developer Preview Program](https://developers.google.com/workspace/preview), which grants early access to certain features. Google Docs offers a remote [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server that allows AI agents to securely interact with Google Docs data. By configuring the Google Docs MCP server, you enable AI applications like Google Antigravity and Claude to perform actions in Google Docs. The Google Docs MCP server provides a standardized way for AI agents to: - **Read data**: Read document structural information and text content. - **Take action**: Update document styling and structure using batch updates. - **Respect security**: Inherit the same permissions and data governance controls as the user. ## Prerequisites - Membership in the [Google Workspace Developer Preview Program](https://developers.google.com/workspace/preview). - A Google Cloud project. To create a project, see [Create a project](https://developers.google.com/workspace/guides/create-project). - An MCP host, like [Google Antigravity](https://antigravity.google/). - To run the commands on this page, set up the gcloud CLI in one of the following development environments: ### Cloud Shell To use an online terminal with the gcloud CLI already set up, activate Cloud Shell: [Activate Cloud Shell](https://console.cloud.google.com/home/dashboard?cloudshell=true) ### Local shell To use a local development environment, follow these steps: 1. [Install the Google Cloud CLI](https://cloud.google.com/sdk/docs/install). If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`. 2. If you're using an external identity provider (IdP), sign in to the gcloud CLI with your federated identity. For more information, see [Sign in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). 3. [Initialize the gcloud CLI](https://docs.cloud.google.com/sdk/docs/initializing). ## Configure the Google Docs MCP server To use the Google Docs MCP server, you must enable it in your Google Cloud project and then configure your MCP client to connect to it. ### Enable the APIs To use the Google Docs MCP server, you must enable the following API in your Google Cloud project: - Google Docs API ### CLI gcloud services enable docs.googleapis.com --project=PROJECT_ID Replace `PROJECT_ID` with your Google Cloud project ID. ### Console Enable the APIs in the Google Cloud console: [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=docs.googleapis.com) ### Enable the MCP services To enable the MCP components for Google Docs, you must enable the following service in your Google Cloud project: - Google Docs MCP API ### CLI gcloud services enable docsmcp.googleapis.com --project=PROJECT_ID Replace `PROJECT_ID` with your Google Cloud project ID. ### Console Enable the MCP services in the Google Cloud console: [Enable the MCP services](https://console.cloud.google.com/flows/enableapi?apiid=docsmcp.googleapis.com) ### Set up the OAuth consent screen The Google Docs MCP server uses OAuth 2.0 for authentication and authorization. You must configure the OAuth consent screen before you can create an OAuth client ID. 1. In the Google Cloud console, go to **Google Auth Platform** \> **Branding**. [Go to Branding](https://console.cloud.google.com/auth/branding) 2. If you have already configured the **Google Auth Platform** , you can configure the following OAuth Consent Screen settings in [Branding](https://console.cloud.google.com/auth/branding), [Audience](https://console.cloud.google.com/auth/audience), and [Data Access](https://console.cloud.google.com/auth/scopes). If you see a message that says **Google Auth Platform not configured yet** , click **Get Started**: 1. Under **App Information** , in **App name** , type `Docs MCP Server`. 2. In **User support email**, select your email address or an appropriate Google group. 3. Click **Next**. 4. Under **Audience** , select **Internal** . If you can't select **Internal** , select **External**. 5. Click **Next**. 6. Under **Contact Information** , enter an **Email address** where you can be notified about any changes to your project. 7. Click **Next**. 8. Under **Finish** , review the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy) and if you agree, select **I agree to the Google API Services: User Data Policy**. 9. Click **Continue**. 10. Click **Create**. 11. If you selected **External** for user type, add test users: 1. Click **Audience**. 2. Under **Test users** , click **Add users**. 3. Enter your email address and any other authorized test users, then click **Save**. 3. Click **Data Access** \> **Add or Remove Scopes**. A panel appears with a list of scopes for each API that you've enabled in your Google Cloud project. 1. Under **Manually add scopes**, paste the scopes for the Google Docs MCP server: - `https://www.googleapis.com/auth/drive.readonly` - `https://www.googleapis.com/auth/drive.file` - `https://www.googleapis.com/auth/documents.readonly` - `https://www.googleapis.com/auth/documents` 2. Click **Add to Table**. 3. Click **Update**. 4. After selecting the scopes required by your app, on the **Data Access** page, click **Save**. ### Configure your MCP client To add the Google Docs remote MCP server to your MCP client, follow the instructions for your client. User-delegated OAuth 2.0 client IDs that call the Docs MCP server must have **Use this client for an AI-powered agent** selected in **Google Auth Platform** \> **Clients** . To update an existing OAuth 2.0 client ID, select this setting in **Google Auth Platform** \> **Clients** , as described in [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257). If you can't change this setting on an existing client, or if the client also supports non-agent features, create a new OAuth 2.0 client ID for your AI agent. For rejected requests, service accounts with domain-wide delegation, or Google Apps Script, see [Troubleshooting](https://developers.google.com/workspace/docs/api/guides/configure-mcp-server#troubleshooting). ### Antigravity To add the Google Docs remote MCP server to Antigravity, add the server configuration to your `mcp_config.json` file. These instructions support Antigravity 2.0, Antigravity IDE, and Antigravity CLI. 1. Create an OAuth 2.0 client ID and secret: 1. In the Google Cloud console, go to **Google Auth Platform** \> **Clients** \> **Create Client**. [Go to Create Client](https://console.cloud.google.com/auth/clients/create) 2. Select **Web application** as the application type. 3. Enter a **Name**. 4. In the **Authorized redirect URIs** section, click **+ Add URI** , and then add `https://antigravity.google/oauth-callback` in the **URIs** field. 5. Select **Use this client for an AI-powered agent**. 6. Click **Create** and copy your **Client ID** and **Client Secret**. 2. Open or create the configuration file `~/.gemini/config/mcp_config.json`. 3. Add the `mcpServers` configuration to `mcp_config.json`: { "mcpServers": { "docs": { "serverUrl": "https://docsmcp.googleapis.com/mcp/v1", "oauth": { "clientId": "OAUTH_CLIENT_ID", "clientSecret": "OAUTH_CLIENT_SECRET" } } } } Replace the following: - `OAUTH_CLIENT_ID`: The client id you created. - `OAUTH_CLIENT_SECRET`: The client secret you created. 4. Save `mcp_config.json`. 5. Authenticate the MCP server. You can authenticate using either the GUI settings or the CLI: - **For Antigravity IDE or GUI (Antigravity 2.0):** 1. Open your settings screen (e.g., click **Settings** at the bottom-left or open **Antigravity User Settings**). 2. Navigate to **Customizations**. 3. Under **Installed MCP Servers** , click **Refresh**. 4. Find `docs` in the list, click **Authenticate** , sign in to your Google Account, copy the authorization code, paste it into the input dialog, and click **Submit**. - **For Antigravity CLI:** 1. Start Antigravity CLI: agy 2. Open the interactive MCP management panel by running: /mcp 3. Use the arrow keys to select `docs`, move to the **Authenticate** action, and press **Enter** . Complete the sign-in flow in your browser, copy the authorization code, paste it into the terminal prompt, and press **Enter**. 6. Verify that the server is correctly configured and running: - **For Antigravity IDE or GUI:** A **Sign out** button is displayed next to the server under **Customizations** \> **Installed MCP Servers**. - **For Antigravity CLI:** Open the `/mcp` panel to view your configured MCP servers. Verified and authenticated servers display **Authed** next to their names inside the interactive TUI panel. You can select any server under the dashboard view to inspect its status and list all of its available tools. The remote MCP server is ready to use in Antigravity. ### Claude To use the Google Docs remote MCP server with Claude.ai or Claude Desktop, you must have the Claude Enterprise, Pro, Max, or Team plan. To add the Google Docs remote MCP server to Claude, configure a custom connector with an OAuth client ID and secret. 1. Create an OAuth 2.0 client ID and secret: 1. In the Google Cloud console, go to **Google Auth Platform** \> **Clients** \> **Create Client**. [Go to Create Client](https://console.cloud.google.com/apis/credentials/oauthclient) 2. Select **Web application** as the application type. 3. Enter a **Name**. 4. In the **Authorized redirect URIs** section, click **+ Add URI** , and then add `https://claude.ai/api/mcp/auth_callback` in the **URIs** field. 5. Select **Use this client for an AI-powered agent**. 6. Click **Create** and copy your **Client ID** and **Client Secret**. 2. Configure the MCP server in Claude: 1. In Claude.ai or Claude Desktop, go to **Settings** \> **Connectors** or **Admin settings** \> **Connectors**. 2. Click **Add custom connector**. 3. Enter the connection details for the Google Docs product: - **Server name** : `Google Docs`. - **Remote MCP server URL** : `https://docsmcp.googleapis.com/mcp/v1` 4. In **Advanced settings** , enter your **OAuth client ID** and **OAuth client secret**. 5. Click **Add**. ### Others Many AI applications have ways to connect to a remote MCP server. You typically need to enter details about the server, like its name, endpoints, transport protocol, and authentication method. For the Google Docs remote MCP server, enter the following: - **Server name** : `docs` - **Server URL** : `https://docsmcp.googleapis.com/mcp/v1` - **Transport** : [Streamable HTTP](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http) - **Authentication** : The Google Docs remote MCP server uses OAuth 2.0. When creating your OAuth 2.0 client, select **Use this client for an AI-powered agent** . For details, see [Learn about authentication and authorization](https://developers.google.com/workspace/guides/auth-overview). For more details on connecting different types of clients, see [Configure MCP in an AI application](https://docs.cloud.google.com/mcp/configure-mcp-ai-application). ## Test the Google Docs MCP server After you configure the MCP client, you can verify the connection by running some test prompts. Try asking your MCP client the following questions: - **"Show me the structural contents of Google Doc `abcd123`."** The client fetches the document structure and contents using `docs.read_doc`. - **"Insert the title 'My Marketing Plan' into Google Doc `abcd123`."** The client performs `docs.update_doc` to update structural elements and insert text. If the tools execute successfully and you receive relevant responses, your Google Docs MCP server is correctly configured. ## Troubleshooting Use the following sections to resolve common authentication and connection issues with the Docs MCP server. ### Check OAuth log events If you encounter issues connecting to the MCP server, check for errors in the OAuth logs. Ask your Google Workspace administrator to review the **OAuth log events** in the [security investigation tool](https://knowledge.workspace.google.com/admin/security/about-the-security-investigation-tool). ### Rejected requests from user-delegated OAuth clients If your requests to the MCP server are rejected, verify that the user-delegated OAuth 2.0 client ID for your 3-legged OAuth flow has **Use this client for an AI-powered agent** selected in **Google Auth Platform** \> **Clients**: - **Existing client supports the setting** : Select **Use this client for an AI-powered agent** on your existing OAuth client. - **Existing client can't be updated** : Create a new OAuth client with **Use this client for an AI-powered agent** selected and update your app to use it. - **Existing client also supports non-agent features**: Create a separate OAuth client for the AI agent and keep the existing client for your non-agent features. For instructions, see [Configure your MCP client](https://developers.google.com/workspace/docs/api/guides/configure-mcp-server#configure-mcp-client) and [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257). ### Service accounts with domain-wide delegation If your app uses a service account with domain-wide delegation for 2-legged OAuth, you can't select **Use this client for an AI-powered agent** because service accounts aren't managed in **Google Auth Platform** \> **Clients**: - **Access control** : Requests to the MCP server from these service accounts aren't rejected for missing the agent setting. Instead, access is governed by the domain-wide delegation settings that your Google Workspace administrator manages. For details on administrator settings, see [Control API access with domain-wide delegation](https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation). - **Sensitive actions**: Google Workspace MCP servers still return form elicitation prompts for human-in-the-loop confirmation on sensitive tool calls made through domain-wide delegation user impersonation. ### Requests from Apps Script If you call the MCP server from Apps Script, you can't select **Use this client for an AI-powered agent** on the default OAuth client that Apps Script creates and manages for your script. This applies even if your script uses a [standard Google Cloud project](https://developers.google.com/apps-script/guides/cloud-platform-projects#standard_cloud_platform_projects). To call the MCP server from Apps Script, do the following: 1. In the Google Cloud console, go to **Google Auth Platform** \> **Clients** , create an OAuth client, and select **Use this client for an AI-powered agent**. 2. In your script, use the [OAuth2 for Apps Script library](https://github.com/googleworkspace/apps-script-oauth2) to authorize users with that OAuth client. 3. When you call the MCP server, send the access token that the library returns instead of the token from `ScriptApp.getOAuthToken`. Apps Script projects that don't call Google Workspace MCP servers aren't affected. ### Repeated hourly sign-in prompts If you're prompted to sign in again about every hour, your MCP client isn't receiving a refresh token. Google's OAuth 2.0 server issues a refresh token only when the authorization request includes `access_type=offline`. Requesting only the OpenID Connect (OIDC) `offline_access` scope doesn't return one. Check whether your MCP client supports custom authorization parameters: - **Client supports custom authorization parameters** : Add `access_type=offline` to the authorization request. To get a new refresh token for a user who already granted access, also add `prompt=consent`. - **Client doesn't support custom authorization parameters**: Sign in again each time the access token expires. For details, see [Refresh an access token](https://developers.google.com/identity/protocols/oauth2/web-server#offline). ## Tool reference The following tools are available for the Google Docs MCP server: - `read_doc` - `update_doc` ## Important security consideration: Indirect prompt injection When you expose a language model to untrusted data, there is a risk of an [indirect prompt injection attack](https://en.wikipedia.org/wiki/Prompt_injection). Because MCP hosts like Google Antigravity have access to powerful tools and APIs through the Google Docs MCP server, they can read, modify, and delete data in your Google Account. To mitigate these risks, you must screen prompts and responses for malicious content or prompt injection attacks. You can use the Google-provided Model Armor or you can use your own solution if you document it in order for users to accept that risk. For more information, see [Configure security for Google Workspace MCP servers](https://developers.google.com/workspace/guides/configure-mcp-security). Follow these best practices: - **Only use trusted tools.** Never connect Google Docs MCP server to untrusted or unverified applications. - **Be cautious with untrusted inputs.** Avoid asking your MCP client to process docs or other resources from unverified sources. These inputs may contain hidden instructions that can hijack your session, allowing an attacker to modify, steal, or delete your data. - **Review all actions.** Always carefully review the actions taken by your AI client on your behalf to ensure they are correct and align with your intentions. ## Related topics - [Configure security for Google Workspace MCP servers](https://developers.google.com/workspace/guides/configure-mcp-security) - [Google Workspace MCP servers in Antigravity (codelab)](https://codelabs.developers.google.com/google-workspace-mcp-antigravity#0) - [List of Google Workspace MCP servers](https://developers.google.com/workspace/guides/configure-mcp-servers#support-products)