Google Workspace

Give agents governed access to Gmail, Drive, Calendar, Docs, Sheets, Slides, Chat and Contacts through Google's MCP servers.

Google publishes MCP servers for Workspace. They sign in with a Google account (OAuth), not an API key. Gatehouse does the sign-in for you, keeps the refresh token encrypted, and renews access every hour, so agents never handle Google credentials.

You create one OAuth client in Google Cloud, then add the products you want in Gatehouse. One sign-in covers all of them.

#Before you start

• A Google Workspace or Google account, and a Google Cloud project you can manage.
• Google's Workspace MCP servers are in the Google Workspace Developer Preview Program. Join it with the account you will use, or the servers will refuse access.

#1. Enable the APIs

In Google Cloud console, pick your project, open APIs & Services → Library, and enable both the regular API and the MCP service for each product you want:

For Chat, also configure a Chat app under the Chat API's Configuration: name it Chat MCP and turn interactive features off.

#2. Set up the consent screen

Open Google Auth Platform → Branding and give the app a name, such as Gatehouse.

Under Audience, choose Internal if you're on Google Workspace, so only people in your organization can connect. On a personal account choose External and add the accounts that will connect as test users.

#3. Create the OAuth client

1. Google Auth Platform → Clients → Create client.
2. Application type: Web application.
3. Tick Use this client for an AI-powered agent.
4. Under Authorized redirect URIs, add the address Gatehouse shows in Add Google Workspace, for example https://gatehouse.yourcompany.com/console/oauth/callback.
5. Create it and copy the client ID and client secret.

#4. Add Google Workspace in Gatehouse

1. Servers → Add Google Workspace.
2. Tick the products.
3. Choose the access:
   • Read only asks Google only for read scopes. No agent can send, edit or delete anything, whatever the policies say.
   • Read and write also allows drafting email and editing files the agent creates.
4. Paste the client ID and secret.
5. Choose whose Google account the tools use:
   • One shared account, such as hello@yourcompany.com. You sign in now, and everyone allowed by policy acts through that account.
   • Each person's own. Everyone connects their own Google account under Servers → Your connections, and agents only see what that person can see in Google.
6. Click Add and connect Google, sign in, and allow access.

Gatehouse creates one server per product (google-gmail, google-drive, …) and lists their tools, turned off. Turn on the ones you want under Tools and write a policy for who may use them.

#Managing the connection

• Each Google server shows Connected as with the account, and Disconnect. Disconnecting asks Google to revoke the sign-in.
• You can also remove access from Google's side, at myaccount.google.com/permissions or in the Workspace admin console. Gatehouse then shows the servers as needing to be connected again.
• Changing the client or the scopes under Edit server signs connected accounts out, so they connect again with the new access.
• Connecting, disconnecting and every tool call are in the audit log.

#Troubleshooting

#Other OAuth servers

Any MCP server that signs in with OAuth works the same way. In Add server, choose OAuth sign-in. If the server lets apps register themselves, leave the client ID empty and Gatehouse registers itself. Otherwise paste a client ID and secret from that service, with the redirect URI above.