OpenBSP MCP for Google Workspace

A public Model Context Protocol (MCP) server that lets AI assistants access your Google Calendar and Sheets.

Why this exists

Most Google MCP servers require you to create your own Google Cloud project, set up OAuth credentials, and run a local server. This is tedious and error-prone.

This project is different. It's a hosted public server with proxy OAuth. You just:

Click "Login with Google"
Get an API key
Add it to your MCP client

No Google Cloud setup. No local servers. No environment variables. Just connect and go.

What you can do

Once connected, ask your AI assistant to:

List and search your calendar events
Create, update, or delete events
Read and write to Google Sheets
Create new spreadsheets

How it works

Code

┌──────────────┐     ┌──────────────────┐     ┌──────────────┐
│  AI Client   │────▶│  OpenBSP MCP     │────▶│  Google APIs │
│  (Claude)    │◀────│  Server          │◀────│              │
└──────────────┘     └──────────────────┘     └──────────────┘

You select which Google products to connect (Calendar, Sheets)
You authenticate with Google and grant permissions
You receive an API key to configure your MCP client
Your AI assistant can now access your Google data

Privacy & Security

What we store

Data	Purpose	Protection
API Key	Authenticate your MCP client	Stored as-is (random 256-bit value)
OAuth Tokens	Access Google APIs on your behalf	AES-256-GCM encrypted
Scopes	Remember which products you authorized	Not encrypted

OAuth tokens are encrypted at rest using AES-256-GCM. The encryption key is stored separately from the database, so a database breach alone cannot expose your Google tokens.

What we DON'T store

Your Google password
Your email content
Your calendar events or spreadsheet data
Any personal information

Data retention

API keys: Stored until you revoke them (or until expiration if set)
OAuth tokens: Stored alongside your API key
Temporary auth states: Deleted after 10 minutes

How to revoke access

Option 1: Delete your API key

Terminal

curl -X DELETE https://g.mcp.openbsp.dev/key/YOUR_API_KEY

Option 2: Revoke from Google

Go to Google Account Security
Find "OpenBSP MCP" in the list
Click "Remove Access"

Both options will immediately invalidate your API key.

Setup for MCP Clients

After authenticating, add this to your MCP client configuration:

config.json

{
  "mcpServers": {
    "google-mcp": {
      "url": "https://g.mcp.openbsp.dev/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Programmatic integration

MCP clients can automate the setup by redirecting users to:

Code

https://g.mcp.openbsp.dev/auth/google?products=calendar,sheets&callback=YOUR_CALLBACK_URL

After authentication, the user is redirected to your callback with credentials in the URL fragment:

Code

YOUR_CALLBACK_URL#api_key=gmc_xxx&url=https://g.mcp.openbsp.dev/mcp&email=user@gmail.com&files=Budget.xlsx,Sales.xlsx

Parameter	Description
`api_key`	The generated API key
`url`	The MCP endpoint URL
`email`	The Google account email that authorized access
`files`	Comma-separated file names (only when Sheets authorized and files selected)

Available Tools

Calendar

Scopes requested:

calendar.events - read and write events
calendar.calendarlist.readonly - list your calendars (read-only)

Tool	Description
`list_calendars`	List all your calendars
`list_events`	Get events with optional date filters
`check_availability`	Check busy/free times (no event details exposed)
`create_event`	Create a new calendar event
`update_event`	Update an existing event
`delete_event`	Delete an event

Sheets

Scope requested:

drive.file - access only files you select or files created by the app

Tool	Description
`list_authorized_files`	List files the user has authorized for access
`get_spreadsheet`	Get spreadsheet metadata, sheets, and tables
`get_sheet_schema`	Get column names and inferred types
`describe_sheet`	Get statistical summary of all columns
`search_rows`	Search for rows matching filter criteria
`semantic_search`	AI-powered semantic search over rows (finds by meaning, not exact match)
`read_sheet`	Read data from a range (e.g., "A1:D10")
`write_sheet`	Write data to a range
`append_rows`	Append rows (supports Tables with `tableId` for footer-aware append)
`create_spreadsheet`	Create a new spreadsheet

The drive.file scope only grants access to files the user explicitly selects during authentication (via Google Drive Picker) or files created by the app. Use list_authorized_files to discover which spreadsheets are available.

Tables support: The get_spreadsheet tool returns table metadata including tableId. Pass this to append_rows for proper table-aware appending that respects footers and auto-expands the table.

Semantic search: The semantic_search tool uses AI embeddings to find rows by meaning. Powered by TAG.

Self-Hosting

Want to run your own instance? See DEPLOY.md for instructions.

FAQ

Is this official? No, this is an independent open-source project. It is not affiliated with Google or Anthropic.

Is it safe? We only request the minimum permissions needed. Your data flows directly between Google and your AI client through our server - we don't store or log it.

Can I see the code? Yes! This project is open source. Review the code, run your own instance, or contribute improvements.

What if I lose my API key? Generate a new one by authenticating again. Old keys remain valid unless you revoke them.

Does it cost anything? This public instance is free. If you self-host, you'll pay for Cloudflare Workers (generous free tier available).