Repository navigation
fix(providers): the google providers ask only the scopes auto's clients cover - #330
Merged
Merged
Conversation
…ts cover Every Google provider a registered client of Auto serves now asks scopes those clients cover, so a person can connect it through Auto's client again. gmail asks gmail.readonly alone. Google's Gmail MCP server takes it for search_threads, get_thread, get_message, list_drafts and list_labels; its tools that draft and label take gmail.compose or gmail.modify, and it has no tool that sends, so the provider reads mail and neither drafts, labels nor sends any. google-analytics-admin asks analytics.readonly. Its document keeps the nine operations Google's Admin API reference lets that scope call and leaves out customDimensions.create and keyEvents.create, which take analytics.edit alone. google-docs asks documents.readonly and documents, google-sheets spreadsheets.readonly and spreadsheets, google-slides drive.file, presentations.readonly and presentations, and google-drive drive.file alone, which reaches the files a person opens with Auto or Auto creates and not the rest of their Drive. No Google provider asks drive.readonly, so gmail is the one that names a restricted scope in its description. A connection's record answers granted_scope, the scope its authorization server granted, while its credential keeps the scope its way asked, so Studio and an agent see a connection that holds less than its provider asked. The serving of a connection of consent takes granted_scope. The guide for connections, the HTTP reference, the OpenAPI document and the two READMEs give the new scopes, the tier Google classifies each provider in, and what the scopes leave out. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
rami-hatoum
pushed a commit
that referenced
this pull request
Oct 26, 2026
🤖 I have created a release *beep* *boop* --- ## [0.22.1](v0.22.0...v0.22.1) (2026-10-26) ### Bug Fixes * **providers:** the google providers ask only the scopes auto's clients cover ([#330](#330)) ([cf651 43](cf65143b7a317d2c2c96880 6de4fd1b05797249a)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The shipped Google providers ask only the scopes Auto's registered clients cover, and the least each provider's tools need. Gmail asks the read-only scope alone and says it reads, searches and lists, and drafts, labels and sends nothing. Google Analytics Admin asks the read-only scope, so its operations that created custom dimensions and key events are gone and its reads remain. Google Docs and Google Sheets ask their own APIs' scopes, which their servers use; Google Slides and Google Drive ask the scope for the files a person opens with Auto or Auto creates, so Drive reaches less, not does less. Nothing asks the scope that reads all of a person's Drive or the one that edits Analytics any more. A way whose scope no client covers is not offered, so these six providers come back at Auto's hosted runtime with this change.
A connection now records the scope the vendor granted beside the scope its provider asked,
granted_scopeon the connection and in what the runtime answers about it, so a connection that holds less than its provider asked can be seen. The connections guide, the providers README and the HTTP reference say the new scopes and what each provider no longer does, and the guide's example of registered clients matches Auto's.Campaign Manager 360, Display & Video 360 and its reports, and Search Ads 360 are unchanged; no registered client covers their scopes, so they are not offered until one does.