From d4a661a6eafbeafbb7aeb06f3d6cad1057814f10 Mon Sep 17 00:00:00 2001 From: Muhammad Kumail Date: Fri, 24 Jul 2026 22:02:55 +0000 Subject: [PATCH] Add Google Drive MCP tab alongside the existing Google Drive API docs Documents the native, Google-hosted Drive MCP server (drivemcp.googleapis.com) as a second tab, matching the Notion two-way pattern: per-user OAuth via a Google Cloud OAuth client (no dynamic client registration), the Drive MCP API enablement step, and Google's fixed MCP tool set. Co-authored-by: c1-squire-dev[bot] --- product/admin/mcp-server/google-drive.mdx | 127 +++++++++++++++++++--- 1 file changed, 111 insertions(+), 16 deletions(-) diff --git a/product/admin/mcp-server/google-drive.mdx b/product/admin/mcp-server/google-drive.mdx index 2a101171..57730b64 100644 --- a/product/admin/mcp-server/google-drive.mdx +++ b/product/admin/mcp-server/google-drive.mdx @@ -1,18 +1,115 @@ --- title: Set up the Google Drive MCP server -description: Connect Google Drive to C1 with per-user OAuth or a service account, then register the Google Drive MCP server and govern its tools. +description: Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then register the server and govern its tools. og:title: Set up the Google Drive MCP server -og:description: Connect Google Drive to C1 with per-user OAuth or a service account, then register the Google Drive MCP server and govern its tools. +og:description: Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then register the server and govern its tools. sidebarTitle: Google Drive --- -{/* Editor Refresh: 2026-06-11 */} +{/* Editor Refresh: 2026-07-24 */} **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Google Drive MCP server lets you govern access to Google Drive — files, folders, shared drives, permissions, comments, and revisions — as tools your AI clients can call through C1. +C1 can govern Google Drive access two ways. Both let your AI clients read from and act on Drive through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: + +- **Google Drive MCP** — listed as plain **Google Drive** in your catalog. C1 registers Google's own hosted Drive MCP server (`drivemcp.googleapis.com`) as a downstream server C1 governs. Authentication is per-user OAuth using a Google Cloud OAuth client you create — Google doesn't support dynamic client registration (DCR) for this server, so there's no bearer token or API key fallback either. Tool calls run with the connected user's own Drive permissions, scoped to whichever OAuth scopes you grant. +- **Google Drive API** — C1 hosts its own MCP server that translates the Google Drive REST API into tools. You choose between per-user OAuth or a service account with domain-wide delegation (Workspace only), and you scope access with the OAuth or delegated scopes you configure. + +| | Google Drive MCP | Google Drive API | +| :--- | :--- | :--- | +| **Who hosts the MCP server** | Google | C1 | +| **Authentication** | Per-user OAuth with a Google Cloud OAuth client you create — no dynamic client registration, bearer token, or API key option | Per-user OAuth, or a service account with domain-wide delegation (Workspace only) | +| **Access scoping** | The connected user's Drive permissions, within the OAuth scopes you grant (`drive`, `drive.readonly`, or `drive.file`) | The OAuth scopes you configure, or the scopes you delegate to the service account | +| **Tool surface** | Google's own fixed tool set: search, read and download content, file metadata, permissions, recent files, plus file creation and copying | Files, folders, shared drives, permissions, comments, and revisions, mapped to Drive API endpoints | +| **Setup effort** | Create a Google Cloud OAuth client and enable the Drive MCP API, then register in C1 | Create an OAuth client or service account first, then register in C1 | + +Use the native **Google Drive MCP** option (listed as plain **Google Drive** in your catalog) if Google's own tool set covers what you need and per-user OAuth is acceptable for your tenant. Use **Google Drive API** if you need a shared service-account credential, or you want the broader tool surface — including permissions, comments, and revisions — that C1's own translation provides. + + + + + +C1 registers as a client of Google's own hosted Drive MCP server ([Configure the Drive MCP server](https://developers.google.com/workspace/drive/api/guides/configure-mcp-server)) rather than translating the Google Drive REST API itself. Your users' AI clients still only ever see C1-governed MCP tools, but C1 proxies each tool call straight through to `drivemcp.googleapis.com` under the connected user's authorized session, then returns the result. The tools available are exactly the ones Google's own MCP server exposes — C1 doesn't reshape or add to them. + +## Before you begin + +- AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). +- A Google Cloud project with an OAuth client — see [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup). This option additionally requires enabling the **Google Drive MCP API** in that project (covered below); the shared guide doesn't cover that API since it's specific to this option. +- Each user needs a Google account with access to the Drive content you want their AI client to reach. + + +In your MCP server catalog, this option is listed as **Google Drive** — distinct from the **Google Drive API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. + + +## Set up per-user OAuth + +Per-user OAuth with a Google Cloud OAuth client is the only authentication method this option supports — Google doesn't offer dynamic client registration, a bearer token, or an API key for its hosted Drive MCP server. Each user authorizes individually with their own Google account. + +### Create a Google OAuth client + +If you already completed [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) for another Google connector, you can reuse that project and OAuth client — you only need to enable one additional API and add the Drive MCP scopes. + + + +Follow [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) to create or select a project, grant your users the **Service Usage Consumer** role, and create an OAuth client with the redirect URI set to `https://accounts.conductor.one/auth/callback`. + + +In the same project, also enable the **Google Drive MCP API** (`drivemcp.googleapis.com`): go to **APIs & Services** > **Library**, search for **Google Drive MCP API**, and select **Enable**. Google's hosted Drive MCP server requires this API alongside the Google Drive API. See Google's [Configure the Drive MCP server](https://developers.google.com/workspace/drive/api/guides/configure-mcp-server) documentation. + + +On the OAuth consent screen's **Data Access** page, add the scopes you want to grant: `https://www.googleapis.com/auth/drive` for full read/write access, `https://www.googleapis.com/auth/drive.readonly` for read-only access, or `https://www.googleapis.com/auth/drive.file` to limit access to files a user opens or creates through the connection. + + + +### Register the server with OAuth + +With your OAuth client ready, register the server and provide its credentials. + + + +Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive** from the catalog. + + +When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your OAuth client's **client ID**, **client secret**, and the scopes you configured. There's no **Use dynamic client registration** toggle for this server — Google doesn't support it. + + +Save your changes. The first time a user calls a Google Drive tool from their AI client, they're prompted to connect their Google account. + + + +## What access is granted + +Once a user authorizes, tool calls run with that user's own Drive permissions, limited to whichever OAuth scope you configured — `drive` for full read/write access to their Drive, `drive.readonly` for read-only access, or `drive.file` for access limited to files the user opens or creates through the connection. Google's hosted server exposes its own fixed tool set for searching, reading, and managing files — `search_files`, `list_recent_files`, `get_file_metadata`, `get_file_permissions`, `download_file_content`, `read_file_content`, `create_file`, and `copy_file` (see Google's [MCP Reference: drivemcp.googleapis.com](https://developers.google.com/workspace/drive/api/reference/mcp)). + +## How Google Drive MCP credentials are shared + +This option only supports per-user OAuth — there's no shared, service-account, or bearer-token mode. Every tool call runs under the calling user's own Google identity, and Google attributes each action to that individual. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). + +## Discover and govern tools + +After you register the server, C1 runs tool discovery against Google's Drive MCP server. Discovered tools appear on the server's **Tools** tab and include Google's own search, file content, metadata, permissions, and file creation and copying tools. + +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). + +Before anyone can call a Google Drive tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. + + +Tool discovery runs even if authentication isn't complete yet, so seeing discovered tools doesn't confirm a user has authorized. You confirm access when an approved user successfully calls a Google Drive tool from their AI client. + + +## Manage access to Google Drive MCP + +- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the server's authentication settings in C1. +- **Adjust scopes** by editing them on the OAuth consent screen's **Data Access** page; users must reconnect their Google account to grant any newly added scopes. +- **An individual user can revoke access at any time** from their Google Account's linked apps page. See Google's [Manage third-party apps & services with access to your account](https://support.google.com/accounts/answer/3466521) documentation. + + + + + +C1 hosts the Google Drive MCP server, so your users' AI clients only ever see MCP tools — they never call Google Drive directly. When an AI client calls one of these tools, C1 makes the matching request to the Google Drive API using the credentials you configure here, then returns the result to the AI client. The credentials you set up below are what C1 uses to call Google Drive on your users' behalf. Google Drive supports two ways to authenticate, and you choose one when you register the server: @@ -21,12 +118,6 @@ Google Drive supports two ways to authenticate, and you choose one when you regi For a deeper comparison of shared versus per-user credentials, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## How C1 connects to Google Drive - -C1 hosts the Google Drive MCP server, so your users' AI clients only ever see MCP tools — they never call Google Drive directly. When an AI client calls one of these tools, C1 makes the matching request to the Google Drive API using the credentials you configure here, then returns the result to the AI client. - -The credentials you set up below are what C1 uses to call Google Drive on your users' behalf. - ## Before you begin - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). @@ -34,7 +125,7 @@ The credentials you set up below are what C1 uses to call Google Drive on your u - For the service-account option, a Google Workspace administrator to set up [domain-wide delegation](https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation). -If you don't see **Google Drive** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP server catalog, this option is listed as **Google Drive API** — distinct from the **Google Drive** entry, which connects to Google's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -74,10 +165,10 @@ With your OAuth client ready, register the server and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive** from the catalog. +Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive API** from the catalog. -When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth client's **client ID** and **client secret**, plus the scopes you configured. Also enter the **Google Cloud Quota Project ID** — the ID of the project where you enabled the Google Drive API and granted users the Service Usage Consumer role. +When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your OAuth client's **client ID** and **client secret**, plus the scopes you configured. Also enter the **Google Cloud Quota Project ID** — the ID of the project where you enabled the Google Drive API and granted users the Service Usage Consumer role. Save your changes. The first time a user calls a Google Drive tool from their AI client, they're prompted to connect their Google account. @@ -113,7 +204,7 @@ With your service account ready, register the server and provide its key. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive** from the catalog. +Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **JWT Bearer (RFC 7523)** and provide the service account's JSON key and the scopes you delegated. @@ -123,7 +214,7 @@ Save your changes. C1 starts a sync that discovers the tools the Google Drive se -## How Google Drive credentials are shared +## How Google Drive API credentials are shared How Google Drive sees your users' activity depends on the method you chose: @@ -144,8 +235,12 @@ Before anyone can call a Google Drive tool, it must be approved, added to a tool Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Google Drive credentials when an approved user successfully calls a Google Drive tool from their AI client. -## Manage your Google Drive credentials +## Manage your Google Drive API credentials - **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the server's authentication settings in C1. - **Rotate the service account key** by generating a new JSON key in the Cloud Console, updating it in C1, then deleting the old key. - **Adjust access** by editing the OAuth client's scopes, or the scopes granted to the service account in domain-wide delegation. + + + +