# Google Workspace MCP connector The Google Workspace connector brings your users, groups, licenses, org units, roles, and usage reports into Claude, ChatGPT, Cursor, and any MCP client through one Elaichi endpoint, with each person working inside their own admin access. Source: https://elaichi.ai/connectors/googleworkspace/ ## Facts | | | | --- | --- | | Application | Google Workspace | | Category | SSO | | AI tools | 21 | | Authentication | OAuth or API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | Yes | ## What you can ask once Google Workspace is connected - List all Google Workspace groups with no members. - Which users were created in the last 14 days? - Show group members for the finance-team group. ## Connect Google Workspace in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Google Workspace. 2. Optionally set Share with, then press Connect. 3. Approve it in Google Workspace. Google Workspace's own window opens. Whoever approves it decides what this connection can reach. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Google Workspace tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Google Workspace to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Google Workspace to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Google Workspace to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Google Workspace to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Google Workspace tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Google Workspace through Elaichi ### Set up a new hire before day one IT. Create the Google Workspace account, add the person to the right groups, and confirm they sit in the correct org unit from a single request. No clicking through the admin console screen by screen. ### Finish offboarding the same afternoon IT. Look up a leaver's account, remove them from every group they belong to, and update or delete the account once HR gives the word. ### Keep group memberships honest People. Ask who is on the all-hands list or the regional sales group, spot people who moved teams months ago, and fix the membership on the spot. ### Reconcile license spend before renewal Finance. List assigned Google Workspace licenses alongside active users to find seats nobody is using, then bring a real number to the renewal conversation. ### Review admin roles and third-party tokens Security. List every role and who holds it, flag super admin assignments that should not exist, and see which outside apps have tokens granted by your users. ### Pull usage reports for the quarterly review Operations. Gather Google Workspace usage reports by org unit and turn them into a short summary of who is active and where adoption is thin. ## Frequently asked questions ### How do I connect Google Workspace to Claude? Connect Google Workspace in Elaichi first, either by signing in with your Google admin account through OAuth or by pasting an API key, whichever your organization prefers. Then open Claude, go to Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp as the endpoint. There is no OAuth application to register in Google and no client ID or secret to generate. Sign in when Claude asks and you are working with your Google Workspace users and groups. ### Does Google Workspace work with ChatGPT and Cursor as well as Claude? Yes. Once Google Workspace is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect Google Workspace once and every client sees it, with the same access rules in each. ### What can an AI agent actually do with my Google Workspace data? With Google Workspace connected, an agent can look up a user or a group, create a new account, update someone's details, add or remove people from groups, and delete an account when someone leaves. It can also list licenses, org units, admin roles and who holds them, third-party tokens users have granted, and usage reports, so you can ask questions like who is a super admin or which licenses are unused and get an answer from live records. ### Does connecting Google Workspace give the AI full admin access to my organization? No. Every request to Google Workspace runs as the person who signed in, so an agent can only see and change what that person's own Google admin role allows. Elaichi can narrow that further, for example to reading users and groups only, but it can never grant more than the person already has in Google Workspace. ### Can my team share one Google Workspace connection? Yes. One admin connects Google Workspace in Elaichi and shares the connection with a team, and nobody else ever handles an API key or signs in to Google on the team's behalf. Each person still signs in to Elaichi as themselves, so the audit log records exactly who created a user or removed a group member, not a shared account. ### Can I stop an agent from deleting or changing things in Google Workspace? Yes. Restrictions in Elaichi apply per action, so you can allow listing Google Workspace users and groups while blocking creating, updating, or deleting them. A blocked action is never shown to Claude, ChatGPT, Cursor, or any other client at all, so no prompt, however worded, can reach it. ### What happens to a Google Workspace connection when someone leaves? Offboarding that person in Elaichi ends their access to Google Workspace through every AI client at once. If they had shared the connection with a team, it keeps working for everyone else. Disconnecting Google Workspace in Elaichi removes it from every client in one step, with no need to visit Claude, ChatGPT, and Cursor separately. ## All 21 Google Workspace tools Every tool below is callable through https://api.elaichi.ai/mcp once Google Workspace is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all Google Workspace users** (List). List all Google Workspace users in the directory. Returns a collection of user objects including id, primaryEmail, and name. - **Get single Google Workspace user by ID** (Get). Get a single Google Workspace user by id. Returns the full user object including id, primaryEmail, name, and associated account details. Required: id. - **Create a Google Workspace user** (Create). Create a new Google Workspace user in the directory. Returns the created user object including id and primaryEmail. Required: primaryEmail, name (givenName and familyName), and password. - **Update a Google Workspace user by ID** (Update). Update an existing Google Workspace user by id, replacing the resource with the supplied fields. Returns the updated user object including id and primaryEmail. Required: id. - **Delete a Google Workspace user by ID** (Delete). Delete a Google Workspace user by id. Returns an empty 204 response on success. Required: id. - **List all Google Workspace groups** (List). List groups in the Google Directory. Returns an array of group objects for the customer. - **Get single Google Workspace group by ID** (Get). Get a single Google Directory group by id. Returns the full group object. Required: id. - **List all Google Workspace group members** (List). List all members of a Google group. Returns member records for the specified group. Required: group_id. - **Get single Google Workspace group member by ID** (Get). Get a single member of a Google group by id. Returns the member record for the specified group and member. Required: group_id, id. - **Create a Google Workspace group member** (Create). Add a new member to a Google group. Returns the created member record. Required: group_id. - **Update a Google Workspace group member by ID** (Update). Update an existing member of a Google group by id. Returns the updated member record. Required: group_id, id. - **Delete a Google Workspace group member by ID** (Delete). Remove a member from a Google group by id. Returns an empty response on success. Required: group_id, id. - **List all Google Workspace userinfo** (List). Retrieves basic profile information about the authenticated user in Google Calendar. The response includes essential details such as the user's unique identifier (sub), full name (name), first name (given_name), last name (family_name), profile picture URL (picture), and email address (email). - **Get single Google Workspace customer by ID** (Get). Get a Google Admin Directory customer by id. Returns the customer object from the Admin Directory API. Required: id. - **List all Google Workspace licenses** (List). List Google Workspace product licenses assigned to users for a given product. Returns user license assignment records. Required: product_id. - **List all Google Workspace usage reports** (List). List Google Admin usage reports for all users on a specific date. Returns usage activity records per user for the given date. Required: date (in YYYY-MM-DD format). - **Create a Google Workspace oauth token** (Create). Exchange an authorization code or refresh token for a Google OAuth access token via the Google OAuth2 token endpoint. Returns: access_token, token_type, expires_in, and optionally refresh_token. Required: grant_type, client_id, client_secret, and either code with redirect_uri (for authorization_code grant) or refresh_token (for refresh_token grant). - **List all Google Workspace roles** (List). List all roles defined in the Google Admin Directory for the authenticated customer. Returns an array of role objects from the directory. - **List all Google Workspace role assignments** (List). List all role assignments for your Google Admin Directory customer account. Returns a collection of role assignment items from the Google Admin SDK. - **List all Google Workspace tokens** (List). List all OAuth tokens issued by a Google user to third-party applications. Returns a collection of token items associated with the user. Required: user_id. - **List all Google Workspace org units** (List). List Google organizational units for the customer. Returns an array of organizationUnits objects from the Google Admin Directory API.