Gmail
by Gmail
Google's own remote MCP server for Gmail. Search threads, read messages and drafts, manage labels, and trash or unspam mail from an AI assistant. 21 tools, 5 read-only, 8 annotated destructive, and no tool that sends email.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Gmail via MCP
https://gmailmcp.googleapis.com/mcp/v1Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Gmail Tools & Capabilities (21)
Creates a new draft email in the authenticated user's Gmail account. This tool takes recipient addresses, a subject, and body content as inputs. If the draft is created as a reply to an existing message, the ID of the original message should be passed to the tool in the replyToMessageId field. Returns a Draft object with only the `id` field populated.
Lists draft emails from the authenticated user's Gmail account. This tool can filter drafts based on a query string and supports pagination. It returns a list of drafts, including their IDs and subjects (unless `view` is set to `DRAFT_VIEW_METADATA_ONLY`). `page_token` can be used to paginate the results. To retrieve subsequent pages of results, use the `page_token` returned in the previous response. The `view` parameter controls which fields are populated in the response. By default (or with `DRAFT_VIEW_FULL`), it returns full content. Use `DRAFT_VIEW_METADATA_ONLY` to exclude sensitive content like subject and body.
Retrieves a specific email thread from the authenticated user's Gmail account, including a list of its messages. The optional `messageFormat` parameter controls the format of the messages returned. By default (or with `FULL_CONTENT`), it returns the full content of messages. We recommend using `PLAIN_TEXT`, which returns the plain text body without the HTML body. Use `MINIMAL` to include only subject and snippet (excluding body). Use `METADATA_ONLY` to include only basic metadata (message ID, thread ID, labels, timestamp, and size estimate).
Retrieves a specific email message from the authenticated user's Gmail account by its unique message ID. Use this tool to inspect a single, individual email when you already know its message ID. If the user wants to read a specific email in detail, check the exact wording of a message, or examine attachment metadata for a single email, this is the right tool. It is not suitable for retrieving entire conversations or viewing back-and-forth discussion threads; use the 'get_thread' tool instead. Key indicators include if the user asks for the full content of a specific message ID returned by a previous search, or if the query asks to inspect a specific individual email rather than an entire thread. Example user prompts are: "Get the full text of message ID 18f123456789abcd.", "Read the latest message in that thread from Alice.", and "What are the attachment names in the email I just received from HR?" The optional `messageFormat` parameter controls the format of the message returned. By default (or with `FULL_CONTENT`), it returns the full content of the message. We recommend using `PLAIN_TEXT`, which returns the plain text body without the HTML body. Use `MINIMAL` to include only subject and snippet (excluding body). Use `METADATA_ONLY` to include only basic metadata (message ID, thread ID, labels, timestamp, and size estimate).
Lists email threads from the authenticated user's Gmail account. This tool can filter threads based on a query string and supports pagination. It returns a list of threads, including their IDs and related messages. Each related message contains details like a snippet of the message body, the subject, the sender, the recipients etc. The `view` parameter controls which fields are populated in the related messages. By default (or with `THREAD_VIEW_MINIMAL`), it includes subject and snippet. Use `THREAD_VIEW_METADATA_ONLY` to exclude subject and snippet. Note that the full message bodies are not returned by this tool; use the 'get_thread' tool with a thread ID to fetch the full message body if needed. Threads with excluded criteria may still appear in the results. This occurs because Gmail identifies matching messages first. For example, if you search for -is:starred, Gmail will find an entire thread if it contains at least one unstarred message, even if other emails in that same conversation are starred.
Adds labels to an entire thread in the authenticated user's Gmail account. This operation affects all messages currently in the thread and any future messages added to it. If unsure of the thread ID, use the `search_threads` tool first. If unsure of a user label's ID, use the `list_labels` tool first to discover available labels and their IDs. To add a Trash label or a Spam label to a thread, or move a specific thread to Trash, please use the `apply_sensitive_thread_label` tool instead.
Removes labels from an entire thread in the authenticated user's Gmail account. If unsure of the thread ID, use the `search_threads` tool first. If unsure of a user label's ID, use the `list_labels` tool first.
Adds a sensitive label (Trash or Spam) to an entire thread in the authenticated user's Gmail account. This operation affects all messages currently in the thread and any future messages added to it. Use this tool to trash a thread, mark a thread as spam, or move the specified thread to Trash. To find the thread ID, use the `search_threads` tool first.
Moves an entire thread to the Trash in the authenticated user's Gmail account. This operation affects all messages currently in the thread and any future messages added to it. If unsure of the thread ID, use the `search_threads` tool first.
Removes an entire thread from the Trash in the authenticated user's Gmail account. If unsure of the thread ID, use the `search_threads` tool first.
Marks an entire thread as Spam in the authenticated user's Gmail account. This operation affects all messages currently in the thread and any future messages added to it. If unsure of the thread ID, use the `search_threads` tool first.
Unmarks an entire thread as Spam in the authenticated user's Gmail account. If unsure of the thread ID, use the `search_threads` tool first.
Lists all labels available in the authenticated user's Gmail account. Use this tool to discover the `id` of a label before calling `label_thread`, `unlabel_thread`, `label_message`, or `unlabel_message`. Note: the system labels, `DRAFT` and `SENT`, cannot be set on messages and are read only.
Adds one or more labels to a specific message in the authenticated user's Gmail account. To find the message ID, use tools like `search_threads` or `get_thread`. If unsure of a user label's ID, use the `list_labels` tool first to discover available labels and their IDs. To add a Trash label or a Spam label to a message, or move a specific message to Trash, please use the `apply_sensitive_message_label` tool instead.
Removes one or more labels from a specific message in the authenticated user's Gmail account. To find the message ID, use tools like `search_threads` or `get_thread`. If unsure of a user label's ID, use the `list_labels` tool first to discover available labels and their IDs.
Adds a sensitive label (Trash or Spam) to a specific message in the authenticated user's Gmail account. Use this tool to trash a message, mark a message as spam, or move the specified message to Trash. To find the message ID, use tools like `search_threads` or `get_thread`. To find the draft message ID, use tools like `list_drafts`.
Moves a specific message to the Trash in the authenticated user's Gmail account. To find the message ID, use tools like `search_threads` or `get_thread`. To find the draft message ID, use tools like `list_drafts`.
Removes a specific message from the Trash in the authenticated user's Gmail account. To find the message ID, use tools like `search_threads` or `get_thread`.
Marks a specific message as Spam in the authenticated user's Gmail account. To find the message ID, use tools like `search_threads` or `get_thread`.
Unmarks a specific message as Spam in the authenticated user's Gmail account. To find the message ID, use tools like `search_threads` or `get_thread`.
Creates a new label in the authenticated user's Gmail account. Supports creating nested labels (sub-labels) using a forward slash (e.g., 'Projects/Alpha/Sprint-1'). By default, parent labels will be automatically created if they do not exist.
Read from the server on 2026-08-17, including each tool's own safety annotations.
Limits
- Eight tools are annotated destructive, on a personal mailbox. Blanket auto-approval on this connector lets an agent move mail into Trash or Spam and strip labels — including
INBOX, which archives — with no confirmation step. Approve those eight case by case, or load the connector with tool filtering where your client supports it. This is the single configuration decision that matters here. - Label removal has no undo tool. Trash and Spam moves are reversible through
untrash_message,untrash_thread,unmark_message_spamandunmark_thread_spam. Removing a label is not: nothing on this server reports which labels a message previously carried, so the information needed to reverse the change is gone the moment it is made. - Thread-level actions apply to mail that has not arrived yet. Six tools state that the operation affects every message currently in the thread and any future message added to it. A thread trashed today swallows tomorrow's reply.
- This is a Developer Preview. Every Google page cited here carries the Google Workspace Developer Preview Program banner. Preview features can change or be withdrawn, and the tool surface visibly has been changing — Google's own reference page still documents ten tools against 21 live.
- Google's own documentation undercounts the tools by more than half. The setup page lists 9 tools, the MCP reference toolset lists 10, and the reference sidebar carries per-tool pages for 11. The live server returns 21. The twelve undocumented ones are exactly the consequential set — every trash, untrash, spam, unspam and sensitive-label tool — and each returns HTTP 404 at its expected reference URL. There is no published Google description, scope mapping or annotation justification for any of the eight destructive tools.
- Two Google sources disagree about the
list_draftsdefault. The live tool description says the view defaults to full content and that you should setDRAFT_VIEW_METADATA_ONLYto exclude subject and body; theviewparameter's own schema, in the same response, says it defaults to metadata only. Both are Google's, in the same object. We did not call the tool, so we cannot say which holds — assume drafts may be returned in full and set the parameter explicitly. create_draftattachments: schema and docs disagree. The input schema defines anattachmentsarray with a 25MB combined limit; Google's reference page for the same tool states that creating drafts with attachments is not supported yet. Untested by us either way.- Prompt injection is Google's own stated risk, not ours. Google's setup page warns that because MCP hosts have access to powerful tools through this server, they can read, modify and delete data in your Google Account, and that you "must screen prompts and responses for malicious content or prompt injection attacks". It recommends its Model Armor service or a documented equivalent, and advises against having an assistant process email from unverified senders. On a connector whose entire input is untrusted text written by strangers, that warning is load-bearing.
gmail.readonlyis a restricted scope covering the whole mailbox. There is no per-folder, per-label or per-sender narrowing anywhere in the tool surface or the consent flow. You grant read of everything or you do not connect.- No
.well-known/oauth-protected-resourcedescriptor. The endpoint 404s on it, so the OAuth arrangement is documented by Google rather than declared by the server over the wire. - We never read a mailbox. Our verification was an anonymous
tools/list, which returns tool definitions and no mail. We additionally called one read-only tool with no credential to confirm the gate; it returned HTTP 401 with a missing-credential message and no data. No authenticated call was made, no message was read, and no draft, label or trash operation was ever performed.
Frequently asked questions
Can the Gmail MCP server send email on my behalf?
No. A live tools/list on 2026-08-17 returned 21 tools and none of them sends, replies or forwards. create_draft writes a draft into your Drafts folder and returns its ID; sending stays a manual step in Gmail. Google's own setup page describes the same boundary, telling you to review and send the draft yourself.
Which OAuth scopes does the Gmail MCP server request?
Two. Google's setup pages tell you to add exactly gmail.readonly and gmail.compose to the consent screen. Neither one permits immediate permanent deletion — that requires the far broader mail.google.com scope, which Google's setup pages never ask for. Consenting therefore grants full mailbox read plus draft and label management.
Which Gmail MCP tools are annotated destructive?
Eight of the twenty-one: trash_message, trash_thread, mark_message_spam, mark_thread_spam, apply_sensitive_message_label, apply_sensitive_thread_label, unlabel_message and unlabel_thread. Each removes mail from where you expect to find it — trash, spam, or a label you filed it under. Every one is recoverable inside Gmail, and none is recoverable through this connector.
Why is removing a label counted as destructive?
Because a Gmail label is where a message lives, not a tag beside it. unlabel_thread accepts system label IDs including INBOX, so removing that label archives the thread out of your inbox. It also accepts TRASH and SPAM. The tool cannot un-remove anything, which is what the destructive annotation asserts.
Does the Gmail MCP server permanently delete email?
No tool on the live server deletes permanently. The eight destructive tools move mail to Trash or Spam, or strip a label. Google documents permanent deletion as requiring the restricted mail.google.com scope, which the Gmail MCP setup instructions never request. Trashed mail follows Gmail's normal retention and can be restored with untrash_message or untrash_thread.
Why does Anthropic's directory list 29 Gmail tools when 21 are live?
The listing is stale in one direction. All 21 live tool names appear in the directory's 29, so nothing was renamed or invented. The eight extras — including send_message, delete_label and create_filter — are not on the server. A reader trusting the listing would expect a connector that sends mail and deletes labels, and it does neither.
Do I need a paid plan to add the Gmail MCP server to Claude?
Yes, and a Google Cloud project too. Google states you need a Claude Enterprise, Pro, Max or Team plan, then must add it as a custom connector with your own OAuth client ID and secret. You also enable the Gmail API and Gmail MCP API in a Cloud project. It is a Developer Preview feature, not a one-click install.
Sources
- Configure the Gmail MCP server (retrieved 2026-08-17, HTTP 200, zero redirects; page last updated 2026-07-27). Source for the two OAuth scopes, the Google Cloud project and API-enablement prerequisites, the Claude custom-connector steps and plan requirement, the redirect URI, the test prompts, the OAuth-log troubleshooting step, the nine-tool documented list, and the prompt-injection warning · retrieved 2026-08-17
- MCP Reference:
gmailmcp.googleapis.com(retrieved 2026-08-17, HTTP 200; page last updated 2026-07-21). Source for the global endpoint, the single-toolset structure and the ten-tool reference list · retrieved 2026-08-17 - Google's per-tool MCP reference pages under
https://developers.google.com/workspace/gmail/api/reference/mcp/tools_list/(retrieved 2026-08-17). Eleven pages returned HTTP 200 and each publishes that tool's annotations and authorisation scopes, which matched the live handshake exactly. Source for the per-tool scope mapping and for thecreate_draftattachment limitation. The twelve trash, spam, untrash, unspam and sensitive-label tools each returned HTTP 404 at the same path pattern · retrieved 2026-08-17 - Configure the Google Workspace MCP servers (retrieved 2026-08-17, HTTP 200). Independently confirms the same two Gmail scopes alongside the other Workspace MCP servers, and the per-product service-enablement model · retrieved 2026-08-17
- Configure security for Google Workspace MCP servers (retrieved 2026-08-17, HTTP 200; page last updated 2026-08-11). Source for the Model Armor screening guidance and the statement that screening prompts and responses is required · retrieved 2026-08-17
- Choose Gmail API scopes (retrieved 2026-08-17, HTTP 200). Source for Google's own descriptions of
gmail.readonlyandgmail.compose, their restricted classification, and the statement that immediate permanent deletion bypassing Trash requires thehttps://mail.google.com/scope · retrieved 2026-08-17 - Live
tools/listhandshake againsthttps://gmailmcp.googleapis.com/mcp/v1— 21 tools with descriptions, JSON Schemas and safety annotations (2026-08-17, HTTP 200, noWWW-Authenticateheader). Source for every tool name, every annotation state, every parameter default and every enum quoted above. No tool was called against any mailbox · retrieved 2026-08-17 - Live
initializeagainst the same endpoint (2026-08-17, HTTP 200) — returnedserverInfoStatelessServerversionESF, protocol2025-06-18, and an emptyinstructionsfield · retrieved 2026-08-17 - Live unauthenticated
tools/callof one read-only listing tool against the same endpoint (2026-08-17) — returned HTTP 401 with "Request is missing required authentication credential. Expected OAuth 2 access token" and no data. This is what setsauthVerified: the server demonstrated the gate rather than a document asserting it · retrieved 2026-08-17 https://gmailmcp.googleapis.com/.well-known/oauth-protected-resource— HTTP 404 on 2026-08-17. No RFC 9728 descriptor is published, so the scope detail comes from Google's documentation · retrieved 2026-08-17- Anthropic Connectors Directory entry (from the 2026-08-16 directory snapshot; partner tier, communication category,
https://gmailmcp.googleapis.com/mcp/v1endpoint, streamable-http transport,auth_requiredposture, Google as author, and 29 tool names against 21 live) · retrieved 2026-08-16 https://developers.google.com/robots.txt(retrieved 2026-08-17, HTTP 200) —User-agent: *with a singleDisallow: /youtube/partner/, noContent-Signalline of any kind. Every documentation path cited above is permitted.https://developers.google.com/llms.txtreturns HTTP 404 · retrieved 2026-08-17- Google Privacy Policy (HTTP 200 on 2026-08-17). Retrieved, but it is Google's general account-wide policy with no MCP-specific or connector-specific section, so nothing is cited from it · retrieved 2026-08-17
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Communication
- Developer
- Gmail
- Tools
- 21
- Domain
- gmailmcp.googleapis.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.