MCP Server for Google Chat with ACL
An MCP server that connects Claude Desktop to Google Chat. It is designed to run locally on each user's machine: Claude Desktop spawns the server automatically and communicates with it over stdio, so no separate process or network endpoint is needed.
Key features
- Per-space allowlist: only the spaces you list are reachable, each with read access, write access or both (independent of each other).
- No direct messages: sending to DMs and group chats is blocked.
- Separate tools for interactive and automated sends:
send_messageposts only to regular spaces and is meant to require your approval in the client;send_message_unattendedposts only to spaces marked:unattended, for scheduled tasks. When the client supports it,send_messagealso asks you to confirm the exact text and target space. - Your own identity: each user authenticates with their own Google account, so messages come from the real person, not a shared bot.
See docs/configuration.md for everything that can be configured, and its security implications.
Available tools
Setup
1. OAuth credentials on Google Cloud Console
-
Open console.cloud.google.com and select (or create) a project
-
Go to APIs & Services → Library, search for Google Chat API and enable it
-
Go to APIs & Services → OAuth consent screen:
- Choose Internal if you use a Google Workspace organisation (no verification required), otherwise External
- Add the following scopes:
https://www.googleapis.com/auth/chat.spaces.readonlyhttps://www.googleapis.com/auth/chat.messageshttps://www.googleapis.com/auth/chat.memberships.readonly
-
Go to APIs & Services → Credentials → Create Credentials → OAuth client ID:
- Application type: Desktop app
- Give it a name (e.g. "Claude MCP")
-
Click Download JSON and save the file as:
~/.config/google-chat-mcp/client_secrets.jsonThe structure of the file matches
client_secrets.example.jsonin this repo.On Windows with WSL, this path is inside the WSL filesystem (see below).
2. Installing WSL on Windows
Skip this section on Mac or Linux.
-
Open PowerShell as Administrator and run:
wsl --installThis installs WSL 2 with Ubuntu. A system restart is required.
-
After restarting, Ubuntu launches automatically. Create your user when prompted.
-
Inside the Ubuntu terminal, install
uv:curl -LsSf https://astral.sh/uv/install.sh | sh source ~/.bashrc -
Create the config folder and copy the
client_secrets.jsondownloaded earlier:mkdir -p ~/.config/google-chat-mcp # Copy the file from Windows (replace "YourUser" with your Windows username): cp /mnt/c/Users/YourUser/Downloads/client_secrets*.json ~/.config/google-chat-mcp/client_secrets.json
First run: OAuth authentication
Run this command once, in a terminal on your machine, to authorise access to your Google account — it is a separate CLI step, not something Claude runs for you, and it must be done before Claude Desktop is configured to start the server:
uvx "git+https://github.com/nuccio/google-chat-mcp" auth
A browser window will open. Sign in with your Google account and grant access. The token is saved to ~/.config/google-chat-mcp/token.json and refreshed automatically on subsequent runs. Its structure matches token.example.json in this repo.
Finding space IDs
To configure which spaces are accessible, you need their resource name (e.g. spaces/AAABBBCCC). There are two ways to find it.
Option A — CLI (after completing the auth step)
uvx "git+https://github.com/nuccio/google-chat-mcp" spaces
This prints a table of all spaces your account can access:
spaces/AAABBBCCC Team General [SPACE]
spaces/DDDEEEFFF Announcements [SPACE]
spaces/GGGHHH111 Alice Johnson [DIRECT_MESSAGE]
The first column is the value to use with --space.
Option B — Google Chat URL
Open chat.google.com in your browser, navigate to the space, and look at the URL:
https://chat.google.com/room/AAABBBCCC/...
^^^^^^^^^^^
The resource name is spaces/ followed by that segment.
Claude Desktop configuration
See docs/claude-desktop.md for where to put the configuration (macOS/Linux and Windows with WSL), and docs/configuration.md for what each option means.
Local development
git clone https://github.com/nuccio/google-chat-mcp
cd google-chat-mcp
uv pip install -e ".[dev]"
For running tests, including integration tests against real Google Chat spaces, see tests/README.md. To try latest in Claude Desktop before promoting it to stable, see docs/manual-testing.md.
Release and branch policy
Two tags separate the version people use every day from the one being tried:
Clients configured with stable are not affected by bugs that the automated tests did not catch: a change reaches them only after someone has tried it in a real client. Some problems only show up there — for example, whether the client supports a given MCP feature.
Flow of a change:
- The change is developed on its own branch, usually one per issue, and proposed with a pull request.
- The automated tests run on every pull request (the Tests workflow,
.github/workflows/tests.yml, on Python 3.11–3.13) and must pass before merging. Integration tests need a real OAuth token and are run by hand (see tests/README.md). - The pull request is merged into
mainwith rebase: merge commits are disabled on this repository, and rebase keeps each commit of the branch onmain. The tests run again onmain, and if they passlatestmoves to the new commit. latestis tried in Claude Desktop, following docs/manual-testing.md.- If it works,
latestis promoted tostable. If a bug turns up,stablestays where it is, and the fix goes through the same flow.
Promoting to stable: on GitHub, Actions → Release tags → Run workflow. Leave "Commit" empty to promote the commit latest points to, or enter the SHA of an earlier commit on main (e.g. to roll stable back). Commits that are not on main are refused. The workflow is in .github/workflows/release-tags.yml.
A green Tests run is required before merging only if it is set as a required status check in the branch protection of main (Settings → Branches); otherwise the rule relies on whoever merges.
For how to install a given version in Claude Desktop, see Choosing the version.