terra-mcp — Google Drive + Sheets MCP server
Read/write access to your Google Drive and Sheets. OAuth + PKCE login — only the public client ID ships in npm, consent happens in browser, token is cached and auto-refreshed.
Quick start
npm install -g terra-mcp-google
terra-mcp auth login # browser consent, caches token
terra-mcp client codex # print safe (read-only) MCP config
npx skills add quangtd-kozocom/terra-mcp-google # install the agent skill
CLI
Configuration
Set these in your MCP client's env block (or the launching shell):
Permission gate (per-resource allowlist)
Beyond on/off tool gating, you can allowlist exactly which Drive files/folders the agent may touch, and with what power (read / write / delete). Every call is checked against a small local SQLite allowlist first; created resources are auto-added. Manage it in the web console:
terra-mcp admin # web console at http://localhost:4717
Three modes (switch any time): off — gate disabled; read_open (default) — read/create
anything, but write/delete only granted resources; strict — only granted resources are visible at
all (even to list/search). New grants default to read-only; a folder grant cascades to its contents.
Console and server share the DB, so changes apply on the next call — no restart.
Requires Node 23.4+ (or Node 22.5+ with
--experimental-sqlite). On older Node the server still runs with the gate disabled.
Tools
Auth — sign-in/out are CLI-only (terra-mcp auth login/logout).
Drive
Sheets