Google Chat IntegrationCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This project provides a Google Chat integration for MCP (Model Control Protocol) servers written by Python with FastMCP. It allows you to access and interact with Google Chat spaces and messages through MCP tools.
Structure
The project consists of two main components:
- MCP Server with Google Chat Tools: Provides tools for interacting with Google Chat through the Model Control Protocol.
- Written by FastMCP
server.py: Main MCP server implementation with Google Chat toolsgoogle_chat.py: Google Chat API integration and authentication handling
- Authentication Server: Standalone component for Google account authentication
- Written by FastAPI
- Handles OAuth2 flow with Google
- Stores and manages access tokens
- Can be run independently or as part of the MCP server
server_auth.py: Authentication server implementation
The authentication flow allows you to obtain and refresh Google API tokens, which are then used by the MCP tools to access Google Chat data. (Your spaces and messages)
Features
- OAuth2 authentication with Google Chat API
- List available Google Chat spaces
- Retrieve messages from specific spaces with date filtering
- Local authentication server for easy setup
Requirements
- Python 3.13+
- Google Cloud project with the following APIs enabled:
- Google Chat API
- People API (for user display names)
- OAuth2 credentials from Google Cloud Console
How to use?
Prepare Google Oauth Login
- Clone this project
git clone https://github.com/chy168/google-chat-mcp-server.git cd google-chat-mcp-server
- Prepare a Google Cloud Project (GCP)
- Google Cloud Conolse (https://console.cloud.google.com/auth/overview?project=)
- Google Auth Platform > Clients > (+) Create client > Web application
reference: https://developers.google.com/identity/protocols/oauth2/?hl=en Authorized JavaScript origins add: http://localhost:8000 Authorized redi
b238692bb64aOBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-gcp-chat-py --env OAUTHLIB_RELAX_TOKEN_SCOPE=${OAUTHLIB_RELAX_TOKEN_SCOPE} -- uvx mcp-gcp-chat-py{
"mcpServers": {
"mcp-gcp-chat-py": {
"command": "uvx",
"args": [
"mcp-gcp-chat-py"
],
"env": {
"OAUTHLIB_RELAX_TOKEN_SCOPE": "${OAUTHLIB_RELAX_TOKEN_SCOPE}"
}
}
}
}Exposed tools (15)
9 read · 5 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add | write | Add two numbers |
authenticate | write | Start (or restart) Google Chat OAuth authentication. |
complete_authentication | read | Complete an in-progress OAuth flow for Google Chat. |
create_reaction | write | Add an emoji reaction to a message in a Google Chat space. |
delete_message | destructive | Delete a message that this app sent. |
fetch_weather | read | Fetch current weather for a city |
get_chat_spaces | read | List all Google Chat spaces the bot has access to. |
get_ip_my_address | read | Get IP address from outian.net |
get_message | read | Get a single message |
get_space_members | read | List the members of a specific Google Chat space. |
get_space_messages | read | List messages from a specific Google Chat space with optional time filtering. |
list_reactions | read | List the emoji reactions on a message in a Google Chat space. |
search_messages | read | Search messages in a Google Chat space for a keyword/substring match. |
send_message | write | Send a text message to a specific Google Chat space, optionally as a reply in a thread. |
update_message | write | Update the text of an existing message that this app sent. |
Trust audit
CAUTIONgrade B · trust 83/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | WARN |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
def complete_authentication(callback_url: str, token_path: Optional[str] = None) -> Dict:
if callback_url.startswith('http'):parsed = urlparse(callback_url)
code = callback_url
def complete_authentication(callback_url: str) -> Dict:
Get IP address from outian.net
delete_message
fastmcp, httpx, google-api-core, google-api-python-client, google-auth, google-auth-httplib2, google-auth-oauthlib, fastapi
Get IP address from outian.net
Fetch current weather for a city
Add two numbers
Gates applied: no_behavioural_pass.
b238692bb64afull audit observations/trust-audit/mcp-server/chy168__google-chat-integration.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | b238692bb64a | CAUTION | B | 83 | first audit |
Questions
What tools does Google Chat Integration expose?
15 in total: 9 read-only, 5 that write, and 1 that can delete or overwrite (delete_message). Every one is listed on this page with its risk.
Is Google Chat Integration safe to connect to an agent?
With care. The audit graded it B (83/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Google Chat Integration need?
It reads OAUTHLIB_RELAX_TOKEN_SCOPE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (b238692bb64a), read on 2026-10-09. The repository is watched and re-audited when it changes.