gmail-mcp-multiauthSAFE
A Model Context Protocol (MCP) server for Gmail integration in Claude Desktop with auto authentication support. This server enables AI assistants to manage Gmail through natural language interactions.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Gmail MCP server that actually supports multiple accounts. Fork of the archived GongRzhe/Gmail-MCP-Server with two fixes the original never shipped:
- Token refresh persistence — refreshed OAuth tokens are saved back to disk. Without this, each account silently loses auth after the first token expiry.
- Account isolation — each server instance knows which account it is via
GMAIL_ACCOUNT_NAME. The MCP server name becomesgmail-personal,gmail-business, etc. instead of all four showing asgmail.
Works with Claude Desktop, Cursor, or any MCP-compatible client.
Setup
1. Google Cloud credentials
You need a gcp-oauth.keys.json for each account — or one shared OAuth app with separate tokens. The simplest approach: one Google Cloud project, one OAuth client, one gcp-oauth.keys.json file used by all accounts.
- Go to Google Cloud Console
- Create a project → Enable the Gmail API
- Create OAuth 2.0 credentials (Desktop app type)
- Download as
gcp-oauth.keys.json
2. Create per-account directories
mkdir -p ~/.gmail-personal ~/.gmail-business ~/.gmail-newsletter ~/.gmail-payments
Copy your gcp-oauth.keys.json into each:
cp gcp-oauth.keys.json ~/.gmail-personal/ cp gcp-oauth.keys.json ~/.gmail-business/ # repeat for each account
3. Run setup for each account
One command per account. It opens a browser, you sign in with the right Google account, and it creates everything automatically.
# The second argument is where your downloaded keys file is right now. # It gets copied into ~/.gmail-personal/ — Downloads is not used after this. npx gmail-mcp-multiauth setup personal ~/Downloads/gcp-oauth.keys.json npx gmail-mcp-multiauth setup work ~/Downloads/gcp-oauth.keys.json npx gmail-mcp-multiauth setup client ~/Downloads/gcp-oauth.keys.json
After each command, these fil
2a2a8f481ab0OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add gmail-mcp-multiauth --env GMAIL_CREDENTIALS_PATH=${GMAIL_CREDENTIALS_PATH} --env GMAIL_OAUTH_PATH=${GMAIL_OAUTH_PATH} -- npx -y [email protected]{
"mcpServers": {
"gmail-mcp-multiauth": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GMAIL_CREDENTIALS_PATH": "${GMAIL_CREDENTIALS_PATH}",
"GMAIL_OAUTH_PATH": "${GMAIL_OAUTH_PATH}"
}
}
}
}Exposed tools (22)
9 read · 9 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
batch_delete_emails | destructive | Permanently deletes multiple emails in batches |
batch_modify_emails | write | Modifies labels for multiple emails in batches |
count_emails | read | Counts emails matching a Gmail search query. Paginates through all results efficiently — no 500 limit. Supports time brackets: after:2026/03/01, before:2026/03/28, newer_than:7d, older_than:30d. |
create_filter | write | Creates a new Gmail filter with custom criteria and actions |
create_filter_from_template | write | Creates a filter using a pre-defined template for common scenarios |
create_label | write | Creates a new Gmail label |
delete_email | destructive | Permanently deletes an email |
delete_filter | destructive | Deletes a Gmail filter |
delete_label | destructive | Deletes a Gmail label |
download_attachment | read | Downloads an email attachment to a specified location |
draft_email | read | Evaluates the tool ability to draft an email |
get_filter | read | Gets details of a specific Gmail filter |
get_label_info | read | Returns stats for a Gmail label: total messages, unread count, total threads, unread threads. Use label name like INBOX, UNREAD, SENT, or a custom label name. |
get_or_create_label | write | Gets an existing label by name or creates it if it doesn |
list_email_labels | read | Retrieves all available Gmail labels |
list_filters | read | Retrieves all Gmail filters |
modify_email | write | Modifies email labels (move to different folders) |
read_email | read | Retrieves the content of a specific email |
search_emails | read | Searches for emails using Gmail search syntax |
send_email | write | Sends a new email |
send_emailEval | write | Evaluates sending a new email |
update_label | write | Updates an existing Gmail label |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
batch_delete_emails, delete_email, delete_filter, delete_label
@modelcontextprotocol/sdk, @types/mime-types, google-auth-library, googleapis, mcp-evals, mime-types, nodemailer, open
Gates applied: no_behavioural_pass.
2a2a8f481ab0full audit observations/trust-audit/mcp-server/jenny-ouyang__gmail-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 2a2a8f481ab0 | SAFE | B | 89 | first audit |
Questions
What is the gmail-mcp-multiauth MCP server?
A Model Context Protocol (MCP) server for Gmail integration in Claude Desktop with auto authentication support. This server enables AI assistants to manage Gmail through natural language interactions.
What tools does gmail-mcp-multiauth expose?
22 in total: 9 read-only, 9 that write, and 4 that can delete or overwrite (batch_delete_emails, delete_email, delete_filter, delete_label). Every one is listed on this page with its risk.
Is gmail-mcp-multiauth safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 4 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does gmail-mcp-multiauth need?
It reads GMAIL_CREDENTIALS_PATH and GMAIL_OAUTH_PATH from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does gmail-mcp-multiauth run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as gmail-mcp-multiauth at 1.4.6.
How current is this page?
The grade is for one exact copy of the source (2a2a8f481ab0), read on 2026-10-12. The repository is watched and re-audited when it changes.