
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
gmcpMCP server for Gmail and Google Calendar integration.
by @johnie
GMCP is a Model Context Protocol server that enables LLMs to interact with Gmail and Google Calendar. It provides tools for searching emails, managing labels, sending messages, and working with calendar events—all through secure OAuth2 authentication.
# Install globally
npm install -g gmcp
# Or run directly
npx gmcp
bunx gmcp
docker pull johnie/gmcp:latest
git clone https://github.com/johnie/gmcp.git
cd gmcp
bun install
# If installed globally
gmcp auth
# Or with npx
npx gmcp auth
# Or from source
bun run auth
Follow the prompts to authorize. The browser will show "connection refused" after authorization - this is expected. Copy the code= parameter from the URL.
# Globally installed
gmcp start
# or just: gmcp
# With npx
npx gmcp start
# From source
bun run start
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"gmcp": {
"command": "npx",
"args": ["-y", "gmcp"],
"env": {
"GOOGLE_CREDENTIALS_PATH": "/path/to/credentials.json",
"GOOGLE_TOKEN_PATH": "/path/to/token.json",
"GOOGLE_SCOPES": "gmail.readonly,gmail.send,calendar.events"
}
}
}
}
{
"mcpServers": {
"gmcp": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-v", "/path/to/credentials.json:/app/data/credentials.json:ro",
"-v", "/path/to/token.json:/app/data/token.json",
"-e", "GOOGLE_CREDENTIALS_PATH=/app/data/credentials.json",
"-e", "GOOGLE_TOKEN_PATH=/app/data/token.json",
"-e", "GOOGLE_SCOPES=gmail.readonly,gmail.send,calendar.events",
"johnie/gmcp:latest"
]
}
}
}
{
"mcpServers": {
"gmcp": {
"command": "bun",
"args": ["run", "/path/to/gmcp/src/cli.ts"],
"env": {
"GOOGLE_CREDENTIALS_PATH": "/path/to/credentials.json",
"GOOGLE_TOKEN_PATH": "/path/to/token.json",
"GOOGLE_SCOPES": "gmail.readonly,gmail.send,calendar.events"
}
}
}
}
| Tool | Description |
|---|---|
gmcp_gmail_search_emails | Search with Gmail query syntax |
gmcp_gmail_get_email | Get message by ID |
gmcp_gmail_get_thread | Get conversation thread |
gmcp_gmail_list_attachments | List attachments on message |
gmcp_gmail_get_attachment | Download attachment data |
gmcp_gmail_send_email | Send new email |
gmcp_gmail_reply | Reply to email in thread |
gmcp_gmail_create_draft | Create draft message |
gmcp_gmail_delete_email | Permanently delete email (bypasses trash) |
gmcp_gmail_archive_email | Archive email (remove from inbox) |
gmcp_gmail_list_labels | List all labels |
gmcp_gmail_get_label | Get label details |
gmcp_gmail_create_label | Create custom label |
gmcp_gmail_update_label | Update label settings |
gmcp_gmail_delete_label | Delete custom label |
gmcp_gmail_modify_labels | Add/remove labels on message |
gmcp_gmail_batch_modify | Batch label operations |
| Tool | Description |
|---|---|
gmcp_calendar_list_calendars | List all calendars |
gmcp_calendar_list_events | List events with filters |
gmcp_calendar_get_event | Get event by ID |
gmcp_calendar_create_event | Create event (supports recurring, Google Meet) |
| Variable | Description |
|---|---|
GOOGLE_CREDENTIALS_PATH | Path to OAuth2 credentials JSON |
GOOGLE_TOKEN_PATH | Path to store OAuth2 tokens |
GOOGLE_SCOPES | Comma-separated API scopes |
| Scope | Access |
|---|---|
gmail.readonly | Read emails and labels |
gmail.send | Send emails |
gmail.modify | Read, modify labels, delete emails |
gmail.labels | Manage labels |
gmail.compose | Create drafts and send |
calendar.readonly | Read calendars and events |
calendar.events | Manage events |
calendar | Full calendar access |
Examples:
# Read-only
GOOGLE_SCOPES=gmail.readonly,calendar.readonly
# Full access
GOOGLE_SCOPES=gmail.readonly,gmail.modify,gmail.send,calendar.events
gmcp [command]
Commands:
start Start MCP server (default)
auth Run OAuth2 authentication flow
Options:
--help, -h Show usage
--version, -v Show version
bunx @modelcontextprotocol/inspector bun run start
MIT
FAQs
GMCP Server for Google Workspace with OAuth2 authentication
We found that gmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.