
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
google-sheets-mcp
Advanced tools
MCP server for Google Sheets - read, write, and query spreadsheet data
MCP server for Google Sheets - read, write, and query spreadsheet data.
Data questions: "How many open deals are in the pipeline?" or "What's our total Q3 revenue?" → reads the spreadsheet and answers directly.
Quick expense entry: Snap a photo of a receipt → extracts the details and appends a row to your expense tracker.
Cross-tool status sync: "Check all our vendor Slack channels and update the tracking spreadsheet with their latest updates" → reads Slack, updates the sheet.
Data analysis: "Break down the Salesforce figures by region and compare against our events calendar" → pulls data from multiple sources into a spreadsheet for analysis.
(These are just examples - any workflow that needs spreadsheet data can use this. Use in combination with google-drive-mcp for finding files, deleting, comments, and sharing permissions.)
http://localhost:3000/callback to Authorized redirect URIsGOOGLE_CLIENT_ID='your-client-id' \
GOOGLE_CLIENT_SECRET='your-client-secret' \
MCP_TRANSPORT=http \
npm start
The server runs on http://localhost:3000 by default. Change with PORT=3001.
claude mcp add --transport http google-sheets-mcp http://localhost:3000/mcp
This server acts as an OAuth proxy to Google:
graph LR
A[MCP client] <--> B[google-sheets-mcp] <--> C[Google OAuth/API]
/.well-known/oauth-authorization-server/register returns the Google OAuth client credentials/authorize redirects to Google, encoding the client's callback URL in state/callback receives the code from Google and forwards to the client's callback/token proxies token requests to Google, injecting client credentials/mcp handles MCP requests, using the bearer token to call Google Sheets APIThe server holds no tokens or state - it just proxies OAuth to Google.
| Tool | Description |
|---|---|
| Spreadsheet | |
sheets_spreadsheet_get | Get spreadsheet metadata (title, sheets list, optionally cell data) |
sheets_spreadsheet_create | Create a new spreadsheet |
| Values | |
sheets_values_get | Read cell values from a range |
sheets_values_batch_get | Read cell values from multiple ranges |
sheets_values_update | Write cell values to a range (overwrites) |
sheets_values_batch_update | Write cell values to multiple ranges |
sheets_values_append | Append rows after existing data |
sheets_values_clear | Clear cell values from a range |
| Sheets (tabs) | |
sheets_sheets_list | List all sheets in a spreadsheet |
sheets_sheet_add | Add a new sheet (tab) |
sheets_sheet_delete | Delete a sheet (tab) |
| Advanced | |
sheets_batch_update | Execute batch operations (formatting, merging, filters, etc.) |
spreadsheets - Full read/write access to spreadsheetsPull requests are welcomed on GitHub! To get started:
npm installnpm run test to run testsnpm run buildVersions follow the semantic versioning spec.
To release:
npm version <major | minor | patch> to bump the versiongit push --follow-tags to push with tagsFAQs
MCP server for Google Sheets - read, write, and query spreadsheet data
The npm package google-sheets-mcp receives a total of 874 weekly downloads. As such, google-sheets-mcp popularity was classified as not popular.
We found that google-sheets-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.