Google Workspace (Gmail, Calendar, Drive)

Diskret connects to Google’s official Workspace MCP servers:

Server	MCP URL
Gmail	`https://gmailmcp.googleapis.com/mcp/v1`
Google Calendar	`https://calendarmcp.googleapis.com/mcp/v1`
Google Drive	`https://drivemcp.googleapis.com/mcp/v1`

Your Google Workspace admin creates one OAuth app inside your own Google Cloud project, once, and Diskret uses it for all three servers. Because the app is Internal to your Workspace, Google does not need to verify it, and you can see, limit and revoke it at any time. In Diskret you add one connector per server, so each one has its own tools, policies and audit trail.

Time: about 15 minutes for all three. Who: a Google Workspace admin with access to Google Cloud, and a Diskret admin.

What Diskret can access

Start with the read-only scopes. You can add the optional ones later. Every response passes through Diskret’s field rules and pseudonymisation before it reaches the AI client, and write tools stay closed until an admin opens them.

Gmail

Scope	Why	Required
`https://www.googleapis.com/auth/gmail.readonly`	Search threads and read messages	Yes
`https://www.googleapis.com/auth/gmail.compose`	Create drafts	Only if users should draft email

Google Calendar

Scope	Why	Required
`https://www.googleapis.com/auth/calendar.calendarlist.readonly`	List the user’s calendars	Yes
`https://www.googleapis.com/auth/calendar.events.freebusy`	Find free time (`suggest_time`)	Yes
`https://www.googleapis.com/auth/calendar.events.readonly`	List, search and read events	Yes

Calendar’s write tools (create_event, update_event, delete_event, respond_to_event) stay closed in Diskret by default. Leave them closed for now.

Google Drive

Scope	Why	Required
`https://www.googleapis.com/auth/drive.readonly`	Search, list and read files and their metadata	Yes
`https://www.googleapis.com/auth/drive.file`	Create and copy files (`create_file`, `copy_file`); limited to files the app creates or opens	Only if users should save files to Drive

What Diskret reads in Drive files: the text that Drive’s MCP server returns is scanned and pseudonymised like any other response. Scanned PDFs and images carry no text to scan, so they are not covered yet. Until Diskret Files can read them, keep such files out of the folders users work with through AI, or keep download_file_content closed.

Before you start

You are a member of the Google Workspace Developer Preview Program (required while the Workspace MCP servers are in preview).
You can create or use a Google Cloud project owned by your Workspace organization.
Turn off Claude’s own Gmail, Google Calendar and Google Drive connectors once Diskret is set up. See Recommended Claude settings.

1. Enable the APIs

Open the Google Cloud console and select (or create) a project, e.g. diskret-gateway.
Go to APIs & Services → Library and enable the API and the MCP API for each server you connect:

Server	API	MCP API
Gmail	Gmail API (`gmail.googleapis.com`)	Gmail MCP API (`gmailmcp.googleapis.com`)
Google Calendar	Google Calendar API (`calendar-json.googleapis.com`)	Google Calendar MCP API (`calendarmcp.googleapis.com`)
Google Drive	Google Drive API (`drive.googleapis.com`)	Google Drive MCP API (`drivemcp.googleapis.com`)

With the gcloud CLI: gcloud services enable gmailmcp.googleapis.com --project=PROJECT_ID, and likewise for the others.

Go to Google Auth Platform → Branding. If it says it is not configured, click Get Started. Fill in the app name (e.g. Diskret) and a support email.
Under Audience, choose Internal. Only users in your Workspace can sign in, and no Google verification is needed.
Agree to the Google API Services: User Data Policy and finish.
Under Data Access, click Add or Remove Scopes, paste the scopes you chose from the tables above under Manually add scopes, click Add to Table, then Update, then Save.

3. Create the OAuth client

Create one client and use it for all three connectors.

Go to Google Auth Platform → Clients → Create client.
Application type: Web application. Give it a name, e.g. Diskret.
Under Authorized redirect URIs, add the Redirect URI shown on the connector form in Diskret (on Diskret Cloud: https://app.diskret.ai/oauth/upstream/callback). It is the same for every connector.
Tick Use this client for an AI-powered agent.
Click Create and copy the Client ID and Client secret.

4. Add the connectors in Diskret

Repeat these steps for each server:

Name	Slug	URL	Scope
`Gmail`	`gmail`	`https://gmailmcp.googleapis.com/mcp/v1`	`https://www.googleapis.com/auth/gmail.readonly`
`Google Calendar`	`google-calendar`	`https://calendarmcp.googleapis.com/mcp/v1`	`https://www.googleapis.com/auth/calendar.calendarlist.readonly https://www.googleapis.com/auth/calendar.events.freebusy https://www.googleapis.com/auth/calendar.events.readonly`
`Google Drive`	`google-drive`	`https://drivemcp.googleapis.com/mcp/v1`	`https://www.googleapis.com/auth/drive.readonly`

In Diskret, go to Connectors → New connector. Type: MCP server.
Choose the Owner unit (usually your root unit), then fill in Name, Slug and URL from the table.
Under Authentication, choose Sign in with OAuth, and under Whose credential choose Personal (each user connects their own).
Paste the Client ID and Client secret from step 3. Under Scope, enter the scopes from the table, separated by spaces. Add an optional scope only if you also added it on the consent screen.
Save, then click Check sign-in. Diskret shows the authorization server it found and the scopes it will ask for.
Choose which units get access to which tools. Read tools are open; write tools stay closed until you open them.

Each user then goes to My connections, clicks Connect for each connector and signs in to Google. Calls run with that user’s own Google permissions, so Gmail, Calendar and Drive’s own access rules and logs still apply. Users who have not connected do not see the tools. Diskret refreshes the access token by itself; if Google stops accepting it, the user sees Sign in again under My connections.

Two accounts or a shared inbox

A user has one connection per connector. To reach a second mailbox, add a second connector with the same URL and its own name and slug, e.g. Gmail (rentals) with slug gmail-rentals. The AI client sees its tools separately (gmail-rentals__…), and it gets its own policies and audit trail.

For a shared inbox that has its own Google account, choose Shared (one credential for the organization) under Whose credential. An admin then clicks Sign in on the connector page and signs in as that account, once. Diskret’s tool access decides which units can use it.

Maintenance

Client secret: Google client secrets do not expire. Rotate it in the console if it may have leaked, then paste the new one into each of the three connectors in Diskret.
Adding a scope later: add it on the consent screen under Data Access and to the connector’s Scope field. Users then click Sign in again under My connections to grant it.
Revoke access: delete the OAuth client in Google Cloud to cut off Diskret for everyone, or remove a connector in Diskret. Users can revoke their own access with Revoke under My connections.

Troubleshooting

Error	Likely cause	Fix
`redirect_uri_mismatch`	The redirect URI in Google Cloud differs from Diskret’s	Copy it again from the connector form, exactly
`access_denied` / `org_internal`	The user is outside your Workspace	Internal apps only allow your own domain’s users
`invalid_scope`	A scope in Diskret is missing on the consent screen	Add it under Data Access
Tools return 403	The MCP API is not enabled, or the project is not in the Developer Preview Program	Enable the server’s MCP API (table in step 1); check preview membership
Users must sign in again about every hour	Google issued no refresh token	Diskret asks for offline access; have the user click Sign in again under My connections
Admins see OAuth errors with no detail	—	Check OAuth log events in the Workspace security investigation tool