Google recently published an official CLI to GitHub that lets AI agents connect to Gmail, Google Docs, Drive, and Calendar. It is MCP-compatible, which means OpenClaw agents can use it out of the box — no custom API wiring required.

This changes what AI employees can actually do. Instead of agents that operate in isolation from your actual work, you can now build employees that read your email, update documents, schedule meetings, and organize files alongside you.

This guide covers how to set up the integration from scratch and what to build with it.

What the Google Workspace CLI Enables

The CLI exposes Google Workspace as a set of tools that an OpenClaw agent can call. Each service maps to a group of capabilities:

• Gmail: Read, search, compose, send, label, archive, reply to emails
• Google Docs: Read document content, create new docs, append text, update sections
• Google Drive: List files, read file content, create folders, move files, search by name or type
• Google Calendar: Read events, create events, update event details, check availability, send invites
• Google Sheets: Read/write cell values, append rows, create sheets
• Google Slides: Read slide content, create presentations (limited)

The CLI runs as a local MCP server that your OpenClaw gateway connects to. The agent calls tools through the MCP protocol, and the CLI handles Google OAuth2 and API calls behind the scenes.

Prerequisites

• OpenClaw installed and a working gateway (port 18789)
• Node.js 18+ (the CLI is a Node.js package)
• A Google account (personal or Workspace)
• A Google Cloud project with the relevant APIs enabled

Step 1: Set Up a Google Cloud Project

Google API access requires an OAuth client ID from a Cloud project. This is a one-time setup.

1. Go to console.cloud.google.com and create a new project (or use an existing one)
2. Enable the APIs you need: Gmail API, Google Drive API, Google Calendar API, Google Docs API
3. Go to APIs & Services > Credentials > Create Credentials > OAuth Client ID
4. Select Desktop app as the application type
5. Download the credentials JSON file

# Save credentials to a standard location
mkdir -p ~/.config/google-workspace-mcp
mv ~/Downloads/client_secret_*.json ~/.config/google-workspace-mcp/credentials.json

Step 2: Install the Google Workspace MCP CLI

# Install globally
npm install -g @google/workspace-mcp

# Or use it via npx without installing
npx @google/workspace-mcp

Step 3: Authenticate

The first time you run the CLI, it opens a browser window for OAuth consent. You select which Google account to authorize and which permission scopes to grant.

# Run the auth flow
workspace-mcp auth

# This opens a browser, complete the OAuth flow
# Tokens are saved to ~/.config/google-workspace-mcp/tokens.json

# Verify authentication worked
workspace-mcp auth --status

Select only the scopes your agent needs. For a read-only research agent, grant read access to Gmail and Drive. For a calendar management agent, grant calendar read and write. Scopes can be expanded later.

Step 4: Register the MCP Server with OpenClaw Gateway

OpenClaw's gateway supports MCP servers as skill providers. Add the Google Workspace server to your gateway configuration.

# In your OpenClaw gateway config (gateway.yaml or config.yaml)
mcp_servers:
  - name: google-workspace
    command: workspace-mcp
    args: ["serve"]
    env:
      GOOGLE_CREDENTIALS_PATH: ~/.config/google-workspace-mcp/credentials.json
      GOOGLE_TOKENS_PATH: ~/.config/google-workspace-mcp/tokens.json

# Restart the gateway to load the new MCP server
openclaw gateway restart

# Verify the skills are available
openclaw gateway skills list | grep google

You should see skills like gmail_search, gmail_send,drive_list, calendar_create_event, and others depending on the scopes you authorized.

Step 5: Grant the Agent Access to Google Skills

In the agent's SOUL.md, add Google Workspace to the allowed skill categories and define how the agent should use them.

# SOUL.md — example for an email triage agent
name: Inbox
role: Email Manager

permissions:
  - network
  - skills:gmail_search
  - skills:gmail_label
  - skills:gmail_reply
  - skills:drive_read

instructions: |
  You are an inbox manager for {{user_name}}.
  Your job is to:
  1. Triage new emails by priority (urgent, normal, low)
  2. Apply labels automatically based on sender and topic
  3. Draft replies for standard requests (status updates, scheduling)
  4. Summarize the inbox every morning

  Never send an email without confirmation.
  Never delete an email without listing it first.

Real Use Cases: What to Build

Use Case 1: Daily Email Briefing

An agent that wakes up every morning, searches Gmail for unread messages from the last 12 hours, and sends you a structured briefing via Telegram with subject, sender, and a one-sentence summary of each email.

# HEARTBEAT.md schedule
schedule: "0 8 * * 1-5"
task: "Search Gmail for unread emails from last 12 hours. Group by: urgent (contains deadline/ASAP/urgent), client, internal. Send summary to Telegram."

Use Case 2: Meeting Prep Agent

Before each calendar event, the agent searches Drive for related documents (by event title keywords), reads them, and posts a briefing 30 minutes before the meeting starts. No manual prep needed.

Use Case 3: Contract Review Alert

An agent monitors a specific Drive folder for new PDF files. When a new file appears, it reads the document, flags key clauses (payment terms, termination conditions, liability), and sends a summary to Slack.

Use Case 4: SEO Content Sync

A content agent writes a blog post in Docs format, saves it to a specific Drive folder, and triggers a webhook to your CMS. The writing, formatting, and publishing workflow becomes fully automated.

Security Best Practices

• Minimum scopes: Only grant the permissions the agent actually needs. A read-only research agent does not need Gmail send access.
• Confirmation for write actions: Set require_confirmation: truefor any action that modifies data — sending email, deleting files, creating calendar events with external invitees.
• Dedicated service account: For production deployments, create a Google Cloud service account with domain-wide delegation instead of using personal OAuth tokens. This avoids token expiry and is easier to revoke.
• Audit logs: Enable Google Workspace audit logs in your Cloud console. This gives you a record of every API call the agent made.

Deploy a Google Workspace AI Employee

If you want a pre-configured AI employee that handles email triage, calendar management, or document processing without building it from scratch, CrewClaw offers a personal assistant template with Workspace integration already configured.

You connect your Google account, define what the assistant should do (triage, summarize, schedule, organize), and it deploys as a running agent on your infrastructure. No Docker debugging or MCP server setup required.