Product · Built by Fullspec Studio · 2026

Gmail MCP server

A multi-inbox Gmail MCP server for Claude Code: seven tools across a dozen Google Workspace mailboxes, with credentials resolved from 1Password at runtime and sending made impossible by construction, not by a confirmation flag.

Project shape
Systems Design 26%Infra 10%DevOps 6%Data 10%AI 20%Backend 26%Frontend 2%
Leading
Systems Design26%Backend26%AI20%
Minimalist coral line art on paper: a stack of email envelopes whose lines converge into a single hub, through a plug-and-socket connector with a padlock and key below it, to a terminal window, with a draft envelope and pencil above the path and a crossed-out paper airplane beside it, and the brand spectrum strip along the base.

The problem

The built-in Gmail connector handles one Google account. Running a studio means a dozen inboxes across several Workspace domains, and checking them means a dozen browser tabs. An assistant that could triage all of them at once would save real time, but only if it could never send an email you didn't write, and never touch the wrong mailbox.

What we built

A Python Model Context Protocol (MCP) server that Claude Code runs locally over stdio.

  • Seven tools. list_accounts, search_mail, read_thread, and triage for reading; apply_labels, archive, and create_draft for changes. Reads can fan out across every inbox or a named group of them in parallel, so "what came in overnight across outreach" is one call, and one failing account doesn't break the rest.
  • Sending is impossible by construction. The server can only reach an allowlist of eight Gmail API endpoints, and none of them send. Tests enforce that three ways: the allowlist is pinned, the source is scanned for any send call, and a fake Gmail service checks the behavior. Drafts get written for a person to review and send.
  • Writes touch one mailbox at a time. Every write tool rejects "all" and group names, and each inbox has a read or read-write tier checked before any network call.
  • No credentials on disk. The server signs in as a Workspace service account with domain-wide delegation, and every secret in the config is a 1Password reference resolved at runtime in one batched call. A test checks that nothing secret gets written to disk.
  • Replies that thread correctly. Drafts carry the right reply headers, reply-all leaves out your own addresses and aliases, and the server refuses to draft if the thread changed underneath it.
  • Built to change. Config is re-read on every call, so adding an inbox is four lines of TOML and no restart. 171 tests.

Status

In daily private use across a dozen mailboxes. It's the same rule as the WorkMail server and our client automations: give the assistant real reach, then make the dangerous actions unreachable rather than just discouraged.

Work

Have a system that needs this level of attention?

See how we evaluate a new engagement.

Start a conversation