mcp-google-multi 4.4.0 → 4.5.0-alpha.2

package/dist/accounts.d.ts

@@ -1,6 +1,7 @@
 export interface AccountConfig {
     email: string;
     tokenPath: string;
+    encPath: string;
 }
 /** Tuple of account aliases (at least one) — usable with z.enum() */
 export declare const ACCOUNTS: [string, ...string[]];

package/dist/accounts.js

@@ -3,7 +3,9 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 dotenv.config({ path: path.resolve(__dirname, '..', '.env') });
-const tokenDir = path.resolve(__dirname, '..', 'tokens');
+const tokenDir = process.env.TOKEN_STORE_PATH
+    ? path.resolve(process.env.TOKEN_STORE_PATH)
+    : path.resolve(__dirname, '..', 'tokens');
 /**
  * Parse accounts from the GOOGLE_ACCOUNTS env var.
  * Format: "alias1:email1,alias2:email2,..."
@@ -39,6 +41,7 @@ function parseAccounts() {
         configs[alias] = {
             email,
             tokenPath: path.join(tokenDir, alias, 'token.json'),
+            encPath: path.join(tokenDir, `${alias}.enc`),
         };
     }
     if (aliases.length === 0) {

package/dist/auth.js

@@ -2,11 +2,10 @@ import { google } from 'googleapis';
 import http from 'node:http';
 import { URL } from 'node:url';
 import { randomBytes } from 'node:crypto';
-import fs from 'node:fs/promises';
-import path from 'node:path';
 import open from 'open';
 import destroyer from 'server-destroy';
 import { ACCOUNTS, ACCOUNT_CONFIG } from './accounts.js';
+import { writeToken } from './token-store.js';
 // ─── Scope tiers ────────────────────────────────────────────────────────
 //
 // BASE: always granted. Existing v3 surface + Tasks + Meet (added in v4.0.0).
@@ -98,6 +97,10 @@ export async function runAuthFlow(args) {
     }
     const config = ACCOUNT_CONFIG[alias];
     const scopes = resolveScopesForAccount(alias);
+    if (!process.env.MASTER_KEY) {
+        console.error('MASTER_KEY is not set. Generate one (openssl rand -base64 32) and add it to .env before authenticating.');
+        process.exit(1);
+    }
     const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, 'http://localhost:4242/oauth2callback');
     // CSRF protection for the OAuth callback (RFC 6749 §10.12).
     const expectedState = randomBytes(32).toString('hex');
@@ -145,13 +148,11 @@ export async function runAuthFlow(args) {
                         return;
                     }
                     const { tokens } = await oauth2Client.getToken(code);
-                    await fs.mkdir(path.dirname(config.tokenPath), { recursive: true });
-                    // 0o600: tokens grant full account access; keep them user-only.
-                    await fs.writeFile(config.tokenPath, JSON.stringify(tokens, null, 2), { mode: 0o600 });
+                    writeToken(alias, tokens);
                     res.writeHead(200, { 'Content-Type': 'text/html' });
                     res.end('<h2>Authentication successful!</h2><p>You can close this tab.</p>');
                     server.destroy();
-                    console.log(`Token saved to ${config.tokenPath}`);
+                    console.log(`Token saved (encrypted) for ${alias}.`);
                     resolve();
                 }
             }

package/dist/client.js

@@ -1,6 +1,6 @@
 import { google } from 'googleapis';
-import fs from 'node:fs/promises';
 import { ACCOUNT_CONFIG } from './accounts.js';
+import { readToken, writeToken } from './token-store.js';
 export async function getClient(account) {
     const config = ACCOUNT_CONFIG[account];
     if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) {
@@ -8,26 +8,15 @@ export async function getClient(account) {
             'Check that .env exists in the project root or pass them as env vars.');
     }
     const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, 'http://localhost:4242/oauth2callback');
-    let tokenData;
-    try {
-        const raw = await fs.readFile(config.tokenPath, 'utf-8');
-        tokenData = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`No token file found for account "${account}" at ${config.tokenPath}. ` +
-            `Run: node dist/index.js auth --account ${account}`);
+    const tokenData = readToken(account);
+    if (!tokenData) {
+        throw new Error(`No token found for account "${account}" (${config.email}). ` +
+            `Run: npx mcp-google-multi auth --account ${account}`);
     }
     oauth2Client.setCredentials(tokenData);
-    // 0o600: tokens grant full account access; keep them user-only.
-    oauth2Client.on('tokens', async (tokens) => {
-        try {
-            const existing = JSON.parse(await fs.readFile(config.tokenPath, 'utf-8'));
-            const merged = { ...existing, ...tokens };
-            await fs.writeFile(config.tokenPath, JSON.stringify(merged, null, 2), { mode: 0o600 });
-        }
-        catch {
-            await fs.writeFile(config.tokenPath, JSON.stringify(tokens, null, 2), { mode: 0o600 });
-        }
+    oauth2Client.on('tokens', (tokens) => {
+        const existing = readToken(account) ?? {};
+        writeToken(account, { ...existing, ...tokens });
     });
     return oauth2Client;
 }

package/dist/index.js

@@ -18,6 +18,7 @@ import { registerFormsTools } from './tools/forms.js';
 import { registerChatTools } from './tools/chat.js';
 import { registerAdminTools, registerAlertCenterTools } from './tools/admin.js';
 import { getOptionalBundles, getAdminAccounts } from './auth.js';
+import { ToolRegistry } from './registry.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.resolve(__dirname, '..', 'package.json'), 'utf-8'));
 async function main() {
@@ -26,29 +27,35 @@ async function main() {
         await runAuthFlow(process.argv);
         return;
     }
+    if (process.argv.includes('migrate-tokens')) {
+        const { runMigrateTokens } = await import('./migrate-tokens.js');
+        runMigrateTokens();
+        return;
+    }
     // MCP server mode — no console.log (stdio is the MCP channel)
     const server = new McpServer({
         name: 'mcp-google-multi',
         version: pkg.version,
     });
-    registerGmailTools(server);
-    registerDriveTools(server);
-    registerCalendarTools(server);
-    registerSheetsTools(server);
-    registerDocsTools(server);
-    registerContactsTools(server);
-    registerSearchConsoleTools(server);
-    registerTasksTools(server);
-    registerMeetTools(server);
+    const registry = new ToolRegistry(server);
+    registerGmailTools(registry);
+    registerDriveTools(registry);
+    registerCalendarTools(registry);
+    registerSheetsTools(registry);
+    registerDocsTools(registry);
+    registerContactsTools(registry);
+    registerSearchConsoleTools(registry);
+    registerTasksTools(registry);
+    registerMeetTools(registry);
     const optional = new Set(getOptionalBundles());
     if (optional.has('forms'))
-        registerFormsTools(server);
+        registerFormsTools(registry);
     if (optional.has('chat'))
-        registerChatTools(server);
+        registerChatTools(registry);
     if (optional.has('alertcenter'))
-        registerAlertCenterTools(server);
+        registerAlertCenterTools(registry);
     if (getAdminAccounts().length > 0)
-        registerAdminTools(server);
+        registerAdminTools(registry);
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/migrate-tokens.d.ts

@@ -0,0 +1 @@
+export declare function runMigrateTokens(): void;

package/dist/migrate-tokens.js

@@ -0,0 +1,22 @@
+import fs from 'node:fs';
+import { ACCOUNTS, ACCOUNT_CONFIG } from './accounts.js';
+import { writeToken, hasToken } from './token-store.js';
+export function runMigrateTokens() {
+    let migrated = 0;
+    let skipped = 0;
+    for (const alias of ACCOUNTS) {
+        const plain = ACCOUNT_CONFIG[alias].tokenPath;
+        if (!fs.existsSync(plain))
+            continue;
+        if (hasToken(alias)) {
+            console.log(`• ${alias}: encrypted token already exists, skipping`);
+            skipped++;
+            continue;
+        }
+        writeToken(alias, JSON.parse(fs.readFileSync(plain, 'utf8')));
+        console.log(`✓ ${alias}: migrated ${plain} → encrypted store`);
+        migrated++;
+    }
+    console.log(`Done. ${migrated} migrated, ${skipped} skipped. ` +
+        'Delete the plaintext tokens/<alias>/token.json once verified.');
+}

package/dist/registry.d.ts

@@ -0,0 +1,13 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export type Cud = 'read' | 'create' | 'update' | 'delete';
+export interface ToolEntry {
+    name: string;
+    service: string;
+    cud: Cud;
+}
+export declare function inferCud(name: string): Cud;
+export declare class ToolRegistry {
+    readonly tools: ToolEntry[];
+    readonly registerTool: McpServer['registerTool'];
+    constructor(server: McpServer);
+}

package/dist/registry.js

@@ -0,0 +1,29 @@
+const CUD_OVERRIDES = {
+    drive_untrash: 'update',
+};
+const DELETE_VERB = /(^|_)(delete|remove|trash|clear|empty)(_|$)/;
+const CREATE_VERB = /(^|_)(create|add|insert|send|upload|copy|import|append|submit|duplicate|share|quick)(_|$)/;
+const UPDATE_VERB = /(^|_)(update|patch|modify|set|move|write|format|merge|unmerge|sort|replace|resize|publish|resolve)(_|$)/;
+export function inferCud(name) {
+    const override = CUD_OVERRIDES[name];
+    if (override)
+        return override;
+    if (DELETE_VERB.test(name))
+        return 'delete';
+    if (CREATE_VERB.test(name))
+        return 'create';
+    if (UPDATE_VERB.test(name))
+        return 'update';
+    return 'read';
+}
+export class ToolRegistry {
+    tools = [];
+    registerTool;
+    constructor(server) {
+        this.registerTool = ((name, ...rest) => {
+            const service = name.includes('_') ? name.slice(0, name.indexOf('_')) : name;
+            this.tools.push({ name, service, cud: inferCud(name) });
+            return server.registerTool(name, ...rest);
+        });
+    }
+}

package/dist/token-store.d.ts

@@ -0,0 +1,7 @@
+import type { TokenData } from './types.js';
+export declare function deriveKey(masterKey: string): Buffer;
+export declare function encryptToken(data: object, masterKey: string): string;
+export declare function decryptToken(fileContents: string, masterKey: string): TokenData;
+export declare function readToken(alias: string): TokenData | null;
+export declare function writeToken(alias: string, data: object): void;
+export declare function hasToken(alias: string): boolean;

package/dist/token-store.js

@@ -0,0 +1,66 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { ACCOUNT_CONFIG } from './accounts.js';
+const ENC_VERSION = 1;
+const ALGO = 'aes-256-gcm';
+export function deriveKey(masterKey) {
+    if (!masterKey) {
+        throw new Error('MASTER_KEY is required to encrypt/decrypt tokens. Generate one with: openssl rand -base64 32');
+    }
+    const raw = Buffer.from(masterKey, 'base64');
+    if (raw.length === 32)
+        return raw;
+    return createHash('sha256').update(masterKey, 'utf8').digest();
+}
+export function encryptToken(data, masterKey) {
+    const key = deriveKey(masterKey);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(Buffer.from(JSON.stringify(data), 'utf8')),
+        cipher.final(),
+    ]);
+    const file = {
+        v: ENC_VERSION,
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: ciphertext.toString('base64'),
+    };
+    return JSON.stringify(file);
+}
+export function decryptToken(fileContents, masterKey) {
+    const key = deriveKey(masterKey);
+    const file = JSON.parse(fileContents);
+    if (file.v !== ENC_VERSION) {
+        throw new Error(`Unsupported token file version: ${file.v}`);
+    }
+    const decipher = createDecipheriv(ALGO, key, Buffer.from(file.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(file.tag, 'base64'));
+    const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(file.data, 'base64')),
+        decipher.final(),
+    ]);
+    return JSON.parse(plaintext.toString('utf8'));
+}
+function masterKey() {
+    return process.env.MASTER_KEY ?? '';
+}
+export function readToken(alias) {
+    let contents;
+    try {
+        contents = fs.readFileSync(ACCOUNT_CONFIG[alias].encPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    return decryptToken(contents, masterKey());
+}
+export function writeToken(alias, data) {
+    const p = ACCOUNT_CONFIG[alias].encPath;
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, encryptToken(data, masterKey()), { mode: 0o600 });
+}
+export function hasToken(alias) {
+    return fs.existsSync(ACCOUNT_CONFIG[alias].encPath);
+}

package/dist/tools/_coerce.d.ts

@@ -0,0 +1,4 @@
+import { z } from 'zod';
+export declare function coerceArray<T extends z.ZodTypeAny>(element: T): z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodArray<T>>;
+export declare function coerceJson<T extends z.ZodTypeAny>(schema: T): z.ZodPipe<z.ZodTransform<unknown, unknown>, T>;
+export declare const coerceBoolean: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodBoolean>;

package/dist/tools/_coerce.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+function parseJsonLoose(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return s;
+    }
+}
+export function coerceArray(element) {
+    return z.preprocess((val) => {
+        if (typeof val !== 'string')
+            return val;
+        const t = val.trim();
+        if (t === '')
+            return [];
+        if (t.startsWith('['))
+            return parseJsonLoose(t);
+        return t.split(',').map((s) => s.trim()).filter((s) => s.length > 0);
+    }, z.array(element));
+}
+export function coerceJson(schema) {
+    return z.preprocess((val) => (typeof val === 'string' ? parseJsonLoose(val) : val), schema);
+}
+export const coerceBoolean = z.preprocess((val) => {
+    if (typeof val === 'boolean')
+        return val;
+    if (typeof val === 'string') {
+        const t = val.trim().toLowerCase();
+        if (['true', '1', 'yes', 'y'].includes(t))
+            return true;
+        if (['false', '0', 'no', 'n'].includes(t))
+            return false;
+    }
+    return val;
+}, z.boolean());

package/dist/tools/_errors.d.ts

@@ -1,5 +1,12 @@
 import type { Account } from '../accounts.js';
-/** Maps googleapis errors to MCP tool responses. 401 → re-auth instruction; 403 + hint → structured hint payload; 429 → retry-after; else → {error, code}. */
+export interface ErrorEnvelope {
+    error: string;
+    message: string;
+    hint?: string;
+    retriable: boolean;
+    account: string;
+}
+export declare function mapGoogleError(error: any, account: Account, forbiddenHint?: string): ErrorEnvelope;
 export declare function handleGoogleApiError(error: any, account: Account, forbiddenHint?: string): {
     content: {
         type: "text";

package/dist/tools/_errors.js

@@ -1,42 +1,69 @@
-/** Maps googleapis errors to MCP tool responses. 401 → re-auth instruction; 403 + hint → structured hint payload; 429 → retry-after; else → {error, code}. */
-export function handleGoogleApiError(error, account, forbiddenHint) {
-    if (error.code === 401) {
+function statusOf(error) {
+    const c = error?.code ?? error?.status ?? error?.response?.status;
+    const n = typeof c === 'string' ? Number(c) : c;
+    return Number.isFinite(n) ? n : undefined;
+}
+function reasonOf(error) {
+    return (error?.errors?.[0]?.reason ??
+        error?.response?.data?.error?.errors?.[0]?.reason ??
+        error?.response?.data?.error?.status);
+}
+function messageOf(error) {
+    return error?.response?.data?.error?.message ?? error?.message ?? String(error);
+}
+export function mapGoogleError(error, account, forbiddenHint) {
+    const status = statusOf(error);
+    const reason = reasonOf(error);
+    const message = messageOf(error);
+    if (status === 401) {
         return {
-            content: [{
-                    type: 'text',
-                    text: `Authentication error for account "${account}". Run: node dist/index.js auth --account ${account}`,
-                }],
-            isError: true,
+            error: 'auth_required',
+            message: `Authentication failed for account "${account}".`,
+            hint: `Run: npx mcp-google-multi auth --account ${account}`,
+            retriable: false,
+            account,
         };
     }
-    if (error.code === 403 && forbiddenHint) {
-        return {
-            content: [{
-                    type: 'text',
-                    text: JSON.stringify({
-                        error: 'forbidden',
-                        hint: forbiddenHint,
-                        original: error.message ?? String(error),
-                    }),
-                }],
-            isError: true,
-        };
+    if (status === 403) {
+        const scopeIssue = reason === 'insufficientPermissions' ||
+            reason === 'ACCESS_TOKEN_SCOPE_INSUFFICIENT' ||
+            /insufficient.*scope/i.test(message);
+        if (scopeIssue) {
+            return {
+                error: 'insufficient_scope',
+                message,
+                hint: forbiddenHint ?? `Re-auth "${account}" with the scope this operation needs.`,
+                retriable: false,
+                account,
+            };
+        }
+        return { error: 'forbidden', message, hint: forbiddenHint, retriable: false, account };
     }
-    if (error.code === 429) {
-        const retryAfter = error.response?.headers?.['retry-after'] ?? 'unknown';
+    if (status === 400 && /invalid[_ ]scope/i.test(message)) {
+        return { error: 'invalid_scope', message, retriable: false, account };
+    }
+    if (status === 404) {
+        return { error: 'not_found', message, retriable: false, account };
+    }
+    if (status === 429) {
+        const retryAfter = error?.response?.headers?.['retry-after'];
         return {
-            content: [{
-                    type: 'text',
-                    text: JSON.stringify({ error: 'rate_limited', retryAfter }),
-                }],
-            isError: true,
+            error: 'rate_limited',
+            message,
+            hint: retryAfter ? `Retry after ${retryAfter}s.` : 'Back off and retry.',
+            retriable: true,
+            account,
         };
     }
+    if (status !== undefined && status >= 500) {
+        return { error: 'upstream_error', message, retriable: true, account };
+    }
+    return { error: 'upstream_error', message, retriable: false, account };
+}
+export function handleGoogleApiError(error, account, forbiddenHint) {
+    const envelope = mapGoogleError(error, account, forbiddenHint);
     return {
-        content: [{
-                type: 'text',
-                text: JSON.stringify({ error: error.message ?? String(error), code: error.code }),
-            }],
+        content: [{ type: 'text', text: JSON.stringify(envelope) }],
         isError: true,
     };
 }

package/dist/tools/admin.d.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolRegistry } from '../registry.js';
 /**
  * Admin SDK tools require Workspace super-admin (or delegated admin) privileges on the target account.
  * Personal `@gmail.com` accounts will 403 on every endpoint.
@@ -6,7 +6,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
  * Writes are gated behind GOOGLE_ALLOW_ADMIN_WRITES=true to prevent accidents on small orgs
  * (a stray users.update on a 3-person Workspace is a bad day).
  */
-export declare function registerAdminTools(server: McpServer): void;
+export declare function registerAdminTools(server: ToolRegistry): void;
 /**
  * Alert Center tools. Gated behind the `alertcenter` optional bundle, NOT the
  * admin bundle: the apps.alerts scope cannot be granted via this server's
@@ -14,4 +14,4 @@ export declare function registerAdminTools(server: McpServer): void;
  * domain-wide delegation. Registered separately so a missing/ungrantable
  * apps.alerts scope never blocks the working Admin SDK admin tools.
  */
-export declare function registerAlertCenterTools(server: McpServer): void;
+export declare function registerAlertCenterTools(server: ToolRegistry): void;

package/dist/tools/admin.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceBoolean } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -75,7 +76,7 @@ export function registerAdminTools(server) {
             maxResults: z.number().min(1).max(500).optional(),
             pageToken: z.string().optional(),
             orderBy: z.enum(['email', 'familyName', 'givenName']).optional(),
-            showDeleted: z.boolean().optional(),
+            showDeleted: coerceBoolean.optional(),
             projection: z.enum(['basic', 'custom', 'full']).optional(),
         },
     }, async ({ account, customer, domain, query, maxResults, pageToken, orderBy, showDeleted, projection }) => {
@@ -130,9 +131,9 @@ export function registerAdminTools(server) {
             userKey: z.string().describe('User email or ID'),
             givenName: z.string().optional(),
             familyName: z.string().optional(),
-            suspended: z.boolean().optional(),
+            suspended: coerceBoolean.optional(),
             password: z.string().optional(),
-            changePasswordAtNextLogin: z.boolean().optional(),
+            changePasswordAtNextLogin: coerceBoolean.optional(),
             orgUnitPath: z.string().optional(),
         },
     }, async ({ account, userKey, givenName, familyName, suspended, password, changePasswordAtNextLogin, orgUnitPath }) => {
@@ -217,7 +218,7 @@ export function registerAdminTools(server) {
             account: accountEnum.describe('Google account alias (must be a Workspace admin)'),
             groupKey: z.string().describe('Group email or ID'),
             roles: z.string().optional().describe('Comma-separated roles to include (OWNER, MANAGER, MEMBER)'),
-            includeDerivedMembership: z.boolean().optional(),
+            includeDerivedMembership: coerceBoolean.optional(),
             maxResults: z.number().min(1).max(200).optional(),
             pageToken: z.string().optional(),
         },

package/dist/tools/calendar.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerCalendarTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerCalendarTools(server: ToolRegistry): void;

package/dist/tools/calendar.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceArray, coerceBoolean } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -111,7 +112,7 @@ export function registerCalendarTools(server) {
                 .describe('Comma-separated email addresses of attendees'),
             calendarId: z.string().default('primary').optional()
                 .describe('Calendar ID (default: primary)'),
-            allDay: z.boolean().default(false).optional()
+            allDay: coerceBoolean.default(false).optional()
                 .describe('If true, start/end are dates (YYYY-MM-DD) not datetimes'),
         },
     }, async ({ account, summary, start, end, description, location, attendees, calendarId, allDay }) => {
@@ -240,7 +241,7 @@ export function registerCalendarTools(server) {
             calendarId: z.string().default('primary').optional()
                 .describe('Calendar ID (default: primary)'),
             text: z.string().describe('Natural language event, e.g. "Lunch with Farouk Thursday 1pm at Le Boulanger"'),
-            sendNotifications: z.boolean().optional().describe('Send notifications to attendees (default: false)'),
+            sendNotifications: coerceBoolean.optional().describe('Send notifications to attendees (default: false)'),
         },
     }, async ({ account, calendarId, text, sendNotifications }) => {
         try {
@@ -266,7 +267,7 @@ export function registerCalendarTools(server) {
             calendarId: z.string().describe('Source calendar ID'),
             eventId: z.string().describe('Event ID to move'),
             destinationCalendarId: z.string().describe('Destination calendar ID'),
-            sendNotifications: z.boolean().optional().describe('Send notifications (default: false)'),
+            sendNotifications: coerceBoolean.optional().describe('Send notifications (default: false)'),
         },
     }, async ({ account, calendarId, eventId, destinationCalendarId, sendNotifications }) => {
         try {
@@ -322,7 +323,7 @@ export function registerCalendarTools(server) {
         description: 'Check free/busy times for one or more calendars within a time window. Returns only busy blocks, not event details.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            calendarIds: z.array(z.string()).describe('Calendar IDs to check, e.g. ["primary", "user@example.com"]'),
+            calendarIds: coerceArray(z.string()).describe('Calendar IDs to check, e.g. ["primary", "user@example.com"]'),
             timeMin: z.string().describe('ISO 8601 start of window'),
             timeMax: z.string().describe('ISO 8601 end of window'),
             timeZone: z.string().optional().describe('Timezone (default: UTC)'),

package/dist/tools/chat.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerChatTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerChatTools(server: ToolRegistry): void;

package/dist/tools/chat.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceJson } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -55,7 +56,7 @@ export function registerChatTools(server) {
             account: accountEnum.describe('Google account alias'),
             parent: z.string().describe('Space resource name, format: spaces/{space}'),
             text: z.string().optional().describe('Plain message text'),
-            cardsV2: z.array(z.record(z.string(), z.any())).optional().describe('Optional Card v2 payloads'),
+            cardsV2: coerceJson(z.array(z.record(z.string(), z.any()))).optional().describe('Optional Card v2 payloads'),
             threadKey: z.string().optional().describe('Thread key to group messages'),
             messageReplyOption: z.enum(['MESSAGE_REPLY_OPTION_UNSPECIFIED', 'REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD', 'REPLY_MESSAGE_OR_FAIL']).optional(),
         },

package/dist/tools/contacts.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerContactsTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerContactsTools(server: ToolRegistry): void;

package/dist/tools/docs.d.ts

@@ -1,5 +1,5 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerDocsTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerDocsTools(server: ToolRegistry): void;
 export declare function buildParagraphStyle(input: {
     namedStyleType?: string;
     alignment?: string;

package/dist/tools/docs.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceBoolean, coerceJson } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -56,7 +57,7 @@ export function registerDocsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             documentId: z.string().describe('Google Docs document ID'),
-            includeTabsContent: z.boolean().optional()
+            includeTabsContent: coerceBoolean.optional()
                 .describe('Include full content for every tab (default: false — first tab only)'),
             suggestionsViewMode: z.enum([
                 'DEFAULT_FOR_CURRENT_ACCESS',
@@ -154,7 +155,7 @@ export function registerDocsTools(server) {
             documentId: z.string().describe('Google Docs document ID'),
             findText: z.string().describe('Text to search for'),
             replaceText: z.string().describe('Replacement text'),
-            matchCase: z.boolean().default(true).optional()
+            matchCase: coerceBoolean.default(true).optional()
                 .describe('Case-sensitive match (default: true)'),
         },
     }, async ({ account, documentId, findText, replaceText, matchCase }) => {
@@ -224,9 +225,9 @@ export function registerDocsTools(server) {
             documentId: z.string().describe('Google Docs document ID'),
             startIndex: z.number().min(1).describe('Start index (inclusive, 1-based)'),
             endIndex: z.number().min(2).describe('End index (exclusive)'),
-            bold: z.boolean().optional().describe('Set bold'),
-            italic: z.boolean().optional().describe('Set italic'),
-            underline: z.boolean().optional().describe('Set underline'),
+            bold: coerceBoolean.optional().describe('Set bold'),
+            italic: coerceBoolean.optional().describe('Set italic'),
+            underline: coerceBoolean.optional().describe('Set underline'),
             fontSize: z.number().min(1).optional().describe('Font size in points'),
             fontFamily: z.string().optional().describe('Font family name (e.g. "Arial", "Times New Roman")'),
         },
@@ -443,9 +444,9 @@ export function registerDocsTools(server) {
             indentEnd: z.number().optional().describe('End indent in points'),
             indentFirstLine: z.number().optional().describe('First-line indent in points'),
             direction: z.enum(['LEFT_TO_RIGHT', 'RIGHT_TO_LEFT']).optional(),
-            keepLinesTogether: z.boolean().optional(),
-            keepWithNext: z.boolean().optional(),
-            avoidWidowAndOrphan: z.boolean().optional(),
+            keepLinesTogether: coerceBoolean.optional(),
+            keepWithNext: coerceBoolean.optional(),
+            avoidWidowAndOrphan: coerceBoolean.optional(),
         },
     }, async ({ account, documentId, startIndex, endIndex, ...style }) => {
         try {
@@ -489,9 +490,9 @@ export function registerDocsTools(server) {
             marginHeader: z.number().optional(),
             marginFooter: z.number().optional(),
             pageNumberStart: z.number().optional(),
-            useFirstPageHeaderFooter: z.boolean().optional(),
-            useEvenPageHeaderFooter: z.boolean().optional(),
-            useCustomHeaderFooterMargins: z.boolean().optional(),
+            useFirstPageHeaderFooter: coerceBoolean.optional(),
+            useEvenPageHeaderFooter: coerceBoolean.optional(),
+            useCustomHeaderFooterMargins: coerceBoolean.optional(),
         },
     }, async ({ account, documentId, ...style }) => {
         try {
@@ -807,8 +808,8 @@ export function registerDocsTools(server) {
             tableStartIndex: z.number().min(1).describe('Start index of the table in the document'),
             rowIndex: z.number().min(0).describe('Target row (0-based)'),
             columnIndex: z.number().min(0).describe('Target column (0-based)'),
-            insertBelow: z.boolean().optional().describe('insertRow only: insert below the target row (default: false)'),
-            insertRight: z.boolean().optional().describe('insertColumn only: insert right of the target column (default: false)'),
+            insertBelow: coerceBoolean.optional().describe('insertRow only: insert below the target row (default: false)'),
+            insertRight: coerceBoolean.optional().describe('insertColumn only: insert right of the target column (default: false)'),
             rowSpan: z.number().min(1).optional().describe('mergeCells only: how many rows the merged cell spans (default 1)'),
             columnSpan: z.number().min(1).optional().describe('mergeCells/unmergeCells: column span (default 1)'),
         },
@@ -981,7 +982,7 @@ export function registerDocsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             documentId: z.string().describe('Google Docs document ID'),
-            requests: z.array(z.record(z.string(), z.any())).describe('Array of Request objects, each with one request-type key'),
+            requests: coerceJson(z.array(z.record(z.string(), z.any()))).describe('Array of Request objects, each with one request-type key'),
             writeControl: z.object({
                 requiredRevisionId: z.string().optional(),
                 targetRevisionId: z.string().optional(),

package/dist/tools/drive.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerDriveTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerDriveTools(server: ToolRegistry): void;

package/dist/tools/drive.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceArray, coerceBoolean } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -505,9 +506,9 @@ export function registerDriveTools(server) {
             role: z.enum(['reader', 'commenter', 'writer', 'fileOrganizer', 'organizer', 'owner']).describe('Permission role'),
             emailAddress: z.string().optional().describe('Required when type is "user" or "group"'),
             domain: z.string().optional().describe('Required when type is "domain"'),
-            sendNotification: z.boolean().optional().describe('Send notification email (default: true)'),
+            sendNotification: coerceBoolean.optional().describe('Send notification email (default: true)'),
             emailMessage: z.string().optional().describe('Custom message in notification email'),
-            transferOwnership: z.boolean().optional().describe('Transfer ownership to the recipient. Requires role="owner". Recipient must accept ownership.'),
+            transferOwnership: coerceBoolean.optional().describe('Transfer ownership to the recipient. Requires role="owner". Recipient must accept ownership.'),
             expirationTime: z.string().optional().describe('RFC 3339 timestamp when access expires. Only valid for role="reader" or "commenter".'),
         },
     }, async ({ account, fileId, type, role, emailAddress, domain, sendNotification, emailMessage, transferOwnership, expirationTime }) => {
@@ -567,9 +568,9 @@ export function registerDriveTools(server) {
                 .describe('New role'),
             expirationTime: z.string().optional()
                 .describe('New RFC 3339 expiration timestamp. Only valid for role "reader" or "commenter".'),
-            removeExpiration: z.boolean().optional()
+            removeExpiration: coerceBoolean.optional()
                 .describe('Clear the existing expirationTime'),
-            transferOwnership: z.boolean().optional()
+            transferOwnership: coerceBoolean.optional()
                 .describe('Promote to owner. Requires role="owner".'),
         },
     }, async ({ account, fileId, permissionId, role, expirationTime, removeExpiration, transferOwnership }) => {
@@ -658,7 +659,7 @@ export function registerDriveTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             fileId: z.string().describe('Google Drive file ID'),
-            includeDeleted: z.boolean().optional().describe('Include deleted comments (default: false)'),
+            includeDeleted: coerceBoolean.optional().describe('Include deleted comments (default: false)'),
             pageSize: z.number().min(1).max(100).optional().describe('Max comments per page (default: 20)'),
             pageToken: z.string().optional().describe('Token from a previous page'),
             startModifiedTime: z.string().optional().describe('Only return comments modified after this RFC 3339 timestamp'),
@@ -689,7 +690,7 @@ export function registerDriveTools(server) {
             account: accountEnum.describe('Google account alias'),
             fileId: z.string().describe('Google Drive file ID'),
             commentId: z.string().describe('Comment ID'),
-            includeDeleted: z.boolean().optional(),
+            includeDeleted: coerceBoolean.optional(),
         },
     }, async ({ account, fileId, commentId, includeDeleted }) => {
         try {
@@ -793,7 +794,7 @@ export function registerDriveTools(server) {
             account: accountEnum.describe('Google account alias'),
             fileId: z.string().describe('Google Drive file ID'),
             commentId: z.string().describe('Parent comment ID'),
-            includeDeleted: z.boolean().optional(),
+            includeDeleted: coerceBoolean.optional(),
             pageSize: z.number().min(1).max(100).optional(),
             pageToken: z.string().optional(),
         },
@@ -899,10 +900,10 @@ export function registerDriveTools(server) {
             account: accountEnum.describe('Google account alias'),
             fileId: z.string().describe('Google Drive file ID'),
             revisionId: z.string().describe('Revision ID'),
-            keepForever: z.boolean().optional().describe('Pin this revision indefinitely'),
-            published: z.boolean().optional().describe('Toggle published state (Docs only)'),
-            publishAuto: z.boolean().optional().describe('Auto-publish subsequent revisions'),
-            publishedOutsideDomain: z.boolean().optional().describe('Allow publish outside domain'),
+            keepForever: coerceBoolean.optional().describe('Pin this revision indefinitely'),
+            published: coerceBoolean.optional().describe('Toggle published state (Docs only)'),
+            publishAuto: coerceBoolean.optional().describe('Auto-publish subsequent revisions'),
+            publishedOutsideDomain: coerceBoolean.optional().describe('Allow publish outside domain'),
         },
     }, async ({ account, fileId, revisionId, keepForever, published, publishAuto, publishedOutsideDomain }) => {
         try {
@@ -984,10 +985,10 @@ export function registerDriveTools(server) {
             fileId: z.string().describe('Google Drive file ID'),
             proposalId: z.string().describe('Access proposal ID'),
             action: z.enum(['ACCEPT', 'DENY']).describe('Whether to accept or deny the proposal'),
-            role: z.array(z.enum(['reader', 'commenter', 'writer', 'fileOrganizer'])).optional()
+            role: coerceArray(z.enum(['reader', 'commenter', 'writer', 'fileOrganizer'])).optional()
                 .describe('Required when action is ACCEPT'),
             view: z.string().optional().describe('Optional view, e.g. "published"'),
-            sendNotification: z.boolean().optional()
+            sendNotification: coerceBoolean.optional()
                 .describe('Email the requester about the resolution'),
         },
     }, async ({ account, fileId, proposalId, action, role, view, sendNotification }) => {

package/dist/tools/forms.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerFormsTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerFormsTools(server: ToolRegistry): void;

package/dist/tools/gmail.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerGmailTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerGmailTools(server: ToolRegistry): void;

package/dist/tools/gmail.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceArray, coerceBoolean } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -319,8 +320,8 @@ export function registerGmailTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             messageId: z.string().describe('Gmail message ID'),
-            addLabelIds: z.array(z.string()).optional().describe('Label IDs to add'),
-            removeLabelIds: z.array(z.string()).optional().describe('Label IDs to remove'),
+            addLabelIds: coerceArray(z.string()).optional().describe('Label IDs to add'),
+            removeLabelIds: coerceArray(z.string()).optional().describe('Label IDs to remove'),
         },
     }, async ({ account, messageId, addLabelIds, removeLabelIds }) => {
         try {
@@ -384,9 +385,9 @@ export function registerGmailTools(server) {
         description: 'Add/remove labels across up to 1000 Gmail messages at once. Useful for bulk archiving, marking as read, etc.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            messageIds: z.array(z.string()).describe('Message IDs (up to 1000)'),
-            addLabelIds: z.array(z.string()).optional().describe('Label IDs to add'),
-            removeLabelIds: z.array(z.string()).optional().describe('Label IDs to remove'),
+            messageIds: coerceArray(z.string()).describe('Message IDs (up to 1000)'),
+            addLabelIds: coerceArray(z.string()).optional().describe('Label IDs to add'),
+            removeLabelIds: coerceArray(z.string()).optional().describe('Label IDs to remove'),
         },
     }, async ({ account, messageIds, addLabelIds, removeLabelIds }) => {
         try {
@@ -412,7 +413,7 @@ export function registerGmailTools(server) {
         description: 'Permanently delete multiple Gmail messages. Irreversible.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            messageIds: z.array(z.string()).describe('Message IDs (up to 1000)'),
+            messageIds: coerceArray(z.string()).describe('Message IDs (up to 1000)'),
         },
     }, async ({ account, messageIds }) => {
         try {
@@ -592,7 +593,7 @@ export function registerGmailTools(server) {
             startHistoryId: z.string().describe('History ID from a previous gmail_get_profile or gmail_read response'),
             maxResults: z.number().min(1).max(500).default(100).optional()
                 .describe('Max results to return (default: 100)'),
-            historyTypes: z.array(z.enum(['messageAdded', 'messageDeleted', 'labelAdded', 'labelRemoved'])).optional()
+            historyTypes: coerceArray(z.enum(['messageAdded', 'messageDeleted', 'labelAdded', 'labelRemoved'])).optional()
                 .describe('Filter by history event types'),
         },
     }, async ({ account, startHistoryId, maxResults, historyTypes }) => {
@@ -635,13 +636,13 @@ export function registerGmailTools(server) {
         description: 'Enable or disable Gmail vacation responder with a custom message',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            enableAutoReply: z.boolean().describe('Whether to enable the vacation responder'),
+            enableAutoReply: coerceBoolean.describe('Whether to enable the vacation responder'),
             responseSubject: z.string().optional().describe('Subject line for auto-reply'),
             responseBodyPlainText: z.string().optional().describe('Plain text body for auto-reply'),
             startTime: z.string().optional().describe('Start time as Unix timestamp in ms'),
             endTime: z.string().optional().describe('End time as Unix timestamp in ms'),
-            restrictToContacts: z.boolean().optional().describe('Only reply to contacts (default: false)'),
-            restrictToDomain: z.boolean().optional().describe('Only reply to same domain (default: false)'),
+            restrictToContacts: coerceBoolean.optional().describe('Only reply to contacts (default: false)'),
+            restrictToDomain: coerceBoolean.optional().describe('Only reply to same domain (default: false)'),
         },
     }, async ({ account, enableAutoReply, responseSubject, responseBodyPlainText, startTime, endTime, restrictToContacts, restrictToDomain }) => {
         try {

package/dist/tools/meet.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerMeetTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerMeetTools(server: ToolRegistry): void;

package/dist/tools/searchconsole.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerSearchConsoleTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerSearchConsoleTools(server: ToolRegistry): void;

package/dist/tools/searchconsole.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceArray, coerceJson } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -169,18 +170,18 @@ export function registerSearchConsoleTools(server) {
             siteUrl: z.string().describe('Site URL (e.g. "https://example.com/" or "sc-domain:example.com")'),
             startDate: z.string().describe('Start date (YYYY-MM-DD). Data is available starting ~3 days ago.'),
             endDate: z.string().describe('End date (YYYY-MM-DD)'),
-            dimensions: z.array(z.enum(['query', 'page', 'country', 'device', 'searchAppearance', 'date'])).optional()
+            dimensions: coerceArray(z.enum(['query', 'page', 'country', 'device', 'searchAppearance', 'date'])).optional()
                 .describe('Dimensions to group by. Common: ["query", "page"], ["date"], ["query", "date"]'),
             type: z.enum(['web', 'image', 'video', 'news', 'discover', 'googleNews']).optional()
                 .describe('Search type filter (default: web)'),
-            dimensionFilterGroups: z.array(z.object({
+            dimensionFilterGroups: coerceJson(z.array(z.object({
                 groupType: z.enum(['and']).optional(),
                 filters: z.array(z.object({
                     dimension: z.enum(['query', 'page', 'country', 'device', 'searchAppearance']),
                     operator: z.enum(['contains', 'equals', 'notContains', 'notEquals', 'includingRegex', 'excludingRegex']),
                     expression: z.string(),
                 })),
-            })).optional()
+            }))).optional()
                 .describe('Filters to narrow results. Example: filter by page containing "/blog/" or query containing "keyword"'),
             rowLimit: z.number().min(1).max(25000).optional()
                 .describe('Max rows to return (default: 1000, max: 25000)'),

package/dist/tools/sheets.d.ts

@@ -1,5 +1,5 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerSheetsTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerSheetsTools(server: ToolRegistry): void;
 export declare function buildCellFormat(input: {
     backgroundColor?: {
         red?: number;

package/dist/tools/sheets.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceArray, coerceBoolean, coerceJson } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -10,7 +11,7 @@ export function registerSheetsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             title: z.string().describe('Spreadsheet title'),
-            sheetTitles: z.array(z.string()).optional()
+            sheetTitles: coerceArray(z.string()).optional()
                 .describe('Optional tab/sheet names (default: one sheet named "Sheet1")'),
         },
     }, async ({ account, title, sheetTitles }) => {
@@ -108,7 +109,7 @@ export function registerSheetsTools(server) {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
             range: z.string().describe('A1 notation target range, e.g. "Sheet1!A1:C3"'),
-            values: z.array(z.array(z.any())).describe('2D array of values (rows x columns)'),
+            values: coerceJson(z.array(z.array(z.any()))).describe('2D array of values (rows x columns)'),
             valueInputOption: z.enum(['RAW', 'USER_ENTERED']).default('USER_ENTERED').optional()
                 .describe('How to interpret values: RAW (literal) or USER_ENTERED (formulas/dates parsed). Default: USER_ENTERED'),
         },
@@ -141,7 +142,7 @@ export function registerSheetsTools(server) {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
             range: z.string().describe('A1 notation range to search for the table (e.g. "Sheet1")'),
-            values: z.array(z.array(z.any())).describe('2D array of rows to append'),
+            values: coerceJson(z.array(z.array(z.any()))).describe('2D array of rows to append'),
             valueInputOption: z.enum(['RAW', 'USER_ENTERED']).default('USER_ENTERED').optional()
                 .describe('How to interpret values. Default: USER_ENTERED'),
         },
@@ -200,7 +201,7 @@ export function registerSheetsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
-            ranges: z.array(z.string()).describe('Array of A1 notation ranges'),
+            ranges: coerceArray(z.string()).describe('Array of A1 notation ranges'),
             valueRenderOption: z.enum(['FORMATTED_VALUE', 'UNFORMATTED_VALUE', 'FORMULA'])
                 .default('FORMATTED_VALUE').optional()
                 .describe('How to render values. Default: FORMATTED_VALUE'),
@@ -231,10 +232,10 @@ export function registerSheetsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
-            data: z.array(z.object({
+            data: coerceJson(z.array(z.object({
                 range: z.string().describe('A1 notation range'),
-                values: z.array(z.array(z.any())).describe('2D array of values'),
-            })).describe('Array of { range, values } objects to write'),
+                values: coerceJson(z.array(z.array(z.any()))).describe('2D array of values'),
+            }))).describe('Array of { range, values } objects to write'),
             valueInputOption: z.enum(['RAW', 'USER_ENTERED']).default('USER_ENTERED').optional()
                 .describe('How to interpret values. Default: USER_ENTERED'),
         },
@@ -373,7 +374,7 @@ export function registerSheetsTools(server) {
             sheetId: z.number().describe('Sheet ID'),
             title: z.string().optional().describe('New tab title'),
             index: z.number().optional().describe('New position among tabs'),
-            hidden: z.boolean().optional().describe('Hide the tab from the UI'),
+            hidden: coerceBoolean.optional().describe('Hide the tab from the UI'),
             tabColor: rgbColorSchema.optional().describe('Tab color (RGB 0..1)'),
             frozenRowCount: z.number().min(0).optional().describe('Number of frozen header rows'),
             frozenColumnCount: z.number().min(0).optional().describe('Number of frozen header columns'),
@@ -460,10 +461,10 @@ export function registerSheetsTools(server) {
             backgroundColor: rgbColorSchema.optional().describe('Cell background (RGB 0..1)'),
             textFormat: z.object({
                 foregroundColor: rgbColorSchema.optional(),
-                bold: z.boolean().optional(),
-                italic: z.boolean().optional(),
-                underline: z.boolean().optional(),
-                strikethrough: z.boolean().optional(),
+                bold: coerceBoolean.optional(),
+                italic: coerceBoolean.optional(),
+                underline: coerceBoolean.optional(),
+                strikethrough: coerceBoolean.optional(),
                 fontFamily: z.string().optional(),
                 fontSize: z.number().min(1).optional(),
             }).optional(),
@@ -609,19 +610,19 @@ export function registerSheetsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
-            ranges: z.array(gridRangeSchema).describe('Ranges the rule applies to'),
+            ranges: coerceJson(z.array(gridRangeSchema)).describe('Ranges the rule applies to'),
             index: z.number().min(0).optional().describe('Where in the rule order to insert (0 = highest priority)'),
             booleanRule: z.object({
                 conditionType: z.string().describe(BOOLEAN_CONDITION_TYPE_DESC),
-                conditionValues: z.array(z.string()).optional().describe('Values for the condition (e.g. ["100"] for NUMBER_GREATER, or ["=A1>10"] for CUSTOM_FORMULA)'),
+                conditionValues: coerceArray(z.string()).optional().describe('Values for the condition (e.g. ["100"] for NUMBER_GREATER, or ["=A1>10"] for CUSTOM_FORMULA)'),
                 format: z.object({
                     backgroundColor: rgbColorSchema.optional(),
                     textFormat: z.object({
                         foregroundColor: rgbColorSchema.optional(),
-                        bold: z.boolean().optional(),
-                        italic: z.boolean().optional(),
-                        strikethrough: z.boolean().optional(),
-                        underline: z.boolean().optional(),
+                        bold: coerceBoolean.optional(),
+                        italic: coerceBoolean.optional(),
+                        strikethrough: coerceBoolean.optional(),
+                        underline: coerceBoolean.optional(),
                     }).optional(),
                 }).describe('Format to apply when condition is true. Conditional formatting only supports bold/italic/strikethrough/underline/foregroundColor/backgroundColor.'),
             }).optional(),
@@ -699,7 +700,7 @@ export function registerSheetsTools(server) {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
             range: gridRangeSchema,
-            sortSpecs: z.array(sortSpecSchema).describe('One spec per sort column (in priority order)'),
+            sortSpecs: coerceJson(z.array(sortSpecSchema)).describe('One spec per sort column (in priority order)'),
         },
     }, async ({ account, spreadsheetId, range, sortSpecs }) => {
         try {
@@ -725,13 +726,13 @@ export function registerSheetsTools(server) {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
             range: gridRangeSchema,
-            sortSpecs: z.array(sortSpecSchema).optional(),
-            filterSpecs: z.array(z.object({
+            sortSpecs: coerceJson(z.array(sortSpecSchema)).optional(),
+            filterSpecs: coerceJson(z.array(z.object({
                 columnIndex: z.number().min(0),
-                hiddenValues: z.array(z.string()).optional().describe('Values to hide in this column'),
+                hiddenValues: coerceArray(z.string()).optional().describe('Values to hide in this column'),
                 conditionType: z.string().optional().describe(BOOLEAN_CONDITION_TYPE_DESC),
-                conditionValues: z.array(z.string()).optional(),
-            })).optional(),
+                conditionValues: coerceArray(z.string()).optional(),
+            }))).optional(),
         },
     }, async ({ account, spreadsheetId, range, sortSpecs, filterSpecs }) => {
         try {
@@ -801,10 +802,10 @@ export function registerSheetsTools(server) {
             scope: z.enum(['allSheets', 'sheet', 'range']).describe('Search scope'),
             sheetId: z.number().optional().describe('Required when scope=sheet'),
             range: gridRangeSchema.optional().describe('Required when scope=range'),
-            matchCase: z.boolean().optional(),
-            matchEntireCell: z.boolean().optional(),
-            searchByRegex: z.boolean().optional(),
-            includeFormulas: z.boolean().optional(),
+            matchCase: coerceBoolean.optional(),
+            matchEntireCell: coerceBoolean.optional(),
+            searchByRegex: coerceBoolean.optional(),
+            includeFormulas: coerceBoolean.optional(),
         },
     }, async ({ account, spreadsheetId, find, replacement, scope, sheetId, range, matchCase, matchEntireCell, searchByRegex, includeFormulas }) => {
         try {
@@ -892,7 +893,7 @@ export function registerSheetsTools(server) {
             dimension: z.enum(['ROWS', 'COLUMNS']),
             startIndex: z.number().min(0).describe('0-based, inclusive'),
             endIndex: z.number().min(1).describe('0-based, exclusive'),
-            inheritFromBefore: z.boolean().optional(),
+            inheritFromBefore: coerceBoolean.optional(),
         },
     }, async ({ account, spreadsheetId, sheetId, dimension, startIndex, endIndex, inheritFromBefore }) => {
         try {
@@ -957,10 +958,10 @@ export function registerSheetsTools(server) {
             spreadsheetId: z.string().describe('Spreadsheet ID'),
             range: gridRangeSchema,
             conditionType: z.string().describe(BOOLEAN_CONDITION_TYPE_DESC),
-            conditionValues: z.array(z.string()).optional().describe('Values per condition type (list items for ONE_OF_LIST, range A1 for ONE_OF_RANGE, etc.)'),
+            conditionValues: coerceArray(z.string()).optional().describe('Values per condition type (list items for ONE_OF_LIST, range A1 for ONE_OF_RANGE, etc.)'),
             inputMessage: z.string().optional().describe('Tooltip shown when cell is selected'),
-            strict: z.boolean().optional().describe('Reject invalid input (default: false = warning only)'),
-            showCustomUi: z.boolean().optional().describe('Show dropdown UI for list-type validations'),
+            strict: coerceBoolean.optional().describe('Reject invalid input (default: false = warning only)'),
+            showCustomUi: coerceBoolean.optional().describe('Show dropdown UI for list-type validations'),
         },
     }, async ({ account, spreadsheetId, range, conditionType, conditionValues, inputMessage, strict, showCustomUi }) => {
         try {
@@ -1048,7 +1049,7 @@ export function registerSheetsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
-            ranges: z.array(z.string()).describe('Array of A1 notation ranges'),
+            ranges: coerceArray(z.string()).describe('Array of A1 notation ranges'),
         },
     }, async ({ account, spreadsheetId, ranges }) => {
         try {
@@ -1073,10 +1074,10 @@ export function registerSheetsTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().describe('Spreadsheet ID'),
-            requests: z.array(z.record(z.string(), z.any())).describe('Array of Request objects. Each object has exactly one key (the request type) like {repeatCell: {...}}, {addChart: {...}}, {updateBanding: {...}}, etc.'),
-            includeSpreadsheetInResponse: z.boolean().optional(),
-            responseRanges: z.array(z.string()).optional(),
-            responseIncludeGridData: z.boolean().optional(),
+            requests: coerceJson(z.array(z.record(z.string(), z.any()))).describe('Array of Request objects. Each object has exactly one key (the request type) like {repeatCell: {...}}, {addChart: {...}}, {updateBanding: {...}}, etc.'),
+            includeSpreadsheetInResponse: coerceBoolean.optional(),
+            responseRanges: coerceArray(z.string()).optional(),
+            responseIncludeGridData: coerceBoolean.optional(),
         },
     }, async ({ account, spreadsheetId, requests, includeSpreadsheetInResponse, responseRanges, responseIncludeGridData }) => {
         try {

package/dist/tools/tasks.d.ts

@@ -1,2 +1,2 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerTasksTools(server: McpServer): void;
+import type { ToolRegistry } from '../registry.js';
+export declare function registerTasksTools(server: ToolRegistry): void;

package/dist/tools/tasks.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { coerceBoolean } from './_coerce.js';
 import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
@@ -119,10 +120,10 @@ export function registerTasksTools(server) {
             tasklistId: z.string().describe('Tasklist ID'),
             maxResults: z.number().min(1).max(100).optional(),
             pageToken: z.string().optional(),
-            showCompleted: z.boolean().optional().describe('Include completed tasks (default: true)'),
-            showDeleted: z.boolean().optional(),
-            showHidden: z.boolean().optional(),
-            showAssigned: z.boolean().optional(),
+            showCompleted: coerceBoolean.optional().describe('Include completed tasks (default: true)'),
+            showDeleted: coerceBoolean.optional(),
+            showHidden: coerceBoolean.optional(),
+            showAssigned: coerceBoolean.optional(),
             completedMax: z.string().optional().describe('RFC 3339 upper bound on completion date'),
             completedMin: z.string().optional(),
             dueMax: z.string().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "4.4.0",
+  "version": "4.5.0-alpha.2",
   "description": "MCP server for Gmail, Google Drive, Calendar, Sheets, Docs, and Contacts with multi-account support",
   "type": "module",
   "license": "MIT",
@@ -44,6 +44,7 @@
     "prepublishOnly": "npm run build",
     "watch": "tsc --watch",
     "auth": "node dist/index.js auth --account",
+    "migrate-tokens": "node dist/index.js migrate-tokens",
     "lint": "eslint .",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",