mcp-google-multi 5.1.3-alpha.1 → 5.2.0-alpha.2

package/README.md

@@ -1,6 +1,6 @@
 # mcp-google-multi
 
-A **local** [MCP](https://modelcontextprotocol.io) server that gives Claude Code (and any MCP client) access to your **Google Workspace** — Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console (plus optional Forms, Chat, and Workspace Admin) — across **multiple Google accounts** at once.
+A **local** [MCP](https://modelcontextprotocol.io) server that gives Claude Code (and any MCP client) access to your **Google Workspace** — Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console (plus optional Slides, Forms, Chat, and Workspace Admin) — across **multiple Google accounts** at once.
 
 [![npm](https://img.shields.io/npm/v/mcp-google-multi?label=npm&color=cb3837)](https://www.npmjs.com/package/mcp-google-multi)
 
@@ -9,7 +9,7 @@ A **local** [MCP](https://modelcontextprotocol.io) server that gives Claude Code
 - 🔑 **Multi-account** — drive any number of your Google accounts from one server, each by a short alias.
 - 🔒 **Secure by default** — refresh tokens **encrypted at rest** (AES-256-GCM); **writes are deny-by-default**; no telemetry — it talks only to Google.
 - 📦 **npm-first** — install and run with `npx`; everything configured through env vars.
-- 🧰 **~170 tools** across 12 services → full list in **[COVERAGE.md](./COVERAGE.md)**.
+- 🧰 **~175 tools** across 13 services → full list in **[COVERAGE.md](./COVERAGE.md)**.
 
 > v5 is **local + user-OAuth only**. Service accounts and hosting (and the APIs they unlock) are on the [roadmap](https://github.com/bakissation/mcp-google-multi/milestones). **Upgrading from v4?** Jump to [Upgrading](#upgrading-from-v4).
 
@@ -67,9 +67,9 @@ Now the only thing on disk is the **encrypted** token store. Pass the token via
 | `GOOGLE_PROFILE` | — | write policy: `read-only` (default) · `safe-writes` · `full-writes` |
 | `GOOGLE_READ_ONLY` | — | `true` = hard kill-switch for all writes |
 | `GOOGLE_WRITE_ALLOW` / `GOOGLE_WRITE_DENY` | — | glob overrides, e.g. `calendar:*`, `*:delete*` |
-| `GOOGLE_OPTIONAL_SCOPES` | — | extra bundles: `forms`, `chat` |
+| `GOOGLE_OPTIONAL_SCOPES` | — | extra bundles: `slides`, `forms`, `chat` |
 | `GOOGLE_ADMIN_ACCOUNTS` | — | aliases granted Workspace-admin scopes (the account's own super-admin OAuth) |
-| `GOOGLE_TOOLSETS` | — | `all` (default) or a CSV filter of: `gmail`, `drive`, `calendar`, `sheets`, `docs`, `contacts`, `searchconsole`, `tasks`, `meet`, `forms`, `chat`, `admin` |
+| `GOOGLE_TOOLSETS` | — | `all` (default) or a CSV filter of: `gmail`, `drive`, `calendar`, `sheets`, `docs`, `contacts`, `searchconsole`, `tasks`, `meet`, `slides`, `forms`, `chat`, `admin` |
 | `TOKEN_STORE_PATH` | — | override the encrypted token dir (default: `~/.config/mcp-google-multi/tokens`) |
 | `DISCOVERY_CACHE_PATH` | — | override the Discovery-doc cache dir (default: `~/.config/mcp-google-multi/discovery`) |
 | `GOOGLE_TRIM` | — | `off` (or `0`/`false`/`no`) disables compact JSON serialization of tool responses |
@@ -80,7 +80,7 @@ Inspect the resolved setup any time: `mcp-google-multi config check`.
 
 The server does **not** dump ~170 tool schemas into your model's context. At boot, `tools/list` exposes only one small `{service}_discover` tool per service (plus nothing else). Calling e.g. `drive_discover` returns that service's operation catalog (name, one-line summary, arguments, read/write class), reveals the operational tools, and emits `notifications/tools/list_changed` so the client re-fetches the list. An optional `query` argument filters the catalog.
 
-Hidden is a listing concept, not a security boundary: operational tools stay callable at all times (existing prompts that call tools directly keep working), and write-control + OAuth scopes remain the real enforcement. Use `GOOGLE_TOOLSETS` to switch entire services off — it is a filter only: listing `forms`/`chat`/`admin` does not enable them without their `GOOGLE_OPTIONAL_SCOPES` / `GOOGLE_ADMIN_ACCOUNTS` gates.
+Hidden is a listing concept, not a security boundary: operational tools stay callable at all times (existing prompts that call tools directly keep working), and write-control + OAuth scopes remain the real enforcement. Use `GOOGLE_TOOLSETS` to switch entire services off — it is a filter only: listing `slides`/`forms`/`chat`/`admin` does not enable them without their `GOOGLE_OPTIONAL_SCOPES` / `GOOGLE_ADMIN_ACCOUNTS` gates.
 
 ## Multi-account: fan out one call across accounts
 
@@ -100,7 +100,7 @@ Fan-out is **read-only by design** (write tools take exactly one account), and t
 
 ## Escape hatch: any Workspace REST method
 
-Two eager tools cover everything the curated set doesn't: `google_api_search` finds any method in Google's API Discovery index (including APIs with no dedicated tools here, like Slides), and `google_api_call` invokes a method by its Discovery id (`drive.revisions.list`, `slides.presentations.create`, …) with path/query params and a JSON body. Calls run through your account's OAuth client and the **same write-control policy** as named tools: the read/create/update/delete class is derived from the method's HTTP verb and name (POST deletes like `batchDelete`/`clear` count as deletes), and policy globs/`GOOGLE_TOOLSETS` match the same service names as named tools (`people` counts as `contacts`, `admin_*` as `admin`; `slides`/`driveactivity`/`drivelabels`/`groupssettings` have no named service and are always available).
+Two eager tools cover everything the curated set doesn't: `google_api_search` finds any method in Google's API Discovery index (including APIs with no dedicated tools here, like Drive Activity), and `google_api_call` invokes a method by its Discovery id (`drive.revisions.list`, `slides.presentations.create`, …) with path/query params and a JSON body. Calls run through your account's OAuth client and the **same write-control policy** as named tools: the read/create/update/delete class is derived from the method's HTTP verb and name (POST deletes like `batchDelete`/`clear` count as deletes), and policy globs/`GOOGLE_TOOLSETS` match the same service names as named tools (`people` counts as `contacts`, `admin_*` as `admin`; `driveactivity`/`drivelabels`/`groupssettings` have no named service and are always available).
 
 Discovery documents are fetched from Google on first use and cached on disk for 7 days (`DISCOVERY_CACHE_PATH`, default `~/.config/mcp-google-multi/discovery`); a stale cache is used when offline.
 
@@ -126,12 +126,12 @@ Reads are never gated. **Every create/update/delete is off until you opt in**
 
 ## What's covered
 
-~170 tools across Gmail, Drive, Calendar, Sheets, Docs, Contacts, Search Console, Tasks, Meet, and (optional) Forms, Chat, Workspace Admin. **Full per-tool list → [COVERAGE.md](./COVERAGE.md).** Every tool takes an `account` argument matching one of your aliases.
+~175 tools across Gmail, Drive, Calendar, Sheets, Docs, Contacts, Search Console, Tasks, Meet, and (optional) Slides, Forms, Chat, Workspace Admin. **Full per-tool list → [COVERAGE.md](./COVERAGE.md).** Every tool takes an `account` argument matching one of your aliases.
 
 ## Google Cloud setup
 
 1. [Google Cloud Console](https://console.cloud.google.com) → create or select a project.
-2. Enable the APIs you'll use: Gmail, Drive, Calendar, Sheets, Docs, People, Search Console, Tasks, Meet (+ Forms / Chat / Admin SDK if you enable those bundles).
+2. Enable the APIs you'll use: Gmail, Drive, Calendar, Sheets, Docs, People, Search Console, Tasks, Meet (+ Slides / Forms / Chat / Admin SDK if you enable those bundles).
 3. **APIs & Services → Credentials → Create Credentials → OAuth client ID → Desktop app**.
 4. Add the redirect URI `http://localhost:4242/oauth2callback`.
 5. Copy the **Client ID** + **Client Secret** into your environment.

package/dist/auth.js

@@ -9,7 +9,7 @@ import { writeToken } from './token-store.js';
 // ─── Scope tiers ────────────────────────────────────────────────────────
 //
 // BASE: always granted. Existing v3 surface + Tasks + Meet (added in v4.0.0).
-// OPTIONAL: per-account opt-in via env GOOGLE_OPTIONAL_SCOPES="forms,chat".
+// OPTIONAL: per-account opt-in via env GOOGLE_OPTIONAL_SCOPES="slides,forms,chat".
 // ADMIN: per-account opt-in via env GOOGLE_ADMIN_ACCOUNTS="alias1,alias2".
 //
 // Personal Gmail accounts will 403 on admin scopes — never grant by default.
@@ -27,6 +27,9 @@ export const BASE_SCOPES = [
     'https://www.googleapis.com/auth/meetings.space.readonly',
 ];
 export const OPTIONAL_SCOPE_BUNDLES = {
+    slides: [
+        'https://www.googleapis.com/auth/presentations',
+    ],
     forms: [
         'https://www.googleapis.com/auth/forms.body',
         'https://www.googleapis.com/auth/forms.responses.readonly',

package/dist/executor.d.ts

@@ -0,0 +1,39 @@
+import { getClient } from './client.js';
+export declare const MAX_RESPONSE_CHARS = 100000;
+export type QueryValue = string | number | boolean;
+export type QueryParams = Record<string, QueryValue | QueryValue[]>;
+export interface ApiMethodRef {
+    id: string;
+    httpMethod: string;
+    path: string;
+    baseUrl: string;
+    requiredParams: string[];
+}
+export interface ExecuteDeps {
+    getClientFn?: typeof getClient;
+}
+export interface ExecuteArgs {
+    account: string;
+    pathParams?: Record<string, string | number>;
+    queryParams?: QueryParams;
+    body?: unknown;
+}
+export declare function jsonResult(payload: unknown, isError?: boolean): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+} | {
+    isError: true;
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};
+export declare function buildQueryString(queryParams: QueryParams | undefined): string;
+export declare function executeApiMethod(method: ApiMethodRef, args: ExecuteArgs, deps?: ExecuteDeps): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;

package/dist/executor.js

@@ -0,0 +1,75 @@
+import { getClient } from './client.js';
+import { expandPath, isGoogleApiUrl } from './discovery-client.js';
+import { handleGoogleApiError } from './tools/_errors.js';
+export const MAX_RESPONSE_CHARS = 100_000;
+export function jsonResult(payload, isError = false) {
+    const base = { content: [{ type: 'text', text: JSON.stringify(payload) }] };
+    return isError ? { ...base, isError: true } : base;
+}
+export function buildQueryString(queryParams) {
+    const usp = new URLSearchParams();
+    const merged = { alt: 'json', ...queryParams };
+    for (const [key, value] of Object.entries(merged)) {
+        if (Array.isArray(value)) {
+            for (const v of value)
+                usp.append(key, String(v));
+        }
+        else {
+            usp.append(key, String(value));
+        }
+    }
+    return usp.toString();
+}
+export async function executeApiMethod(method, args, deps = {}) {
+    if (args.queryParams?.alt === 'media') {
+        return jsonResult({
+            error: 'binary_unsupported',
+            message: 'Binary media download (alt=media) returns no usable JSON through this tool.',
+            hint: 'Use drive_download / drive_export for file content.',
+            retriable: false,
+        }, true);
+    }
+    let url;
+    try {
+        url = method.baseUrl + expandPath(method.path, args.pathParams ?? {});
+    }
+    catch (err) {
+        return jsonResult({
+            error: 'invalid_params',
+            message: err.message,
+            hint: `Required params for ${method.id}: ${method.requiredParams.join(', ') || '(none)'}`,
+            retriable: false,
+        }, true);
+    }
+    if (!isGoogleApiUrl(url)) {
+        return jsonResult({
+            error: 'untrusted_host',
+            message: `Refusing to send credentials to a non-googleapis.com host for "${method.id}".`,
+            hint: 'The discovery cache may be corrupt; delete DISCOVERY_CACHE_PATH and retry.',
+            retriable: false,
+        }, true);
+    }
+    try {
+        const getClientFn = deps.getClientFn ?? getClient;
+        const auth = await getClientFn(args.account);
+        const res = await auth.request({
+            // query string built by hand: gaxios comma-joins arrays, Google needs repeated keys
+            url: `${url}?${buildQueryString(args.queryParams)}`,
+            method: method.httpMethod,
+            data: args.body ?? undefined,
+        });
+        const text = JSON.stringify(res.data ?? null);
+        if (text.length > MAX_RESPONSE_CHARS) {
+            return jsonResult({
+                truncated: true,
+                totalChars: text.length,
+                head: text.slice(0, MAX_RESPONSE_CHARS),
+                hint: 'Narrow the request (fields mask, pageSize) to get complete JSON.',
+            });
+        }
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (error) {
+        return handleGoogleApiError(error, args.account);
+    }
+}

package/dist/index.js

@@ -14,10 +14,12 @@ import { registerContactsTools } from './tools/contacts.js';
 import { registerSearchConsoleTools } from './tools/searchconsole.js';
 import { registerTasksTools } from './tools/tasks.js';
 import { registerMeetTools } from './tools/meet.js';
+import { registerSlidesTools } from './tools/slides.js';
 import { registerFormsTools } from './tools/forms.js';
 import { registerChatTools } from './tools/chat.js';
 import { registerAdminTools } from './tools/admin.js';
 import { getOptionalBundles, getAdminAccounts } from './auth.js';
+import { GENERATED_SERVICES } from './tools/generated/index.js';
 import { ToolRegistry } from './registry.js';
 import { registerDiscoverTools } from './discover.js';
 import { registerEscapeTools } from './tools/google-api.js';
@@ -36,15 +38,19 @@ const SERVICES = [
     { name: 'searchconsole', register: registerSearchConsoleTools },
     { name: 'tasks', register: registerTasksTools },
     { name: 'meet', register: registerMeetTools },
+    { name: 'slides', register: registerSlidesTools, enabled: () => new Set(getOptionalBundles()).has('slides') },
     { name: 'forms', register: registerFormsTools, enabled: () => new Set(getOptionalBundles()).has('forms') },
     { name: 'chat', register: registerChatTools, enabled: () => new Set(getOptionalBundles()).has('chat') },
     { name: 'admin', register: registerAdminTools, enabled: () => getAdminAccounts().length > 0 },
 ];
+// Opt-in gates for generated-only services whose scopes are not granted by
+// default; shared services (admin, forms, chat) reuse their curated gate below.
+const GENERATED_GATES = {};
 function buildRegistry(server, policy) {
     const registry = new ToolRegistry(server, policy);
     const toolsets = getToolsets();
     if (toolsets !== 'all') {
-        const known = new Set(SERVICES.map((s) => s.name));
+        const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
         for (const requested of toolsets) {
             if (!known.has(requested)) {
                 process.stderr.write(`GOOGLE_TOOLSETS: unknown service "${requested}" ignored\n`);
@@ -63,10 +69,23 @@ function buildRegistry(server, policy) {
         }
         svc.register(registry);
     }
+    for (const gen of GENERATED_SERVICES) {
+        if (!toolsetEnabled(toolsets, gen.name))
+            continue;
+        const curated = SERVICES.find((s) => s.name === gen.name);
+        const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
+        if (gate && !gate()) {
+            if (!curated && toolsets !== 'all') {
+                process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
+            }
+            continue;
+        }
+        gen.register(registry);
+    }
     if (registry.services().length === 0) {
         throw new Error(`GOOGLE_TOOLSETS="${process.env.GOOGLE_TOOLSETS ?? ''}" selected no enabled services. ` +
             `Known services: ${SERVICES.map((s) => s.name).join(', ')}. ` +
-            `Note: forms/chat require GOOGLE_OPTIONAL_SCOPES, admin requires GOOGLE_ADMIN_ACCOUNTS.`);
+            `Note: slides/forms/chat require GOOGLE_OPTIONAL_SCOPES, admin requires GOOGLE_ADMIN_ACCOUNTS.`);
     }
     registerDiscoverTools(registry, policy);
     registerEscapeTools(registry, policy);

package/dist/registry.js

@@ -44,7 +44,7 @@ export class ToolRegistry {
         this.policy = policy;
         this.registerTool = ((name, config, handler) => {
             const service = SERVICE_OVERRIDES[name] ?? (name.includes('_') ? name.slice(0, name.indexOf('_')) : name);
-            const cud = inferCud(name);
+            const cud = config.cud ?? inferCud(name);
             // destructiveHint=false claims "additive only" (MCP spec) — updates overwrite, so they stay true.
             const annotations = {
                 readOnlyHint: cud === 'read',
@@ -84,7 +84,8 @@ export class ToolRegistry {
             const finalHandler = this.compactOutput
                 ? async (...args) => compactResult(await guarded(...args))
                 : guarded;
-            return server.registerTool(name, { ...config, inputSchema: inputShape, annotations }, finalHandler);
+            const { cud: _cud, ...sdkConfig } = config;
+            return server.registerTool(name, { ...sdkConfig, inputSchema: inputShape, annotations }, finalHandler);
         });
     }
     registerMeta = ((name, config, handler) => {

package/dist/tools/forms.js

@@ -3,6 +3,7 @@ import { google } from 'googleapis';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
+import { coerceArray, coerceBoolean, coerceJson } from './_coerce.js';
 const accountEnum = z.enum(ACCOUNTS);
 export function registerFormsTools(server) {
     server.registerTool('forms_get', {
@@ -90,6 +91,98 @@ export function registerFormsTools(server) {
             return handleFormsError(error, account);
         }
     });
+    server.registerTool('forms_create', {
+        description: 'Create a new Google Form with a title (add questions with forms_batch_update)',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            title: z.string().describe('Form title shown to responders'),
+            documentTitle: z.string().optional().describe('Drive file name (default: the title)'),
+        },
+    }, async ({ account, title, documentTitle }) => {
+        try {
+            const auth = await getClient(account);
+            const forms = google.forms({ version: 'v1', auth });
+            const res = await forms.forms.create({
+                requestBody: { info: { title, documentTitle } },
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify({
+                            formId: res.data.formId,
+                            title: res.data.info?.title,
+                            responderUri: res.data.responderUri,
+                            revisionId: res.data.revisionId,
+                        }, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleFormsError(error, account);
+        }
+    });
+    server.registerTool('forms_batch_update', {
+        description: 'Generic forms.batchUpdate pass-through: add/edit/delete questions, update form info and settings. See https://developers.google.com/workspace/forms/api/reference/rest/v1/forms/request',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            formId: z.string().describe('Form ID'),
+            requests: coerceArray(coerceJson(z.record(z.string(), z.unknown())))
+                .describe('Array of Request objects, each with one request-type key like {createItem: {...}}'),
+            includeFormInResponse: coerceBoolean.optional().describe('Return the updated form in the response'),
+            writeControl: coerceJson(z.object({
+                requiredRevisionId: z.string().optional(),
+                targetRevisionId: z.string().optional(),
+            }).optional()).describe('Optional optimistic concurrency control'),
+        },
+    }, async ({ account, formId, requests, includeFormInResponse, writeControl }) => {
+        try {
+            const auth = await getClient(account);
+            const forms = google.forms({ version: 'v1', auth });
+            const res = await forms.forms.batchUpdate({
+                formId,
+                requestBody: {
+                    requests: requests,
+                    includeFormInResponse,
+                    writeControl,
+                },
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleFormsError(error, account);
+        }
+    });
+    server.registerTool('forms_set_publish_settings', {
+        description: 'Publish/unpublish a form and toggle whether it accepts responses (legacy forms without publish state are not supported)',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            formId: z.string().describe('Form ID'),
+            isPublished: coerceBoolean.describe('Form is published and reachable by responders'),
+            isAcceptingResponses: coerceBoolean.optional().describe('Form accepts responses (requires published; default: follows isPublished)'),
+        },
+    }, async ({ account, formId, isPublished, isAcceptingResponses }) => {
+        try {
+            const auth = await getClient(account);
+            const forms = google.forms({ version: 'v1', auth });
+            const updateMask = ['publishState.isPublished'];
+            if (isAcceptingResponses !== undefined)
+                updateMask.push('publishState.isAcceptingResponses');
+            const res = await forms.forms.setPublishSettings({
+                formId,
+                requestBody: {
+                    publishSettings: {
+                        publishState: { isPublished, isAcceptingResponses },
+                    },
+                    updateMask: updateMask.join(','),
+                },
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleFormsError(error, account);
+        }
+    });
 }
 function handleFormsError(error, account) {
     return handleGoogleApiError(error, account, "Forms tools require the optional \"forms\" scope bundle. Add GOOGLE_OPTIONAL_SCOPES=forms (or include \"forms\" in the list) and re-auth.");

package/dist/tools/generated/_shared.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+import { type ApiMethodRef, type ExecuteDeps } from '../../executor.js';
+import type { Cud, ToolRegistry } from '../../registry.js';
+export interface GeneratedParam {
+    field: string;
+    api: string;
+    location: 'path' | 'query';
+}
+export interface GeneratedToolDef {
+    name: string;
+    cud: Cud;
+    description: string;
+    method: ApiMethodRef;
+    params: GeneratedParam[];
+    hasBody: boolean;
+    shape: z.ZodRawShape;
+}
+export declare function accountField(): z.ZodEnum<{
+    [x: string]: string;
+}>;
+export declare function registerGeneratedTool(registry: ToolRegistry, def: GeneratedToolDef, deps?: ExecuteDeps): void;

package/dist/tools/generated/_shared.js

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+import { ACCOUNTS } from '../../accounts.js';
+import { executeApiMethod } from '../../executor.js';
+export function accountField() {
+    return z.enum(ACCOUNTS).describe('Google account alias');
+}
+export function registerGeneratedTool(registry, def, deps = {}) {
+    // Widened locally: `cud` is a registry extension the SDK config type doesn't
+    // carry; the registry reads it before handing the config to the SDK.
+    const register = registry.registerTool;
+    register(def.name, {
+        description: def.description,
+        inputSchema: def.shape,
+        cud: def.cud,
+        annotations: { openWorldHint: true },
+    }, async (args) => {
+        const pathParams = {};
+        const queryParams = {};
+        for (const p of def.params) {
+            const value = args[p.field];
+            if (value === undefined)
+                continue;
+            if (p.location === 'path')
+                pathParams[p.api] = value;
+            else
+                queryParams[p.api] = value;
+        }
+        return executeApiMethod(def.method, {
+            account: args.account,
+            pathParams,
+            queryParams,
+            body: def.hasBody ? args.body : undefined,
+        }, deps);
+    });
+}

package/dist/tools/generated/index.d.ts

@@ -0,0 +1,5 @@
+import type { ToolRegistry } from '../../registry.js';
+export declare const GENERATED_SERVICES: Array<{
+    name: string;
+    register: (registry: ToolRegistry) => void;
+}>;

package/dist/tools/generated/index.js

@@ -0,0 +1,4 @@
+import { registerTasksGeneratedTools } from './tasks.js';
+export const GENERATED_SERVICES = [
+    { name: "tasks", register: registerTasksGeneratedTools },
+];

package/dist/tools/generated/tasks.d.ts

@@ -0,0 +1,2 @@
+import type { ToolRegistry } from '../../registry.js';
+export declare function registerTasksGeneratedTools(registry: ToolRegistry): void;

package/dist/tools/generated/tasks.js

@@ -0,0 +1,35 @@
+// GENERATED by scripts/gen-tools.ts — do not edit. Regenerate: npm run gen:tools
+import { z } from 'zod';
+import { coerceJson } from '../_coerce.js';
+import { accountField, registerGeneratedTool } from './_shared.js';
+export function registerTasksGeneratedTools(registry) {
+    registerGeneratedTool(registry, {
+        name: "tasks_tasklists_update",
+        cud: "update",
+        description: "Updates the authenticated user's specified task list.",
+        method: { id: "tasks.tasklists.update", httpMethod: "PUT", path: "tasks/v1/users/@me/lists/{tasklist}", baseUrl: "https://tasks.googleapis.com/", requiredParams: ["tasklist"] },
+        params: [{ "field": "tasklist", "api": "tasklist", "location": "path" }, { "field": "fields", "api": "fields", "location": "query" }],
+        hasBody: true,
+        shape: {
+            account: accountField(),
+            tasklist: z.string().describe("Task list identifier."),
+            body: coerceJson(z.record(z.string(), z.unknown())).describe("TaskList JSON request body. Top-level fields: etag, id, kind, selfLink, title, updated."),
+            fields: z.string().optional().describe('Response field mask.'),
+        },
+    });
+    registerGeneratedTool(registry, {
+        name: "tasks_tasks_update",
+        cud: "update",
+        description: "Updates the specified task.",
+        method: { id: "tasks.tasks.update", httpMethod: "PUT", path: "tasks/v1/lists/{tasklist}/tasks/{task}", baseUrl: "https://tasks.googleapis.com/", requiredParams: ["tasklist", "task"] },
+        params: [{ "field": "task", "api": "task", "location": "path" }, { "field": "tasklist", "api": "tasklist", "location": "path" }, { "field": "fields", "api": "fields", "location": "query" }],
+        hasBody: true,
+        shape: {
+            account: accountField(),
+            task: z.string().describe("Task identifier."),
+            tasklist: z.string().describe("Task list identifier."),
+            body: coerceJson(z.record(z.string(), z.unknown())).describe("Task JSON request body. Top-level fields: assignmentInfo, completed, deleted, due, etag, hidden, id, kind, links, notes, parent, position, +5 more."),
+            fields: z.string().optional().describe('Response field mask.'),
+        },
+    });
+}

package/dist/tools/google-api.js

@@ -2,12 +2,11 @@ import { z } from 'zod';
 import { isAllowed, writeDisabledResult } from '../write-control.js';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
-import { handleGoogleApiError } from './_errors.js';
 import { coerceJson } from './_coerce.js';
 import { getToolsets, toolsetEnabled } from '../toolsets.js';
-import { WORKSPACE_APIS, cudFromMethod, expandPath, isGoogleApiUrl, loadMethodIndex, searchMethods, } from '../discovery-client.js';
+import { executeApiMethod, jsonResult } from '../executor.js';
+import { WORKSPACE_APIS, cudFromMethod, loadMethodIndex, searchMethods, } from '../discovery-client.js';
 const accountEnum = z.enum(ACCOUNTS);
-const MAX_RESPONSE_CHARS = 100_000;
 // Policy/toolset namespace for each API alias must match the NAMED tools' service
 // names, or user deny globs and GOOGLE_TOOLSETS silently miss escape-hatch calls.
 const SERVICE_FOR_ALIAS = {
@@ -29,24 +28,6 @@ const SERVICE_FOR_ALIAS = {
     admin_reports: 'admin',
     groupssettings: 'groupssettings',
 };
-function buildQueryString(queryParams) {
-    const usp = new URLSearchParams();
-    const merged = { alt: 'json', ...queryParams };
-    for (const [key, value] of Object.entries(merged)) {
-        if (Array.isArray(value)) {
-            for (const v of value)
-                usp.append(key, String(v));
-        }
-        else {
-            usp.append(key, String(value));
-        }
-    }
-    return usp.toString();
-}
-function jsonResult(payload, isError = false) {
-    const base = { content: [{ type: 'text', text: JSON.stringify(payload) }] };
-    return isError ? { ...base, isError: true } : base;
-}
 function describeMethod(m) {
     return {
         api: m.api,
@@ -134,14 +115,6 @@ export function registerEscapeTools(registry, policy, deps = {}) {
         }
         if (!apiEnabled(api))
             return toolsetDisabled(api);
-        if (queryParams?.alt === 'media') {
-            return jsonResult({
-                error: 'binary_unsupported',
-                message: 'Binary media download (alt=media) returns no usable JSON through the escape hatch.',
-                hint: 'Use drive_download / drive_export for file content.',
-                retriable: false,
-            }, true);
-        }
         let index;
         try {
             index = await loadMethodIndex(api, deps);
@@ -165,47 +138,11 @@ export function registerEscapeTools(registry, policy, deps = {}) {
         if (cud !== 'read' && !isAllowed(toolRef, policy)) {
             return writeDisabledResult(toolRef, policy);
         }
-        let url;
-        try {
-            url = method.baseUrl + expandPath(method.path, pathParams ?? {});
-        }
-        catch (err) {
-            return jsonResult({
-                error: 'invalid_params',
-                message: err.message,
-                hint: `Required params for ${method.id}: ${method.requiredParams.join(', ') || '(none)'}`,
-                retriable: false,
-            }, true);
-        }
-        if (!isGoogleApiUrl(url)) {
-            return jsonResult({
-                error: 'untrusted_host',
-                message: `Refusing to send credentials to a non-googleapis.com host for "${method.id}".`,
-                hint: 'The discovery cache may be corrupt; delete DISCOVERY_CACHE_PATH and retry.',
-                retriable: false,
-            }, true);
-        }
-        try {
-            const auth = await getClientFn(account);
-            const res = await auth.request({
-                // query string built by hand: gaxios comma-joins arrays, Google needs repeated keys
-                url: `${url}?${buildQueryString(queryParams)}`,
-                method: method.httpMethod,
-                data: body ?? undefined,
-            });
-            const text = JSON.stringify(res.data ?? null);
-            if (text.length > MAX_RESPONSE_CHARS) {
-                return jsonResult({
-                    truncated: true,
-                    totalChars: text.length,
-                    head: text.slice(0, MAX_RESPONSE_CHARS),
-                    hint: 'Narrow the request (fields mask, pageSize) to get complete JSON.',
-                });
-            }
-            return { content: [{ type: 'text', text }] };
-        }
-        catch (error) {
-            return handleGoogleApiError(error, account);
-        }
+        return executeApiMethod(method, {
+            account: account,
+            pathParams: pathParams,
+            queryParams: queryParams,
+            body,
+        }, { getClientFn });
     });
 }

package/dist/tools/slides.d.ts

@@ -0,0 +1,4 @@
+import type { ToolRegistry } from '../registry.js';
+export declare function registerSlidesTools(server: ToolRegistry): void;
+export declare function extractPageText(elements: Array<Record<string, any>> | undefined): string;
+export declare function summarizePresentation(p: Record<string, any>): Record<string, unknown>;

package/dist/tools/slides.js

@@ -0,0 +1,183 @@
+import { z } from 'zod';
+import { google } from 'googleapis';
+import { ACCOUNTS } from '../accounts.js';
+import { getClient } from '../client.js';
+import { handleGoogleApiError } from './_errors.js';
+import { coerceArray, coerceBoolean, coerceJson } from './_coerce.js';
+import { sliceClean } from '../trim.js';
+const accountEnum = z.enum(ACCOUNTS);
+const SLIDE_TEXT_DIGEST_CHARS = 200;
+export function registerSlidesTools(server) {
+    server.registerTool('slides_create', {
+        description: 'Create a new Google Slides presentation (starts with one blank slide)',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            title: z.string().describe('Presentation title'),
+        },
+    }, async ({ account, title }) => {
+        try {
+            const auth = await getClient(account);
+            const slides = google.slides({ version: 'v1', auth });
+            const res = await slides.presentations.create({ requestBody: { title } });
+            return {
+                content: [{ type: 'text', text: JSON.stringify({
+                            presentationId: res.data.presentationId,
+                            title: res.data.title,
+                            url: `https://docs.google.com/presentation/d/${res.data.presentationId}/edit`,
+                            firstSlideObjectId: res.data.slides?.[0]?.objectId,
+                        }, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleSlidesError(error, account);
+        }
+    });
+    server.registerTool('slides_get', {
+        description: 'Get a presentation as a compact summary (title, per-slide objectId + text digest). Pass full:true for the raw Presentation JSON (can be very large).',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            presentationId: z.string().describe('Presentation ID'),
+            full: coerceBoolean.optional().describe('Return the untrimmed Presentation resource'),
+        },
+    }, async ({ account, presentationId, full }) => {
+        try {
+            const auth = await getClient(account);
+            const slides = google.slides({ version: 'v1', auth });
+            const res = await slides.presentations.get({ presentationId });
+            const payload = full ? res.data : summarizePresentation(res.data);
+            return {
+                content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleSlidesError(error, account);
+        }
+    });
+    server.registerTool('slides_page_get', {
+        description: 'Get the full JSON of one slide/page (all page elements with geometry and text)',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            presentationId: z.string().describe('Presentation ID'),
+            pageObjectId: z.string().describe('Page object ID (from slides_get)'),
+        },
+    }, async ({ account, presentationId, pageObjectId }) => {
+        try {
+            const auth = await getClient(account);
+            const slides = google.slides({ version: 'v1', auth });
+            const res = await slides.presentations.pages.get({ presentationId, pageObjectId });
+            return {
+                content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleSlidesError(error, account);
+        }
+    });
+    server.registerTool('slides_page_thumbnail', {
+        description: 'Get a rendered thumbnail image URL for one slide (the contentUrl expires after ~30 minutes)',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            presentationId: z.string().describe('Presentation ID'),
+            pageObjectId: z.string().describe('Page object ID (from slides_get)'),
+            mimeType: z.enum(['PNG']).optional().describe('Thumbnail mime type (default: PNG)'),
+            thumbnailSize: z.enum(['LARGE', 'MEDIUM', 'SMALL', 'WIDTH2000_PX']).optional()
+                .describe('LARGE=1600px, MEDIUM=800px, SMALL=200px, WIDTH2000_PX=2000px wide (default: server-chosen)'),
+        },
+    }, async ({ account, presentationId, pageObjectId, mimeType, thumbnailSize }) => {
+        try {
+            const auth = await getClient(account);
+            const slides = google.slides({ version: 'v1', auth });
+            const res = await slides.presentations.pages.getThumbnail({
+                presentationId,
+                pageObjectId,
+                'thumbnailProperties.mimeType': mimeType,
+                'thumbnailProperties.thumbnailSize': thumbnailSize,
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleSlidesError(error, account);
+        }
+    });
+    server.registerTool('slides_batch_update', {
+        description: 'Generic presentations.batchUpdate pass-through. Accepts the full Request union (create/move/delete slides, insert text/shapes/images/tables, styling, replaceAllText, …). See https://developers.google.com/workspace/slides/api/reference/rest/v1/presentations/request',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            presentationId: z.string().describe('Presentation ID'),
+            requests: coerceArray(coerceJson(z.record(z.string(), z.unknown())))
+                .describe('Array of Request objects, each with one request-type key like {createSlide: {...}}'),
+            writeControl: coerceJson(z.object({
+                requiredRevisionId: z.string().optional(),
+            }).optional()).describe('Optional optimistic concurrency control'),
+        },
+    }, async ({ account, presentationId, requests, writeControl }) => {
+        try {
+            const auth = await getClient(account);
+            const slides = google.slides({ version: 'v1', auth });
+            const res = await slides.presentations.batchUpdate({
+                presentationId,
+                requestBody: {
+                    requests: requests,
+                    writeControl,
+                },
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify({
+                            presentationId: res.data.presentationId,
+                            replies: res.data.replies ?? [],
+                        }, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleSlidesError(error, account);
+        }
+    });
+}
+// ─── Helpers (exported for unit tests) ───────────────────────────────────
+export function extractPageText(elements) {
+    const parts = [];
+    const visit = (els) => {
+        for (const el of els ?? []) {
+            for (const te of el.shape?.text?.textElements ?? []) {
+                const content = te.textRun?.content ?? te.autoText?.content;
+                if (content)
+                    parts.push(content);
+            }
+            for (const row of el.table?.tableRows ?? []) {
+                for (const cell of row.tableCells ?? []) {
+                    for (const te of cell.text?.textElements ?? []) {
+                        if (te.textRun?.content)
+                            parts.push(te.textRun.content);
+                    }
+                }
+            }
+            visit(el.elementGroup?.children);
+        }
+    };
+    visit(elements);
+    return parts.join('').replace(/\s+/g, ' ').trim();
+}
+export function summarizePresentation(p) {
+    const slides = (p.slides ?? []).map((s, index) => {
+        const text = extractPageText(s.pageElements);
+        return {
+            index,
+            objectId: s.objectId,
+            elementCount: (s.pageElements ?? []).length,
+            ...(text ? { text: sliceClean(text, SLIDE_TEXT_DIGEST_CHARS) } : {}),
+        };
+    });
+    return {
+        presentationId: p.presentationId,
+        title: p.title,
+        revisionId: p.revisionId,
+        slideCount: slides.length,
+        slides,
+        hint: 'Pass full:true for the raw Presentation JSON, or slides_page_get for one slide.',
+    };
+}
+function handleSlidesError(error, account) {
+    return handleGoogleApiError(error, account, "Slides tools require the optional \"slides\" scope bundle. Add GOOGLE_OPTIONAL_SCOPES=slides (or include \"slides\" in the list) and re-auth.");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "5.1.3-alpha.1",
+  "version": "5.2.0-alpha.2",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",
@@ -52,9 +52,11 @@
     "auth": "node dist/index.js auth --account",
     "migrate-tokens": "node dist/index.js migrate-tokens",
     "lint": "eslint .",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.scripts.json",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "gen:discovery": "tsx scripts/fetch-discovery.ts",
+    "gen:tools": "tsx scripts/gen-tools.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -72,6 +74,7 @@
     "@types/server-destroy": "^1.0.3",
     "eslint": "^10.2.1",
     "semantic-release": "^25.0.3",
+    "tsx": "^4.23.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.59.1",
     "vitest": "^3.2.6"