mcp-google-multi 5.3.0 → 5.4.0-beta.1

package/README.md

@@ -4,7 +4,7 @@ The most complete **local Google Workspace MCP server**: Gmail, Drive, Calendar,
 
 [![npm](https://img.shields.io/npm/v/mcp-google-multi?label=npm&color=cb3837)](https://www.npmjs.com/package/mcp-google-multi)
 
-- 🧰 **Exhaustive** — 871 tools across 28 services + an escape hatch for anything else → [COVERAGE.md](./COVERAGE.md)
+- 🧰 **Exhaustive** — 872 tools across 28 services + an escape hatch for anything else → [COVERAGE.md](./COVERAGE.md)
 - 🔑 **Multi-account** — drive any number of Google accounts by alias, or fan one call out across all of them
 - 🔒 **Private by design** — your own OAuth app, tokens encrypted at rest (AES-256-GCM), writes deny-by-default, no telemetry, no metering — it talks only to Google
 

package/dist/accounts.js

@@ -3,20 +3,15 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { homedir } from 'node:os';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// quiet: dotenv v17 prints a banner to stdout by default, which corrupts the
-// stdio JSON-RPC channel (DOTENV_CONFIG_QUIET can't help — it would be read
-// from .env after config() already ran).
+// dotenv v17 prints a banner to stdout, corrupting the stdio JSON-RPC channel;
+// DOTENV_CONFIG_QUIET cannot help, it would be read from .env after config() ran.
 dotenv.config({ quiet: true });
 dotenv.config({ path: path.resolve(__dirname, '..', '.env'), quiet: true });
 const defaultTokenDir = path.join(process.env.XDG_CONFIG_HOME || path.join(homedir(), '.config'), 'mcp-google-multi', 'tokens');
 const tokenDir = process.env.TOKEN_STORE_PATH
     ? path.resolve(process.env.TOKEN_STORE_PATH)
     : defaultTokenDir;
-/**
- * Parse accounts from the GOOGLE_ACCOUNTS env var.
- * Format: "alias1:email1,alias2:email2,..."
- * Example: "work:me@company.com,personal:me@gmail.com"
- */
+/** Format: GOOGLE_ACCOUNTS="alias1:email1,alias2:email2". */
 function parseAccounts() {
     const raw = process.env.GOOGLE_ACCOUNTS;
     if (!raw || raw.trim() === '') {

package/dist/auth.d.ts

@@ -5,9 +5,6 @@ export declare const ADMIN_SCOPES: string[];
 export declare function getOptionalBundles(): string[];
 /** Account aliases granted ADMIN_SCOPES via GOOGLE_ADMIN_ACCOUNTS. */
 export declare function getAdminAccounts(): string[];
-/**
- * Compose the scope list for a single account at consent time.
- * Resolves env flags: GOOGLE_OPTIONAL_SCOPES (global) and GOOGLE_ADMIN_ACCOUNTS (per-account allowlist).
- */
+/** Scopes are fixed at consent time: changing GOOGLE_OPTIONAL_SCOPES or GOOGLE_ADMIN_ACCOUNTS requires re-running auth. */
 export declare function resolveScopesForAccount(alias: string): string[];
 export declare function runAuthFlow(args: string[]): Promise<void>;

package/dist/auth.js

@@ -1,19 +1,11 @@
-import { google } from 'googleapis';
+import { OAuth2Client } from 'googleapis-common';
 import http from 'node:http';
 import { URL } from 'node:url';
 import { randomBytes } from 'node:crypto';
 import open from 'open';
-import destroyer from 'server-destroy';
 import { ACCOUNTS, ACCOUNT_CONFIG } from './accounts.js';
 import { writeToken } from './token-store.js';
-// ─── Scope tiers ────────────────────────────────────────────────────────
-//
-// BASE: always granted. Existing v3 surface + Tasks + Meet (added in v4.0.0).
-// OPTIONAL: per-account opt-in via env GOOGLE_OPTIONAL_SCOPES="slides,forms,chat".
-// ADMIN: per-account opt-in via env GOOGLE_ADMIN_ACCOUNTS="alias1,alias2".
-//
-// Personal Gmail accounts will 403 on admin scopes — never grant by default.
-// ────────────────────────────────────────────────────────────────────────
+// Personal (non-Workspace) accounts 403 on admin scopes; ADMIN_SCOPES stays per-account opt-in, never granted by default.
 export const BASE_SCOPES = [
     'https://www.googleapis.com/auth/gmail.modify',
     'https://www.googleapis.com/auth/gmail.send',
@@ -39,10 +31,8 @@ export const OPTIONAL_SCOPE_BUNDLES = {
         'https://www.googleapis.com/auth/chat.messages',
         'https://www.googleapis.com/auth/chat.messages.create',
     ],
-    // Unlike the service bundles these extend the always-on gmail service:
-    // users.settings.* writes only accept the settings scopes (reads already
-    // work via gmail.modify). sharing is separate — it governs delegation,
-    // auto-forwarding and send-as, a different risk profile from e.g. filters.
+    // These extend the always-on gmail service: users.settings.* writes require these
+    // scopes (reads already work via gmail.modify); sharing is split out as riskier.
     gmail_settings: [
         'https://www.googleapis.com/auth/gmail.settings.basic',
     ],
@@ -104,10 +94,7 @@ export function getOptionalBundles() {
 export function getAdminAccounts() {
     return parseCsvEnv('GOOGLE_ADMIN_ACCOUNTS');
 }
-/**
- * Compose the scope list for a single account at consent time.
- * Resolves env flags: GOOGLE_OPTIONAL_SCOPES (global) and GOOGLE_ADMIN_ACCOUNTS (per-account allowlist).
- */
+/** Scopes are fixed at consent time: changing GOOGLE_OPTIONAL_SCOPES or GOOGLE_ADMIN_ACCOUNTS requires re-running auth. */
 export function resolveScopesForAccount(alias) {
     const scopes = [...BASE_SCOPES];
     for (const bundle of getOptionalBundles()) {
@@ -141,7 +128,7 @@ export async function runAuthFlow(args) {
         console.error('MASTER_KEY is not set. Generate one (openssl rand -base64 32) and add it to .env before authenticating.');
         process.exit(1);
     }
-    const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, 'http://localhost:4242/oauth2callback');
+    const oauth2Client = new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, 'http://localhost:4242/oauth2callback');
     // CSRF protection for the OAuth callback (RFC 6749 §10.12).
     const expectedState = randomBytes(32).toString('hex');
     const authorizeUrl = oauth2Client.generateAuthUrl({
@@ -167,7 +154,8 @@ export async function runAuthFlow(args) {
                     if (error) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(`Authorization denied: ${error}`);
-                        server.destroy();
+                        server.close();
+                        server.closeAllConnections();
                         reject(new Error(`Authorization denied: ${error}`));
                         return;
                     }
@@ -175,7 +163,8 @@ export async function runAuthFlow(args) {
                     if (!code) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end('No authorization code received.');
-                        server.destroy();
+                        server.close();
+                        server.closeAllConnections();
                         reject(new Error('No authorization code received'));
                         return;
                     }
@@ -183,7 +172,8 @@ export async function runAuthFlow(args) {
                     if (returnedState !== expectedState) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end('State mismatch — possible CSRF attempt. Aborting.');
-                        server.destroy();
+                        server.close();
+                        server.closeAllConnections();
                         reject(new Error('OAuth state token mismatch'));
                         return;
                     }
@@ -191,7 +181,8 @@ export async function runAuthFlow(args) {
                     writeToken(alias, tokens);
                     res.writeHead(200, { 'Content-Type': 'text/html' });
                     res.end('<h2>Authentication successful!</h2><p>You can close this tab.</p>');
-                    server.destroy();
+                    server.close();
+                    server.closeAllConnections();
                     console.log(`Token saved (encrypted) for ${alias}.`);
                     console.log('Next: authenticate your other aliases, then verify with: mcp-google-multi config check');
                     resolve();
@@ -200,7 +191,8 @@ export async function runAuthFlow(args) {
             catch (e) {
                 res.writeHead(500, { 'Content-Type': 'text/plain' });
                 res.end('Internal error during authentication.');
-                server.destroy();
+                server.close();
+                server.closeAllConnections();
                 reject(e);
             }
         })
@@ -210,7 +202,6 @@ export async function runAuthFlow(args) {
             console.log(`Opening your browser to authorize "${alias}". If nothing opens, visit:\n${authorizeUrl}`);
             open(authorizeUrl, { wait: false }).then((cp) => cp.unref());
         });
-        destroyer(server);
         server.on('error', (err) => {
             if (err.code === 'EADDRINUSE') {
                 console.error('Port 4242 is already in use. Close the process using it and retry.');

package/dist/client.d.ts

@@ -1,2 +1,3 @@
+import { OAuth2Client } from 'googleapis-common';
 import type { Account } from './accounts.js';
-export declare function getClient(account: Account): Promise<import("google-auth-library").OAuth2Client>;
+export declare function getClient(account: Account): Promise<OAuth2Client>;

package/dist/client.js

@@ -1,4 +1,4 @@
-import { google } from 'googleapis';
+import { OAuth2Client } from 'googleapis-common';
 import { ACCOUNT_CONFIG } from './accounts.js';
 import { readToken, updateToken } from './token-store.js';
 export async function getClient(account) {
@@ -7,7 +7,7 @@ export async function getClient(account) {
         throw new Error('GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be set. ' +
             'Check that .env exists in the project root or pass them as env vars.');
     }
-    const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, 'http://localhost:4242/oauth2callback');
+    const oauth2Client = new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, 'http://localhost:4242/oauth2callback');
     const tokenData = readToken(account);
     if (!tokenData) {
         throw new Error(`No token found for account "${account}" (${config.email}). ` +

package/dist/executor.js

@@ -20,11 +20,7 @@ export function buildQueryString(queryParams) {
     }
     return usp.toString();
 }
-// GET/HEAD must never carry a request body: no Google Discovery GET/HEAD method
-// declares a request schema, and undici/fetch throw ("Request with GET/HEAD method
-// cannot have body") if one is attached. gaxios stringifies any object `data`
-// without checking the verb, so a caller-supplied `{}` on a read would otherwise
-// crash the request. Write verbs keep prior semantics: null/undefined -> no body.
+// GET/HEAD bodies are stripped — undici rejects them and gaxios attaches `data` regardless of verb (docs/internals.md).
 export function resolveRequestBody(httpMethod, body) {
     const verb = httpMethod.toUpperCase();
     if (verb === 'GET' || verb === 'HEAD')

package/dist/services.js

@@ -27,10 +27,8 @@ export const SERVICES = [
     { name: 'chat', register: registerChatTools, enabled: () => new Set(getOptionalBundles()).has('chat') },
     { name: 'admin', register: registerAdminTools, enabled: () => getAdminAccounts().length > 0 },
 ];
-// Opt-in gates for generated-only services whose scopes are not granted by
-// default; shared services (admin, forms, chat) reuse their curated gate in
-// buildRegistry. workspaceevents has no dedicated scope (subscriptions use the
-// underlying resource scopes), so it registers ungated.
+// Generated-only services with opt-in scopes; admin/forms/chat reuse their curated gate in buildRegistry,
+// and workspaceevents is deliberately absent — no dedicated scope (subscriptions use resource scopes).
 const bundleGate = (name) => ({
     enabled: () => new Set(getOptionalBundles()).has(name),
     hint: `add "${name}" to GOOGLE_OPTIONAL_SCOPES`,

package/dist/token-store.js

@@ -93,9 +93,8 @@ function withTokenLock(alias, fn) {
                         }
                         catch (ownerError) {
                             const code = ownerError.code;
-                            // EPERM: the PID exists but is not signalable (recycled by another
-                            // user) — treat as alive and wait out the timeout rather than
-                            // break a lock we cannot verify.
+                            // EPERM: PID exists but is not signalable (recycled by another user);
+                            // treat as alive, never break a lock we cannot verify.
                             if (code === 'ESRCH')
                                 ownerDead = true;
                             else if (code !== 'EPERM')
@@ -158,11 +157,7 @@ function writeTokenAtomic(alias, data) {
         }
     }
 }
-// Windows uses classic rename semantics (MoveFileExW without POSIX semantics),
-// so replacing a token file that another process momentarily holds open — a
-// concurrent readToken, antivirus, an indexer — fails with a transient
-// EPERM/EACCES/EBUSY. Reads take no lock, so the token lock cannot prevent
-// this; a short bounded retry absorbs it. POSIX rename never fails this way.
+// Windows only: renaming over a momentarily-open file throws transient EPERM/EACCES/EBUSY (reads take no lock); see docs/internals.md.
 function renameWithRetry(from, to) {
     for (let attempt = 1;; attempt++) {
         try {

package/dist/tools/admin.d.ts

@@ -1,8 +1,2 @@
 import type { ToolRegistry } from '../registry.js';
-/**
- * Admin SDK tools require Workspace super-admin (or delegated admin) privileges on the target account.
- * Personal `@gmail.com` accounts will 403 on every endpoint.
- *
- * Writes (e.g. admin_users_update) are gated by write-control like any CUD tool.
- */
 export declare function registerAdminTools(server: ToolRegistry): void;

package/dist/tools/admin.js

@@ -1,16 +1,11 @@
 import { z } from 'zod';
 import { coerceBoolean } from './_coerce.js';
-import { google } from 'googleapis';
+import { admin as adminClient } from '@googleapis/admin';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
 const accountEnum = z.enum(ACCOUNTS);
-/**
- * Admin SDK tools require Workspace super-admin (or delegated admin) privileges on the target account.
- * Personal `@gmail.com` accounts will 403 on every endpoint.
- *
- * Writes (e.g. admin_users_update) are gated by write-control like any CUD tool.
- */
+// Admin SDK requires Workspace super-admin (or delegated admin) on the account — personal @gmail.com accounts 403 on every endpoint.
 export function registerAdminTools(server) {
     // ─── Reports / audit log ───────────────────────────────────────────────
     server.registerTool('reports_activities_list', {
@@ -40,7 +35,7 @@ export function registerAdminTools(server) {
     }, async ({ account, applicationName, userKey, startTime, endTime, eventName, actorIpAddress, filters, orgUnitID, groupIdFilter, customerId, maxResults, pageToken }) => {
         try {
             const auth = await getClient(account);
-            const reports = google.admin({ version: 'reports_v1', auth });
+            const reports = adminClient({ version: 'reports_v1', auth });
             const res = await reports.activities.list({
                 applicationName,
                 userKey: userKey ?? 'all',
@@ -80,7 +75,7 @@ export function registerAdminTools(server) {
     }, async ({ account, customer, domain, query, maxResults, pageToken, orderBy, showDeleted, projection }) => {
         try {
             const auth = await getClient(account);
-            const directory = google.admin({ version: 'directory_v1', auth });
+            const directory = adminClient({ version: 'directory_v1', auth });
             const res = await directory.users.list({
                 customer: customer ?? 'my_customer',
                 domain,
@@ -109,7 +104,7 @@ export function registerAdminTools(server) {
     }, async ({ account, userKey, projection }) => {
         try {
             const auth = await getClient(account);
-            const directory = google.admin({ version: 'directory_v1', auth });
+            const directory = adminClient({ version: 'directory_v1', auth });
             const res = await directory.users.get({
                 userKey,
                 projection: projection ?? 'basic',
@@ -137,7 +132,7 @@ export function registerAdminTools(server) {
     }, async ({ account, userKey, givenName, familyName, suspended, password, changePasswordAtNextLogin, orgUnitPath }) => {
         try {
             const auth = await getClient(account);
-            const directory = google.admin({ version: 'directory_v1', auth });
+            const directory = adminClient({ version: 'directory_v1', auth });
             const requestBody = {};
             if (givenName !== undefined || familyName !== undefined) {
                 requestBody.name = {};
@@ -181,7 +176,7 @@ export function registerAdminTools(server) {
     }, async ({ account, customer, domain, userKey, query, maxResults, pageToken }) => {
         try {
             const auth = await getClient(account);
-            const directory = google.admin({ version: 'directory_v1', auth });
+            const directory = adminClient({ version: 'directory_v1', auth });
             const res = await directory.groups.list({
                 customer: customer ?? 'my_customer',
                 domain,
@@ -211,7 +206,7 @@ export function registerAdminTools(server) {
     }, async ({ account, groupKey, roles, includeDerivedMembership, maxResults, pageToken }) => {
         try {
             const auth = await getClient(account);
-            const directory = google.admin({ version: 'directory_v1', auth });
+            const directory = adminClient({ version: 'directory_v1', auth });
             const res = await directory.members.list({
                 groupKey,
                 roles,

package/dist/tools/calendar.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { coerceArray, coerceBoolean } from './_coerce.js';
-import { google } from 'googleapis';
+import { calendar as calendarClient } from '@googleapis/calendar';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
@@ -15,7 +15,7 @@ export function registerCalendarTools(server) {
     }, async ({ account }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.calendarList.list();
             const calendars = (res.data.items ?? []).map((c) => ({
                 id: c.id,
@@ -50,7 +50,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, calendarId, query, timeMin, timeMax, maxResults }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const params = {
                 calendarId: calendarId ?? 'primary',
                 maxResults: maxResults ?? 25,
@@ -87,7 +87,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, eventId, calendarId }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.events.get({
                 calendarId: calendarId ?? 'primary',
                 eventId,
@@ -119,7 +119,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, summary, start, end, description, location, attendees, calendarId, allDay }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const event = { summary };
             if (allDay) {
                 event.start = { date: start };
@@ -169,7 +169,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, eventId, summary, start, end, description, location, attendees, calendarId }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             // Fetch the event first so a 404 surfaces before we attempt the patch.
             await cal.events.get({
                 calendarId: calendarId ?? 'primary',
@@ -222,7 +222,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, eventId, calendarId }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             await cal.events.delete({
                 calendarId: calendarId ?? 'primary',
                 eventId,
@@ -247,7 +247,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, calendarId, text, sendNotifications }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.events.quickAdd({
                 calendarId: calendarId ?? 'primary',
                 text,
@@ -273,7 +273,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, calendarId, eventId, destinationCalendarId, sendNotifications }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.events.move({
                 calendarId,
                 eventId,
@@ -303,7 +303,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, calendarId, eventId, timeMin, timeMax, maxResults }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.events.instances({
                 calendarId: calendarId ?? 'primary',
                 eventId,
@@ -332,7 +332,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, calendarIds, timeMin, timeMax, timeZone }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.freebusy.query({
                 requestBody: {
                     timeMin,
@@ -360,7 +360,7 @@ export function registerCalendarTools(server) {
     }, async ({ account, summary, description, timeZone }) => {
         try {
             const auth = await getClient(account);
-            const cal = google.calendar({ version: 'v3', auth });
+            const cal = calendarClient({ version: 'v3', auth });
             const res = await cal.calendars.insert({
                 requestBody: {
                     summary,

package/dist/tools/chat.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { coerceJson } from './_coerce.js';
-import { google } from 'googleapis';
+import { chat as chatClient } from '@googleapis/chat';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
@@ -17,7 +17,7 @@ export function registerChatTools(server) {
     }, async ({ account, pageSize, pageToken, filter }) => {
         try {
             const auth = await getClient(account);
-            const chat = google.chat({ version: 'v1', auth });
+            const chat = chatClient({ version: 'v1', auth });
             const res = await chat.spaces.list({
                 pageSize: pageSize ?? 100,
                 pageToken,
@@ -40,7 +40,7 @@ export function registerChatTools(server) {
     }, async ({ account, name }) => {
         try {
             const auth = await getClient(account);
-            const chat = google.chat({ version: 'v1', auth });
+            const chat = chatClient({ version: 'v1', auth });
             const res = await chat.spaces.get({ name });
             return {
                 content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
@@ -66,7 +66,7 @@ export function registerChatTools(server) {
                 return { content: [{ type: 'text', text: JSON.stringify({ error: 'Either text or cardsV2 must be provided' }) }], isError: true };
             }
             const auth = await getClient(account);
-            const chat = google.chat({ version: 'v1', auth });
+            const chat = chatClient({ version: 'v1', auth });
             const requestBody = {};
             if (text)
                 requestBody.text = text;
@@ -100,7 +100,7 @@ export function registerChatTools(server) {
     }, async ({ account, parent, pageSize, pageToken, filter, orderBy }) => {
         try {
             const auth = await getClient(account);
-            const chat = google.chat({ version: 'v1', auth });
+            const chat = chatClient({ version: 'v1', auth });
             const res = await chat.spaces.messages.list({
                 parent,
                 pageSize: pageSize ?? 100,

package/dist/tools/contacts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { google } from 'googleapis';
+import { people as peopleClient } from '@googleapis/people';
 import { ACCOUNTS } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
@@ -43,7 +43,7 @@ export function registerContactsTools(server) {
     }, async ({ account, query, pageSize }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             // Warmup request required by the People API
             await people.people.searchContacts({
                 query: '',
@@ -72,7 +72,7 @@ export function registerContactsTools(server) {
     }, async ({ account, resourceName }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             const res = await people.people.get({
                 resourceName,
                 personFields: PERSON_FIELDS,
@@ -103,7 +103,7 @@ export function registerContactsTools(server) {
     }, async ({ account, pageSize, pageToken, sortOrder }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             const res = await people.people.connections.list({
                 resourceName: 'people/me',
                 personFields: PERSON_FIELDS,
@@ -142,7 +142,7 @@ export function registerContactsTools(server) {
     }, async ({ account, givenName, familyName, email, emailType, phone, phoneType, organization, jobTitle }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             const requestBody = {
                 names: [{ givenName, familyName: familyName ?? '' }],
             };
@@ -189,7 +189,7 @@ export function registerContactsTools(server) {
     }, async ({ account, resourceName, givenName, familyName, email, emailType, phone, phoneType, organization, jobTitle }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             // Fetch current contact to get etag
             const current = await people.people.get({
                 resourceName,
@@ -251,7 +251,7 @@ export function registerContactsTools(server) {
     }, async ({ account, resourceName }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             await people.people.deleteContact({ resourceName });
             return {
                 content: [{ type: 'text', text: JSON.stringify({
@@ -273,7 +273,7 @@ export function registerContactsTools(server) {
     }, async ({ account, pageSize }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             const res = await people.contactGroups.list({
                 pageSize: pageSize ?? 100,
                 groupFields: 'name,groupType,memberCount',
@@ -303,7 +303,7 @@ export function registerContactsTools(server) {
     }, async ({ account, groupResourceName, maxMembers }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             const groupRes = await people.contactGroups.get({
                 resourceName: groupResourceName,
                 maxMembers: maxMembers ?? 100,
@@ -344,7 +344,7 @@ export function registerContactsTools(server) {
     }, async ({ account, name }) => {
         try {
             const auth = await getClient(account);
-            const people = google.people({ version: 'v1', auth });
+            const people = peopleClient({ version: 'v1', auth });
             const res = await people.contactGroups.create({
                 requestBody: {
                     contactGroup: { name },