mcp-google-multi 6.0.0-alpha.74 → 6.0.0-alpha.76

package/README.md

@@ -4,7 +4,7 @@ The most complete **local Google Workspace MCP server**: Gmail, Drive, Calendar,
 
 [![npm](https://img.shields.io/npm/v/mcp-google-multi?label=npm&color=cb3837)](https://www.npmjs.com/package/mcp-google-multi)
 
-- 🧰 **Exhaustive** — 940 tools across 29 services, now including Google Analytics (GA4), + an escape hatch for anything else → [COVERAGE.md](./COVERAGE.md)
+- 🧰 **Exhaustive** — 942 tools across 29 services, now including Google Analytics (GA4), + an escape hatch for anything else → [COVERAGE.md](./COVERAGE.md)
 - 🔑 **Multi-account** — drive any number of Google accounts by alias, or fan one call out across all of them
 - 🔒 **Private by design** — your own OAuth app, tokens encrypted at rest (AES-256-GCM), writes deny-by-default, no telemetry, no metering — it talks only to Google
 - 🌐 **Local or remote** — runs locally over stdio, or self-hosted over HTTP with its own built-in OAuth 2.1 server (Claude Code's `/mcp` login and the claude.ai connector, zero custom UI). Pull-and-up Docker Compose with optional automatic HTTPS → [remote setup](./docs/http-setup.md)

package/dist/registry.js

@@ -59,6 +59,8 @@ const CUD_OVERRIDES = {
     drive_transfer: 'create',
     // read-only resolver; the name's "resolve" verb would otherwise infer update.
     contacts_resolve: 'read',
+    // "respond" matches no write verb; it patches the event (a write).
+    calendar_respond_event: 'update',
     // Gated by anthropic/requiresUserInteraction, not write-control, so
     // onboarding works under any profile; cud=read also keeps them off fan-out.
     account_add: 'read',

package/dist/tools/admin.js

@@ -68,7 +68,12 @@ export function registerAdminTools(server, deps = {}) {
             account: accountEnum.describe('Google account alias (must be a Workspace admin)'),
             customer: z.string().default('my_customer').optional(),
             domain: z.string().optional(),
-            query: z.string().optional().describe('Search query, e.g. "name:John"'),
+            query: z.string().optional().describe('Directory search query: space-separated clauses of field+operator+value, ANDed together. ' +
+                '"=" is exact match, ":" is a contains/startsWith match. Searchable fields include email, name ' +
+                '(matches the concatenated givenName+familyName), givenName, familyName, isAdmin, isDelegatedAdmin, ' +
+                'orgName, orgTitle, orgDepartment, manager, directManager, addressCountry. Prefix/wildcard matching ' +
+                'is a trailing "*" on a ":" clause, e.g. "email:admin*" for every address starting with "admin". ' +
+                'Examples: \'name:John\', \'isAdmin=true\', \'orgTitle:Manager orgName=Engineering\'.'),
             maxResults: z.number().min(1).max(500).optional(),
             pageToken: z.string().optional(),
             orderBy: z.enum(['email', 'familyName', 'givenName']).optional(),

package/dist/tools/analytics.js

@@ -4,7 +4,7 @@ import { analyticsdata as analyticsdataClient } from '@googleapis/analyticsdata'
 import { analyticsadmin as analyticsadminClient } from '@googleapis/analyticsadmin';
 import { accountArgLive } from '../accounts.js';
 import { getClient } from '../client.js';
-import { handleGoogleApiError } from './_errors.js';
+import { handleGoogleApiError, invalidParams } from './_errors.js';
 /** Accepts "213025502" or "properties/213025502"; rejects the identifiers
  * people paste by mistake (G-… measurement IDs, UA-… properties) with a
  * pointer to the right one. */
@@ -104,6 +104,11 @@ export function shapeMetadata(data) {
 const propertySchema = z
     .string()
     .describe('GA4 property: numeric ID like "213025502" or "properties/213025502" — NOT a "G-..." measurement ID and not "UA-...". Find yours with analytics_account_summaries.');
+// Accepts this server's plain string form and the native GA4 API shape ({name}),
+// so a request built against GA4's own docs works unmodified.
+const metricOrDimensionRef = z.union([z.string(), z.object({ name: z.string() })]);
+const nameOf = (ref) => (typeof ref === 'string' ? ref : ref.name);
+const dateRangeRef = z.object({ startDate: z.string(), endDate: z.string() });
 export function registerAnalyticsTools(server, deps = {}) {
     // Per-registry, live account enum + injectable client: the schema follows
     // the registry's account view at parse time, not a process-global default.
@@ -130,16 +135,19 @@ export function registerAnalyticsTools(server, deps = {}) {
         }
     });
     server.registerTool('analytics_run_report', {
-        description: 'Run a Google Analytics (GA4) report: metrics over a date range, optionally grouped by dimensions — the workhorse for questions like "how many users last week, by country". Dates accept YYYY-MM-DD or relative forms ("today", "yesterday", "28daysAgo"). Unsure which dimension/metric names are valid? Call analytics_get_metadata first.',
+        description: 'Run a Google Analytics (GA4) report: metrics over a date range, optionally grouped by dimensions — the workhorse for questions like "how many users last week, by country". Dates accept YYYY-MM-DD or relative forms ("today", "yesterday", "28daysAgo"). Also accepts the native GA4 request shapes directly: a single dateRanges entry in place of startDate/endDate, and metrics/dimensions as {name} objects. Unsure which dimension/metric names are valid? Call analytics_get_metadata first.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             property: propertySchema,
-            startDate: z.string().describe('Start date: YYYY-MM-DD or relative ("today", "yesterday", "NdaysAgo" e.g. "28daysAgo")'),
-            endDate: z.string().describe('End date: YYYY-MM-DD or relative ("today", "yesterday", "NdaysAgo")'),
-            metrics: coerceArray(z.string()).describe('Metric API names, e.g. ["activeUsers","sessions","screenPageViews"]. Max 10. Valid names (including custom ones) come from analytics_get_metadata.'),
-            dimensions: coerceArray(z.string())
+            startDate: z.string().optional().describe('Start date: YYYY-MM-DD or relative ("today", "yesterday", "NdaysAgo" e.g. "28daysAgo"). Required unless dateRanges is given.'),
+            endDate: z.string().optional().describe('End date: YYYY-MM-DD or relative ("today", "yesterday", "NdaysAgo"). Required unless dateRanges is given.'),
+            dateRanges: coerceJson(z.array(dateRangeRef))
                 .optional()
-                .describe('Dimension API names to group by, e.g. ["date"] or ["country","deviceCategory"]. Max 9. Omit for a single total row.'),
+                .describe('Native GA4 shape, as an alternative to startDate/endDate: exactly one {startDate, endDate} entry (this tool runs one range per call).'),
+            metrics: coerceArray(metricOrDimensionRef).describe('Metric API names, e.g. ["activeUsers","sessions","screenPageViews"], or the native GA4 [{"name":"activeUsers"}] form. Max 10. Valid names (including custom ones) come from analytics_get_metadata.'),
+            dimensions: coerceArray(metricOrDimensionRef)
+                .optional()
+                .describe('Dimension API names to group by, e.g. ["date"] or ["country","deviceCategory"], or the native GA4 {"name":...} form. Max 9. Omit for a single total row.'),
             dimensionFilter: coerceJson(z.record(z.string(), z.unknown()))
                 .optional()
                 .describe('FilterExpression on dimensions (applies independently of metricFilter). Simple: {"filter":{"fieldName":"country","stringFilter":{"matchType":"EXACT","value":"France"}}}. AND of two: {"andGroup":{"expressions":[{"filter":{"fieldName":"country","stringFilter":{"matchType":"EXACT","value":"France"}}},{"filter":{"fieldName":"deviceCategory","stringFilter":{"matchType":"EXACT","value":"mobile"}}}]}}. matchType: EXACT | BEGINS_WITH | ENDS_WITH | CONTAINS | FULL_REGEXP (add "caseSensitive":true for case-sensitive). Also available: inListFilter, notExpression, orGroup.'),
@@ -157,19 +165,28 @@ export function registerAnalyticsTools(server, deps = {}) {
             keepEmptyRows: coerceBoolean.optional().describe('Include rows whose metrics are all zero (default false)'),
             returnPropertyQuota: coerceBoolean.optional().describe("Include this property's remaining quota tokens in the response"),
         },
-    }, async ({ account, property, startDate, endDate, metrics, dimensions, dimensionFilter, metricFilter, orderBys, limit, offset, metricAggregations, keepEmptyRows, returnPropertyQuota }) => {
+    }, async ({ account, property, startDate, endDate, dateRanges, metrics, dimensions, dimensionFilter, metricFilter, orderBys, limit, offset, metricAggregations, keepEmptyRows, returnPropertyQuota }) => {
         const prop = normalizeProperty(property);
         if ('hint' in prop)
             return invalidProperty(prop.hint, account);
+        if (dateRanges !== undefined && dateRanges.length > 1) {
+            return invalidParams(account, `dateRanges has ${dateRanges.length} entries, but analytics_run_report runs a single range per call.`, 'Pass exactly one {startDate, endDate} entry, or call the tool once per range.');
+        }
+        const range = dateRanges?.[0];
+        const resolvedStart = range?.startDate ?? startDate;
+        const resolvedEnd = range?.endDate ?? endDate;
+        if (resolvedStart === undefined || resolvedEnd === undefined) {
+            return invalidParams(account, 'Missing a date range: pass startDate and endDate, or a single-entry dateRanges.', 'e.g. startDate: "28daysAgo", endDate: "today", or dateRanges: [{"startDate":"28daysAgo","endDate":"today"}].');
+        }
         try {
             const auth = await getClientFn(account);
             const dataApi = analyticsdataClient({ version: 'v1beta', auth });
             const requestBody = {
-                dateRanges: [{ startDate, endDate }],
-                metrics: metrics.map((name) => ({ name })),
+                dateRanges: [{ startDate: resolvedStart, endDate: resolvedEnd }],
+                metrics: metrics.map((ref) => ({ name: nameOf(ref) })),
             };
             if (dimensions?.length)
-                requestBody.dimensions = dimensions.map((name) => ({ name }));
+                requestBody.dimensions = dimensions.map((ref) => ({ name: nameOf(ref) }));
             if (dimensionFilter)
                 requestBody.dimensionFilter = dimensionFilter;
             if (metricFilter)

package/dist/tools/calendar.d.ts

@@ -8,6 +8,11 @@ export declare function registerCalendarTools(server: ToolRegistry, deps?: Curat
  * Date.parse is lenient, so it is used only to SKIP the check, never to accept. */
 export declare function timeRangeError(timeMin: string | undefined, timeMax: string | undefined): string | null;
 export declare const TIME_RANGE_HINT: string;
+/** The Calendar API requires timeMin/timeMax as RFC3339 with a mandatory
+ * offset; a bare local datetime is silently ambiguous rather than rejected,
+ * so catch it here with a message that names the field. */
+export declare function missingTimeZoneError(field: 'timeMin' | 'timeMax', value: string | undefined): string | null;
+export declare const MISSING_TIME_ZONE_HINT = "Add \"Z\" for UTC or an explicit offset, e.g. \"2026-04-04T00:00:00Z\" or \"2026-04-04T00:00:00+01:00\".";
 export declare function formatEvent(event: any, opts?: {
     full?: boolean;
 }): {

package/dist/tools/calendar.js

@@ -54,6 +54,9 @@ export function registerCalendarTools(server, deps = {}) {
                 .describe('Continuation token from a previous call\'s nextPageToken'),
         },
     }, async ({ account, calendarId, query, timeMin, timeMax, maxResults, pageToken }) => {
+        const tzError = missingTimeZoneError('timeMin', timeMin) ?? missingTimeZoneError('timeMax', timeMax);
+        if (tzError)
+            return invalidParams(account, tzError, MISSING_TIME_ZONE_HINT);
         const rangeError = timeRangeError(timeMin, timeMax);
         if (rangeError)
             return invalidParams(account, rangeError, TIME_RANGE_HINT);
@@ -236,6 +239,46 @@ export function registerCalendarTools(server, deps = {}) {
             return handleCalendarError(error, account);
         }
     });
+    // attendeesOmitted plus a single-entry attendees array patches only the caller's own RSVP.
+    server.registerTool('calendar_respond_event', {
+        description: 'RSVP to a calendar event as this account (accepted/declined/tentative) without touching any other attendee',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            eventId: z.string().min(1).describe('Calendar event ID'),
+            calendarId: z.string().default('primary').optional()
+                .describe('Calendar ID (default: primary)'),
+            response: z.enum(['accepted', 'declined', 'tentative']).describe('RSVP response'),
+            comment: z.string().optional().describe('Optional comment attached to the response'),
+        },
+    }, async ({ account, eventId, calendarId, response, comment }) => {
+        try {
+            const auth = await getClientFn(account);
+            const cal = calendarClient({ version: 'v3', auth });
+            const cid = calendarId ?? 'primary';
+            const current = await cal.events.get({ calendarId: cid, eventId });
+            const attendees = current.data.attendees ?? [];
+            const accountEmail = server.accountSet().configs[account]?.email;
+            const self = attendees.find((a) => a.self)
+                ?? attendees.find((a) => a.email?.toLowerCase() === accountEmail?.toLowerCase());
+            if (!self?.email) {
+                return invalidParams(account, `Event "${eventId}" has no attendee entry for this account, so there is nothing to RSVP to.`, 'RSVP only applies to events where this account is invited as a guest; check calendar_get_event to see the attendee list.');
+            }
+            const res = await cal.events.patch({
+                calendarId: cid,
+                eventId,
+                requestBody: {
+                    attendeesOmitted: true,
+                    attendees: [{ email: self.email, responseStatus: response, ...(comment !== undefined ? { comment } : {}) }],
+                },
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify(formatEvent(res.data), null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleCalendarError(error, account);
+        }
+    });
     server.registerTool('calendar_delete_event', {
         description: 'Delete a Google Calendar event',
         inputSchema: {
@@ -328,6 +371,9 @@ export function registerCalendarTools(server, deps = {}) {
                 .describe('Continuation token from a previous call\'s nextPageToken'),
         },
     }, async ({ account, calendarId, eventId, timeMin, timeMax, maxResults, pageToken }) => {
+        const tzError = missingTimeZoneError('timeMin', timeMin) ?? missingTimeZoneError('timeMax', timeMax);
+        if (tzError)
+            return invalidParams(account, tzError, MISSING_TIME_ZONE_HINT);
         const rangeError = timeRangeError(timeMin, timeMax);
         if (rangeError)
             return invalidParams(account, rangeError, TIME_RANGE_HINT);
@@ -367,6 +413,9 @@ export function registerCalendarTools(server, deps = {}) {
             if (calendarIds.length === 0) {
                 return invalidParams(account, '`calendarIds` is empty, so there is nothing to check.', 'Pass at least one calendar ID, e.g. ["primary"]. Use calendar_list_calendars to see the IDs this account can read.');
             }
+            const tzError = missingTimeZoneError('timeMin', timeMin) ?? missingTimeZoneError('timeMax', timeMax);
+            if (tzError)
+                return invalidParams(account, tzError, MISSING_TIME_ZONE_HINT);
             const rangeError = timeRangeError(timeMin, timeMax);
             if (rangeError)
                 return invalidParams(account, rangeError, TIME_RANGE_HINT);
@@ -440,6 +489,16 @@ export function timeRangeError(timeMin, timeMax) {
 }
 export const TIME_RANGE_HINT = 'Swap the two values or widen the window: timeMin must be strictly earlier than timeMax. ' +
     'An empty result from this tool then always means "nothing scheduled", never "bad range".';
+const TZ_SUFFIX_RE = /(Z|[+-]\d{2}:?\d{2})$/;
+/** The Calendar API requires timeMin/timeMax as RFC3339 with a mandatory
+ * offset; a bare local datetime is silently ambiguous rather than rejected,
+ * so catch it here with a message that names the field. */
+export function missingTimeZoneError(field, value) {
+    if (value === undefined || TZ_SUFFIX_RE.test(value))
+        return null;
+    return `${field} ("${value}") has no "Z" or UTC offset, so its timezone is ambiguous.`;
+}
+export const MISSING_TIME_ZONE_HINT = 'Add "Z" for UTC or an explicit offset, e.g. "2026-04-04T00:00:00Z" or "2026-04-04T00:00:00+01:00".';
 export function formatEvent(event, opts = {}) {
     const full = opts.full ?? true;
     const description = event.description ?? '';

package/dist/tools/contacts.js

@@ -234,8 +234,8 @@ export function registerContactsTools(server, deps = {}) {
         description: 'List all contacts (paginated)',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            pageSize: z.number().min(1).max(1000).default(100).optional()
-                .describe('Number of contacts per page (default: 100)'),
+            pageSize: z.number().min(1).max(1000).default(50).optional()
+                .describe('Number of contacts per page (default: 50)'),
             pageToken: z.string().optional().describe('Page token for pagination'),
             sortOrder: z.enum([
                 'LAST_MODIFIED_ASCENDING',
@@ -244,19 +244,25 @@ export function registerContactsTools(server, deps = {}) {
                 'LAST_NAME_ASCENDING',
             ]).default('FIRST_NAME_ASCENDING').optional()
                 .describe('Sort order (default: FIRST_NAME_ASCENDING)'),
+            requireEmail: coerceBoolean.optional().describe('Only return contacts with at least one email address. Filtering happens after the page is fetched, so the returned page can hold fewer than pageSize contacts; nextPageToken still continues the underlying, unfiltered listing'),
+            requireName: coerceBoolean.optional().describe('Only return contacts with a name. Filtering happens after the page is fetched, so the returned page can hold fewer than pageSize contacts; nextPageToken still continues the underlying, unfiltered listing'),
         },
-    }, async ({ account, pageSize, pageToken, sortOrder }) => {
+    }, async ({ account, pageSize, pageToken, sortOrder, requireEmail, requireName }) => {
         try {
             const auth = await getClientFn(account);
             const people = peopleClient({ version: 'v1', auth });
             const res = await people.people.connections.list({
                 resourceName: 'people/me',
                 personFields: PERSON_FIELDS,
-                pageSize: pageSize ?? 100,
+                pageSize: pageSize ?? 50,
                 pageToken: pageToken ?? undefined,
                 sortOrder: sortOrder ?? 'FIRST_NAME_ASCENDING',
             });
-            const contacts = (res.data.connections ?? []).map(formatContact);
+            let contacts = (res.data.connections ?? []).map(formatContact);
+            if (requireEmail)
+                contacts = contacts.filter((c) => c.emails.length > 0);
+            if (requireName)
+                contacts = contacts.filter((c) => c.name !== '');
             return {
                 content: [{ type: 'text', text: JSON.stringify({
                             contacts,

package/dist/tools/docs.js

@@ -380,35 +380,64 @@ export function registerDocsTools(server, deps = {}) {
     server.registerTool('docs_replace_text', {
         // Insert/append-capable or non-convergent: a retry duplicates content.
         annotations: { idempotentHint: false },
-        description: 'Find and replace all occurrences of text in a document',
+        description: 'Find and replace text in a document. Pass findText/replaceText for a single pair, or replacements for several pairs applied in one batchUpdate.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             documentId: z.string().min(1).describe('Google Docs document ID'),
-            findText: z.string().describe('Text to search for'),
-            replaceText: z.string().describe('Replacement text'),
+            findText: z.string().optional().describe('Text to search for. Use with replaceText; exactly one of this pair or `replacements` is required.'),
+            replaceText: z.string().optional().describe('Replacement text for findText'),
             matchCase: coerceBoolean.default(true).optional()
                 .describe('Case-sensitive match (default: true)'),
+            replacements: coerceJson(z.array(z.object({
+                findText: z.string(),
+                replaceText: z.string(),
+                matchCase: coerceBoolean.optional(),
+            })).min(1)).optional().describe('Several find/replace pairs applied in one batchUpdate, each returning its own count. Exactly one of this or findText/replaceText is required.'),
         },
-    }, async ({ account, documentId, findText, replaceText, matchCase }) => {
+    }, async ({ account, documentId, findText, replaceText, matchCase, replacements }) => {
+        const singlePair = findText !== undefined || replaceText !== undefined;
+        if (singlePair && replacements) {
+            return invalidParams(account, 'Pass either findText/replaceText or replacements, not both.', 'Use findText and replaceText for one pair, or replacements for several pairs in one call.');
+        }
+        if (!singlePair && !replacements) {
+            return invalidParams(account, 'Pass findText and replaceText, or a replacements array.', 'Use findText and replaceText for one pair, or replacements for several pairs in one call.');
+        }
+        if (singlePair && (findText === undefined || replaceText === undefined)) {
+            return invalidParams(account, 'Both findText and replaceText are required together.', 'Pass both, or use replacements for several pairs.');
+        }
+        const pairs = replacements ?? [{ findText: findText, replaceText: replaceText, matchCase }];
         try {
             const auth = await getClientFn(account);
             const docs = docsClient({ version: 'v1', auth });
             const res = await docs.documents.batchUpdate({
                 documentId,
                 requestBody: {
-                    requests: [{
-                            replaceAllText: {
-                                containsText: { text: findText, matchCase: matchCase ?? true },
-                                replaceText,
-                            },
-                        }],
+                    requests: pairs.map((p) => ({
+                        replaceAllText: {
+                            containsText: { text: p.findText, matchCase: p.matchCase ?? true },
+                            replaceText: p.replaceText,
+                        },
+                    })),
                 },
             });
-            const occurrences = res.data.replies?.[0]?.replaceAllText?.occurrencesChanged ?? 0;
+            const counts = (res.data.replies ?? []).map((r) => r?.replaceAllText?.occurrencesChanged ?? 0);
+            const warning = counts.every((c) => c === 0)
+                ? 'No occurrences were replaced; check spelling and matchCase.'
+                : undefined;
+            if (replacements) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({
+                                documentId: res.data.documentId,
+                                replacements: pairs.map((p, i) => ({ findText: p.findText, replaceText: p.replaceText, occurrencesReplaced: counts[i] })),
+                                ...(warning ? { warning } : {}),
+                            }, null, 2) }],
+                };
+            }
             return {
                 content: [{ type: 'text', text: JSON.stringify({
                             documentId: res.data.documentId,
-                            occurrencesReplaced: occurrences,
+                            occurrencesReplaced: counts[0],
+                            ...(warning ? { warning } : {}),
                         }, null, 2) }],
             };
         }

package/dist/tools/drive.js

@@ -13,11 +13,13 @@ import * as path from 'path';
 import * as os from 'os';
 import * as crypto from 'crypto';
 import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
 import mime from 'mime-types';
 // drive_transfer's two-account form is the sanctioned schema exception and
 // stays REQUIRED: omission must fail at the schema, not as a runtime riddle.
 const MAX_FILE_SIZE = 2 * 1024 * 1024; // 2MB
 const FALLBACK_MAX_BYTES = 1024 * 1024 * 1024; // 1GB
+const MAX_UPLOAD_BASE64_BYTES = 10 * 1024 * 1024; // 10MB decoded
 const GOOGLE_WORKSPACE_TYPES = new Set([
     'application/vnd.google-apps.document',
     'application/vnd.google-apps.spreadsheet',
@@ -135,8 +137,10 @@ export function registerDriveTools(server, deps = {}) {
             driveId: z.string().optional().describe('Optional shared drive ID'),
             pageToken: z.string().min(1).optional()
                 .describe('Continuation token from a previous call\'s nextPageToken'),
+            orderBy: z.string().optional()
+                .describe('Sort key(s) for files.list, e.g. "modifiedTime desc" or "folder,name". Default: Drive\'s relevance ranking for the query, an arbitrary stable order otherwise.'),
         },
-    }, async ({ account, query, maxResults, driveId, pageToken }) => {
+    }, async ({ account, query, maxResults, driveId, pageToken, orderBy }) => {
         try {
             // normalizeDriveQuery trims to '' and Drive reads that as "everything", so
             // a blank query would list the whole drive as a "search" result.
@@ -160,6 +164,8 @@ export function registerDriveTools(server, deps = {}) {
             }
             if (pageToken)
                 params.pageToken = pageToken;
+            if (orderBy)
+                params.orderBy = orderBy;
             const res = await drive.files.list(params);
             const incomplete = res.data.incompleteSearch === true;
             return {
@@ -337,22 +343,55 @@ export function registerDriveTools(server, deps = {}) {
         }
     });
     // ─── Write / upload / download ─────────────────────────────────────────
-    registerHostFileTool('drive_upload', {
-        description: 'Upload a local file to Google Drive. Pass `convertTo` to import it as a native, editable Google Doc/Sheet/Slides/Drawing instead of storing the raw bytes.',
+    server.registerTool('drive_upload', {
+        description: 'Upload a file to Google Drive, from inline base64 content or (when this server exposes the host filesystem) a local path. Pass `convertTo` to import it as a native, editable Google Doc/Sheet/Slides/Drawing instead of storing the raw bytes.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            localPath: z.string().min(1).describe('Absolute path of the SOURCE file on disk to upload (on the machine running the server; this is not savePath)'),
             filename: z.string().describe('Name as it appears in Drive'),
-            mimeType: z.string().optional().describe('Source MIME type of the local file (inferred from extension if omitted). With `convertTo`, this is the format Drive imports from.'),
+            contentBase64: z.string().optional().describe(`Base64-encoded file content. Exactly one of contentBase64${localFiles ? ' or localPath' : ''} is required. Decoded size is capped at ${MAX_UPLOAD_BASE64_BYTES / (1024 * 1024)} MB.`),
+            ...(localFiles
+                ? {
+                    localPath: z.string().min(1).optional().describe('Absolute path of the SOURCE file on disk to upload (on the machine running the server; this is not savePath). Exactly one of contentBase64 or localPath is required.'),
+                }
+                : {}),
+            mimeType: z.string().optional().describe('Source MIME type of the content (inferred from filename if omitted). With `convertTo`, this is the format Drive imports from.'),
             convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('Convert the upload into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted). E.g. upload .md/.html/.docx/.txt with convertTo=document to get a real Google Doc. Source must be an importable format. Omit to store the file as-is.'),
             parentFolderId: z.string().optional().describe('Parent folder ID, not parentId. Defaults to My Drive root'),
         },
-    }, async ({ account, localPath, filename, mimeType: mimeTypeArg, convertTo, parentFolderId }) => {
+    }, async (args) => {
+        const { account, filename, contentBase64, mimeType: mimeTypeArg, convertTo, parentFolderId } = args;
+        // Declared only when the context may read host files (see the shape).
+        const { localPath: localPathArg } = args;
+        if (localPathArg && !localFiles)
+            return hostFilesRefused(account, 'localPath');
+        const hasBase64 = contentBase64 !== undefined;
+        const hasLocalPath = !!localPathArg;
+        if (hasBase64 === hasLocalPath) {
+            return invalidParams(account, `Pass exactly one of contentBase64${localFiles ? ' or localPath' : ''}.`, localFiles
+                ? 'Use contentBase64 for inline content, or localPath for a file already on the machine running the server.'
+                : 'Pass contentBase64 with the file\'s base64-encoded content.');
+        }
         try {
+            let media;
+            if (hasBase64) {
+                const maxB64Length = Math.ceil(MAX_UPLOAD_BASE64_BYTES / 3) * 4 + 4;
+                if (contentBase64.length > maxB64Length) {
+                    return invalidParams(account, `Base64-encoded contentBase64 string length ${contentBase64.length} exceeds the ${maxB64Length} character limit (implies decoded size over ${MAX_UPLOAD_BASE64_BYTES} bytes).`, 'Upload a smaller file, or use localPath if this server exposes the host filesystem.');
+                }
+                const buf = Buffer.from(contentBase64, 'base64');
+                if (buf.length > MAX_UPLOAD_BASE64_BYTES) {
+                    return invalidParams(account, `Decoded contentBase64 is ${buf.length} bytes, over the ${MAX_UPLOAD_BASE64_BYTES} byte cap.`, 'Upload a smaller file, or use localPath if this server exposes the host filesystem.');
+                }
+                media = { mimeType: mimeTypeArg ?? (mime.lookup(filename) || 'application/octet-stream'), body: Readable.from(buf) };
+            }
+            else {
+                media = {
+                    mimeType: mimeTypeArg ?? (mime.lookup(localPathArg) || 'application/octet-stream'),
+                    body: await openLocalReadStream(localPathArg),
+                };
+            }
             const auth = await getClientFn(account);
             const drive = driveClient({ version: 'v3', auth });
-            const resolvedMime = mimeTypeArg ?? (mime.lookup(localPath) || 'application/octet-stream');
-            const fileStream = await openLocalReadStream(localPath);
             const res = await drive.files.create({
                 requestBody: {
                     name: filename,
@@ -360,10 +399,7 @@ export function registerDriveTools(server, deps = {}) {
                     // Setting a google-apps target type makes Drive convert the media on import.
                     ...(convertTo ? { mimeType: resolveConvertTarget(convertTo) } : {}),
                 },
-                media: {
-                    mimeType: resolvedMime,
-                    body: fileStream,
-                },
+                media,
                 fields: 'id,name,mimeType,webViewLink,size',
                 supportsAllDrives: true,
             });
@@ -676,6 +712,12 @@ export function registerDriveTools(server, deps = {}) {
             expirationTime: z.string().optional().describe('RFC 3339 timestamp when access expires. Only valid for role="reader" or "commenter".'),
         },
     }, async ({ account, fileId, type, role, emailAddress, domain, sendNotification, emailMessage, transferOwnership, expirationTime }) => {
+        if ((type === 'user' || type === 'group') && !emailAddress) {
+            return invalidParams(account, `type is "${type}" but emailAddress was not supplied.`, 'Pass emailAddress, the grantee to share with.');
+        }
+        if (type === 'domain' && !domain) {
+            return invalidParams(account, 'type is "domain" but domain was not supplied.', 'Pass domain, e.g. "example.com".');
+        }
         {
             // Outbound allowlist (off unless GOOGLE_OUTBOUND_ALLOWLIST is set): user/group
             // grantees must match, a domain share needs its exact "@domain" entry, "anyone" is refused while active.

package/dist/tools/sheets.d.ts

@@ -1,6 +1,15 @@
 import type { ToolRegistry } from '../registry.js';
 import { type CuratedToolDeps } from '../client.js';
 export declare function registerSheetsTools(server: ToolRegistry, deps?: CuratedToolDeps): void;
+interface GridRangeIndexes {
+    startRowIndex?: number;
+    endRowIndex?: number;
+    startColumnIndex?: number;
+    endColumnIndex?: number;
+}
+export declare function parseA1Range(a1: string): GridRangeIndexes & {
+    sheetName: string;
+};
 export declare function buildCellFormat(input: {
     backgroundColor?: {
         red?: number;
@@ -33,3 +42,4 @@ export declare function buildCellFormat(input: {
     format: any;
     fields: string;
 };
+export {};

package/dist/tools/sheets.js

@@ -369,6 +369,31 @@ export function registerSheetsTools(server, deps = {}) {
             return handleSheetsError(error, account);
         }
     });
+    server.registerTool('sheets_copy_sheet_to', {
+        description: 'Copy a tab into another spreadsheet (which may belong to a different account)',
+        inputSchema: {
+            account: accountEnum.describe('Google account alias'),
+            spreadsheetId: z.string().min(1).describe('Source spreadsheet ID'),
+            sheetId: z.number().describe('Source sheet ID'),
+            destinationSpreadsheetId: z.string().min(1).describe('Destination spreadsheet ID'),
+        },
+    }, async ({ account, spreadsheetId, sheetId, destinationSpreadsheetId }) => {
+        try {
+            const auth = await getClientFn(account);
+            const sheets = sheetsClient({ version: 'v4', auth });
+            const res = await sheets.spreadsheets.sheets.copyTo({
+                spreadsheetId,
+                sheetId,
+                requestBody: { destinationSpreadsheetId },
+            });
+            return {
+                content: [{ type: 'text', text: JSON.stringify(res.data, null, 2) }],
+            };
+        }
+        catch (error) {
+            return handleSheetsError(error, account);
+        }
+    });
     server.registerTool('sheets_update_sheet_properties', {
         description: 'Rename a tab, change tab color, freeze rows/columns, hide/show, or change grid dimensions',
         inputSchema: {
@@ -457,7 +482,8 @@ export function registerSheetsTools(server, deps = {}) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             spreadsheetId: z.string().min(1).describe('Spreadsheet ID'),
-            range: gridRangeSchema.describe('Target range (GridRange, half-open indexes)'),
+            range: z.union([gridRangeSchema, z.string().min(1)])
+                .describe('Target range: a GridRange object (half-open indexes), or an A1 string such as "Sheet1!A1:D10" (the sheet title is resolved to a sheetId with one extra call)'),
             backgroundColor: rgbColorSchema.optional().describe('Cell background (RGB 0..1)'),
             textFormat: z.object({
                 foregroundColor: rgbColorSchema.optional(),
@@ -484,12 +510,16 @@ export function registerSheetsTools(server, deps = {}) {
             if (built.fields.length === 0) {
                 return invalidParams(account, 'No formatting to apply: every optional format property was omitted.', 'Pass at least one of: backgroundColor, textFormat, horizontalAlignment, verticalAlignment, wrapStrategy, numberFormat.');
             }
+            const targetRange = typeof range === 'string' ? await resolveA1GridRange(sheets, spreadsheetId, range) : range;
+            if ('error' in targetRange) {
+                return invalidParams(account, targetRange.error, targetRange.hint);
+            }
             await sheets.spreadsheets.batchUpdate({
                 spreadsheetId,
                 requestBody: {
                     requests: [{
                             repeatCell: {
-                                range,
+                                range: targetRange,
                                 cell: { userEnteredFormat: built.format },
                                 fields: built.fields,
                             },
@@ -1118,6 +1148,83 @@ const gridRangeSchema = z.object({
     startColumnIndex: z.number().min(0).optional(),
     endColumnIndex: z.number().min(0).optional(),
 });
+function columnLettersToIndex(letters) {
+    let n = 0;
+    for (const ch of letters.toUpperCase())
+        n = n * 26 + (ch.charCodeAt(0) - 64);
+    return n - 1;
+}
+const A1_CELL_RE = /^([A-Za-z]+)?(\d+)?$/;
+// Either side of ':', and either half of a side, may be omitted: whole column, row or sheet.
+export function parseA1Range(a1) {
+    const bang = a1.lastIndexOf('!');
+    const sheetPart = bang === -1 ? a1 : a1.slice(0, bang);
+    const rangePart = bang === -1 ? '' : a1.slice(bang + 1);
+    const sheetName = sheetPart.startsWith("'") && sheetPart.endsWith("'")
+        ? sheetPart.slice(1, -1).replace(/''/g, "'")
+        : sheetPart;
+    if (rangePart === '')
+        return { sheetName };
+    const [startRaw, endRaw] = rangePart.split(':');
+    const m1 = startRaw.match(A1_CELL_RE);
+    if (!m1 || (!m1[1] && !m1[2]))
+        throw new Error(`invalid A1 range "${a1}"`);
+    const [, col1, row1] = m1;
+    const out = { sheetName };
+    if (endRaw === undefined) {
+        if (col1) {
+            const c = columnLettersToIndex(col1);
+            out.startColumnIndex = c;
+            out.endColumnIndex = c + 1;
+        }
+        if (row1) {
+            const r = Number(row1) - 1;
+            out.startRowIndex = r;
+            out.endRowIndex = r + 1;
+        }
+        return out;
+    }
+    const m2 = endRaw.match(A1_CELL_RE);
+    if (!m2 || (!m2[1] && !m2[2]))
+        throw new Error(`invalid A1 range "${a1}"`);
+    const [, col2, row2] = m2;
+    if (col1)
+        out.startColumnIndex = columnLettersToIndex(col1);
+    if (col2)
+        out.endColumnIndex = columnLettersToIndex(col2) + 1;
+    if (row1)
+        out.startRowIndex = Number(row1) - 1;
+    if (row2)
+        out.endRowIndex = Number(row2);
+    return out;
+}
+async function resolveA1GridRange(sheets, spreadsheetId, a1) {
+    let parsed;
+    try {
+        parsed = parseA1Range(a1);
+    }
+    catch {
+        return {
+            error: `Could not parse A1 range "${a1}".`,
+            hint: 'Use a form like "Sheet1!A1:D10", "Sheet1!A:D", or "Sheet1" for the whole sheet.',
+        };
+    }
+    const meta = await sheets.spreadsheets.get({ spreadsheetId, fields: 'sheets.properties(sheetId,title)' });
+    const match = meta.data.sheets?.find((s) => s.properties?.title === parsed.sheetName);
+    if (!match || match.properties?.sheetId == null) {
+        return {
+            error: `No sheet/tab named "${parsed.sheetName}" in this spreadsheet.`,
+            hint: 'Check the tab name, or use sheets_get to list sheet titles and IDs.',
+        };
+    }
+    return {
+        sheetId: match.properties.sheetId,
+        startRowIndex: parsed.startRowIndex,
+        endRowIndex: parsed.endRowIndex,
+        startColumnIndex: parsed.startColumnIndex,
+        endColumnIndex: parsed.endColumnIndex,
+    };
+}
 const borderSchema = z.object({
     style: z.enum(['DOTTED', 'DASHED', 'SOLID', 'SOLID_MEDIUM', 'SOLID_THICK', 'NONE', 'DOUBLE']),
     color: rgbColorSchema.optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.74",
+  "version": "6.0.0-alpha.76",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",