MCP server for Google Workspace admins

Run every Google Workspace by chatting with your own AI.

Domains, DNS records, verification, users, licences and activity reports — for the Workspace this key belongs to. No admin console clicking, no copy-paste errors, no 40-minute onboarding checklists.

Request accessSee the flow

Access is by invitation right now.

claude · mcp connected
Live execution
admin sdk

step 0 of 4

  • Domain added to Workspace

    acme-mail.example → your tenant

  • DNS records issued (writing them: in development)

    MX ×5 · SPF · DKIM 2048 · DMARC p=quarantine

  • Ownership verified

    TXT checked against Google · status 200

  • Users created (bulk import: in development)

    licences assigned by name · aliases mapped

8

Scopes, exact

None

Super-admin

—

Workspaces

Works with the tools you already run on

Claude
Claude Code
Any MCP client
Google Workspace Admin SDK
Model Context Protocol
Claude
Claude Code
Any MCP client
Google Workspace Admin SDK
Model Context Protocol
Claude
Claude Code
Any MCP client
Google Workspace Admin SDK
Model Context Protocol

Capabilities

Everything an admin does manually — as a tool call.

One tenant per key

A key is the tenant identity — there is no key that spans two. Scoped service accounts keep every action inside the right customer. Multi-workspace switching: in development.

User lifecycle

Create, update, suspend and alias users from a sentence — groups and licences included. Deletion is not possible: the role cannot. Bulk import from a sheet: in development.

Domain onboarding

Add secondary domains, get the exact TXT, MX, SPF and DMARC records to publish, and verify ownership against Google. Writing them to a registrar: in development.

Deliverability records

The exact SPF, DKIM and DMARC records for a domain, checked against what is actually live in DNS. Aggregate report parsing and drift alerts: in development.

Reports on demand

Login and admin activity from the Reports API, asked for in the same conversation. Anomaly detection and licence-waste analysis: in development.

Guarded by policy

Every call is scoped to one tenant and written to an append-only audit log. Destructive tools are off by default and require an explicit second call to execute.

Isolation

One tenant cannot see another.

Agencies and MSPs juggle dozens of Workspace accounts, each with its own super-admin login. Tenant identity here comes from the API key, never from anything the model can say — so a request cannot reach across, and neither can a bug. Managing several from one account is in development.

  • Per-tenant OAuth scopes and service accounts
  • One API key per tenant — there is no key that spans two
  • Destructive tools return a preview and wait for a second call
  • Full audit trail of every tool call, per workspace
AL

Alpha

own key · own vault

Active
BR

Bravo

own key · own vault

Setup unfinished
CH

Charlie

own key · own vault

Active
DE

Delta

own key · own vault

Active

How it works

Three steps to hands-off admin

01

Connect your AI client

Point Claude, Claude Code or any MCP client at the endpoint. One key or one OAuth connector, no plugins to maintain.

02

Attach your Workspace

Authorise the service account in your own Admin console once. The server holds exactly eight scopes and never a Super Admin.

03

Just describe the work

"Add this domain and create the sales users" — the agent chains the tool calls and reports back, with every call written down.

What a deliverability check reports
MX recordschecked
SPF recordchecked
DKIM selectorchecked
DMARC policychecked
What you get back

The exact records to publish, and which of them are already live in DNS. Aggregate report parsing, blacklist checks and drift alerts are in development — this checks what is configured, not what recipients did with it.

Reports

Ask for the records. Get the answer, not the raw dump.

Working out which DNS records a domain needs, and which are already live, takes a console and a dig command. Ask instead: the agent reads the domain, lists the exact records, and tells you which are missing.

DNS record guidance
Login & admin activity
Domain verification status
Per-tenant audit trail

Stop clicking through admin consoles.

Plug the MCP server into the AI you already use and hand over the repetitive half of Workspace administration today.

Access is by invitation right now. We review every request.

ClaudeClaude CodeAny MCP clientGoogle Workspace Admin SDKModel Context Protocol