Use Google Workspace with Evergreen

The Google Workspace integration lets the agent work with your Google account the way you would. It sees and changes what you can, and nothing more. One sign-in covers Drive, Docs, Sheets, Slides, Gmail, and Calendar.

What the agent can do

• Search Drive and read Docs, Sheets, Slides, and other files you can see.
• Create and edit Docs, Sheets, and Slides, and copy or create files when you ask.
• Search and read your Gmail, label threads, and leave drafts. It doesn’t send email.
• Read your calendars, and create, update, or respond to events when you ask.
• Use Google’s gws command-line tool, signed in as you, along with Google’s own Workspace skills. The tool is on the agent’s path in each of your runs.

The agent is told to leave drafts in your Drafts folder for you to send. It’s also told not to change a file’s sharing or permissions, not to delete anything, and not to copy the contents of a document, sheet, or mailbox into a commit, pull request, or message. It links to the file or thread it relied on instead.

Who can connect it

An Owner or Admin installs it for the workspace. Then each person connects their own Google account.

Install it

Google requires a security review before an app outside your organization can use Drive and Gmail. Until Evergreen’s own Google app has passed that review, you connect through an OAuth app that’s Internal to your Google Workspace. An Internal app needs no review, shows no unverified-app warning, and has no user limit.

You need:

• A Google Workspace organization. A personal Gmail account can’t create an Internal app.
• Someone who can create a Google Cloud project in your organization.
• About 5 minutes once you’re enrolled in the preview.

The app checklist

Each item in the checklist has Open, which takes you to the right page in Google’s console, and Mark done, which ticks it off. The ticks are for you alone, and Evergreen doesn’t check them.

1. Join the Google Workspace Developer Preview Program. Google reviews each enrollment, so start this first.
2. Create a Google Cloud project. Name it Evergreen, and for Location pick your organization.
3. Turn on the Workspace APIs. The link turns on the Workspace APIs Evergreen uses and their MCP servers. Pick the Evergreen project, then choose Enable. You can also copy the API names and run gcloud services enable in Cloud Shell.
4. Set up the consent screen as Internal. Under Branding, name the app Evergreen and give your support email. Under Audience, choose Internal. If Internal isn’t offered, your account isn’t in a Google Workspace organization.
5. Add the scopes. Under Data access, choose Add or remove scopes, paste the scopes the step shows into Manually add scopes, then choose Update and Save.
6. Create the OAuth client. Create a Web application named Evergreen, with the redirect URI the step shows as its Authorized redirect URI. After you choose Create, keep Google’s dialog open for the next item.
7. Paste the Client ID and Client secret. Copy them from the dialog Google shows, or from Clients › Evergreen, into the fields in Evergreen.

What it asks before changing things

While the agent plans, it reads. Creating or editing files, writing to a sheet, and creating or changing calendar events become available once you approve the plan, or from the start if you skip the plan. The agent is told to write only when the task asks. See Plans and asks for how approval works.

Email is drafts only. The agent can leave a draft for you, and you send it yourself. An Owner or Admin can block individual tools for everyone on the Tools tab in Manage.

Limits

• The agent sees and changes what your own Google account can, because the connection is yours.
• Google’s Workspace MCP servers are a preview, so what they offer can change on Google’s side.
• Your Evergreen workspace’s own Google app belongs to your organization. While anyone is connected, Manage refuses to change or clear its client ID and secret, and it tells you how many people have to disconnect first. A connection works only with the app that granted it.
• A connection can lapse if you revoke it in Google, if it goes unused for six months, or if you change your Google password, since the connection includes Gmail. Choose Reconnect to sign in again.

Troubleshooting