Google Workspace Admin Security-Audit MCP

MCP server for Google Workspace security auditing — login audit, external sharing, daily brief

Connector by shigechika · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/shigechika-gwsadm-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

MCP server for Google Workspace security auditing — login audit, external sharing, daily brief

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools: 9 read · 5 write · 1 delete · 8 not yet classified
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Tools by what they do 23

Read from the source code; the running server may list different tools.

Read 9 · Look things up without changing anything.

daily_brief_result
dmarc_rua_summary
get_user
group_delivery_policy
health_check
list_group_members
suspended_accounts
user_oauth_tokens
workspace_status

Write 5 · Create, change, send or run things.

daily_brief_start
drive_external_sharing
gmail_message_trace
login_audit
sign_out_user

Delete 1 · Delete, drop, revoke or wipe things.

shared_drive_membership_changes

Not yet classified 8 · We could not tell from the name and description.

admin_actions
compromise_sweep
daily_brief
drive_doc_activity
gmail_usage_report
ip_activity
timeout_probe
user_activity

Network hosts it talks to 6

github.com · found in code
google.com · found in code
googleapis.com · found in code
json.schemastore.org · found in code
raw.githubusercontent.com · found in code
shigechika.github.io · found in code

Files it touches

Your home directory (~)
~/.config/gwsadm-mcp/config.ini

Tools (23)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

admin_actions
What administrators did in the Admin console: to one account or group, or tenant-wide. Answers "did someone (IT staff, a sync job) suspend this account, reset its password, move it to another org unit, or take it out of a group?" from the Admin console audit log (Reports API ``applicationName=admin``). Each row names the ``actor`` (the administrator's address, or a profile id for a service account or sync client), ``actor_ip``, the ``event_type`` (``USER_SETTINGS``, ``GROUP_SETTINGS``, ...), the ``event`` (``SUSPEND_USER``, ``UNSUSPEND_USER``, ``CHANGE_PASSWORD``, ``CHANGE_USER_ORGANIZATION``…
compromise_sweep
The Google-side follow-through after ONE account is confirmed compromised, in one call. Four questions, each answered from its own source and reported in its own section so that a failure in one never hides the others: - ``activity``: what the account did (``user_activity`` for the window, flags first -- a ``2sv_enroll`` from the attacker is the item that survives a password reset). A Reports failure stays in this section as ``error``; the others are still attempted with their own grants. - ``state`` / ``grants``: what the account is now (``get_user``: suspended, 2SV enrolled, last l…
daily_brief
One-call security summary across all configured domains. Aggregates login_audit (account locks, suspicious logins), account-protection changes (``account_changes``: 2-Step Verification enrolled/disabled, passkeys added/removed, Advanced Protection turned off, password and recovery address/phone edits, mail forwarding out of the domain; each row says whether it came from outside the ``GWSADM_SITES_INI`` table and from which country (``GWSADM_IP2ASN``), and is ``flagged`` with ``flag_reasons`` -- ``foreign`` (outside ``GWSADM_HOME_COUNTRIES``), ``unknown_origin``, ``after_suspicious_login`` -- …
daily_brief_result
Fetch a ``daily_brief_start`` job by id. ``status`` is ``running`` (keep polling), ``done`` (``result`` holds the full daily_brief payload), ``error`` (``error`` holds the exception type name — the message is omitted to avoid leaking internal detail), or ``unknown`` (bad/expired id).
daily_brief_start
Start a daily_brief in the background; returns immediately with a ``job_id``. Use this instead of ``daily_brief`` when the synchronous call risks the client's ~60s tool-call timeout (large tenants). Args mirror ``daily_brief``. You MUST then poll ``daily_brief_result(job_id)`` every few seconds until ``status`` is ``done`` (the full daily_brief payload is under ``result``) or ``error``. On a config error returns ``{"error": ...}``; if too many jobs are already active returns ``{"status": "rejected", ...}``.
dmarc_rua_summary
Summarize DMARC aggregate (RUA) reports: pass/fail per domain, top reject-candidate IPs. Impersonates the domain's configured ``dmarc_rua_mailbox`` (a real user -- domain-wide delegation cannot act as a group or alias; config default ``postmaster@<domain>``), searches it for mail addressed to ``dmarc_rua_recipient`` (the ``rua=mailto:`` address published in DNS, e.g. the ``postmaster+rua@`` plus-subaddress; default: same as the mailbox), reads the aggregate reports those messages carry, and answers "how much of this domain's mail volume is passing DMARC, and if we moved the policy to ``p=reje…
drive_doc_activity
Full audit history of one Drive document: owner, ACL changes, lifecycle. The triage companion to ``drive_external_sharing``: a sharing finding names a ``doc_id``, and judging it requires who OWNS the document (an individual user vs. a shared drive completely changes the risk read) and its grant history over time. Uses a server-side ``doc_id`` filter, so the page budget is spent on this one document only. ``owner`` / ``doc_title`` are taken from the document's own events (a shared-drive-owned file reports the drive's name — not a user address — as owner). ``events`` lists ACL and lifecycle ev…
drive_external_sharing
Report Drive ACL grants to external targets and new link/public exposure. Counts grants whose target (``target_user`` address, or ``target_domain`` for domain-scoped grants) is outside the configured internal domains (revocations are reported separately, not as exposure) and visibility transitions into link/public access (``people_with_link`` / ``public_on_the_web``, excluding a narrowing from public down to link-only; Google's ``shared_externally`` is owner-domain relative, so external-ness is judged by the target instead). ``untargeted_external_transitions`` counts transitions into ``shared…
get_user
Look up ONE named account's current state — the "why can't this person sign in" tool. Answers a helpdesk ticket that already names the exact address: is the account suspended (and for what reason, since when), archived, enrolled in or enforced into 2-step verification, when did it last log in, which org unit is it in, is a password change pending. One Directory API request, no pagination. Use this — not ``suspended_accounts`` — whenever the address is known. That tool lists only accounts that ARE suspended, so it can never confirm that a given address is *not* suspended, and once that list e…
gmail_message_trace
Check whether a message (by RFC 822 Message-ID) reached specific users' mailboxes. Answers "who got this email and who didn't" for a KNOWN Message-ID and a KNOWN candidate recipient list — there is no Workspace API to search across every user for one message, so the caller supplies who to check (a mailing-list roster, or simply the people who reported a problem). For each recipient this impersonates that exact user via domain-wide delegation and searches their own mailbox (including Spam and Trash) for the Message-ID. Requires the ``gmail.readonly`` DWD scope — granted PER SERVICE ACCOUNT CL…
gmail_usage_report
Daily Gmail send/receive counts per domain (Admin SDK customerUsageReports). Answers "how much Gmail traffic did this domain send/receive on day X" -- a customer-level daily counter, NOT a per-user or per-message breakdown (the Reports API has no such thing; ``login_audit``'s activity stream is the per-event alternative for that, at the cost of no volume total). Each day's fetch is independent: a domain missing the DWD scope reports one whole-domain ``error`` (there is no point retrying `days` times for an identical scope failure), but a single date's fetch failing for some other reason (Goo…
group_delivery_policy
Check a Google Group's own posting/delivery policy — why an external sender's mail never arrived. A Group's access-control layer sits IN FRONT of Gmail delivery: when ``who_can_post`` is restricted (e.g. domain-members-only), an external sender's message is rejected there and never generates a per-recipient Gmail delivery event at all — ``gmail_message_trace`` (a real mailbox) and any Reports-API-based delivery trace both see nothing for that address, indistinguishable from a genuine delivery failure without this. Use this FIRST when a group address "isn't receiving" mail from an external sen…
health_check
Report service status, version, and per-domain auth/API reachability. Always returns the same keys: status (healthy / degraded / error), service, version, config, and domains (per-domain auth result plus ``gmail``: ok / api_disabled / no_grant / error, with ``gmail_detail`` on an unexpected error -- whether the per-user Gmail tools can work there; it does not affect ``status``), ``sites`` (the optional ``GWSADM_SITES_INI`` table: configured / ranges / error) and ``geo`` (the optional ``GWSADM_IP2ASN`` dataset: configured / home_countries / age_days / error / warning); both are informational a…
ip_activity
Every account ONE source address acted as, across applications and domains. The follow-through after ``user_activity`` names an attacker's address: did the same source get into other accounts? The Reports API filters on ``actorIpAddress`` server-side, so this is one probe per (domain × application) over the matching events only, not a scan of the whole tenant's log — and every domain's probes run in one pool, so a slow domain does not delay another's answer. Per domain it returns the acting ``accounts`` (count, first/last seen, which applications) ordered by most recent, the posture ``flags``…
list_group_members
List a Google Group's basic metadata and member roster (Directory API). Resolves a group's actual membership directly, independent of any specific message ever having been sent to it — unlike inferring membership from Reports API delivery-event fanout (``applicationName=gmail``), which only shows members who received one PARTICULAR message and requires one to already exist to trace. Pair with ``gmail_message_trace`` to deep-dive a specific member's mailbox once the roster is known, or with ``group_delivery_policy`` to see why the group as a whole may not be receiving mail at all. Read-only: …

Show 8 more tools

login_audit
Audit the login log: Google-auto-disabled accounts, suspicious logins, failure top-N. Answers "did Google itself decide something was wrong with an account here, and with which account?" — the question a "my mail suddenly stopped working" ticket usually turns out to be. ``account_disabled_*`` is Google reporting that it locked an account (leaked password, hijacking, spamming); ``suspicious_login`` and ``gov_attack_warning`` are warnings without a lock. In both sections ``user`` is the account the event is ABOUT, not an actor who did something: Google raised these itself, so the actor is Goog…
shared_drive_membership_changes
Membership add/remove/role-change history across shared drives. Answers "who added this (external) member, and when" — the other half of triaging a shared-drive sharing finding (see ``drive_doc_activity``). Membership changes are low-volume, so a plain window scan of the single ``shared_drive_membership_change`` event works even over months. Each entry's ``drive`` is the shared drive's NAME as the audit log reports it (the event's ``owner`` parameter — not an id, not a user address); ``target_is_external`` classifies the affected member against the configured internal domains. The Reports AP…
sign_out_user
Sign ONE account out of every Google web and device session (STATE-CHANGING). The response to a confirmed account takeover: ends the attacker's existing Google sessions and resets the account's sign-in cookies (Directory API ``users().signOut``), so a session opened before the password reset or suspension cannot keep going. The owner must sign in again too. Not a full remediation — ``not_covered`` lists what stays in place (OAuth grants, app passwords, an enrolled second factor, the password). Run ``compromise_sweep`` before and after to see what is left. Exists only when the server was sta…
suspended_accounts
Snapshot of currently suspended Google Workspace accounts, per domain. A suspended-but-still-provisioned account is a common attack surface: an account disabled in Google may remain enabled in a downstream IdP (e.g. KeyCloak), where a password-spray attacker can still authenticate through it. Cross-reference this list against the IdP to find and disable such gaps. Unlike ``login_audit`` (which reports the *event* of Google disabling an account within a time window), this is current *state* — every account suspended right now, regardless of when. Read-only (Directory API ``users().list`` with…
timeout_probe
Diagnostic: sleep ``seconds`` in ~5s steps, optionally emitting progress notifications. Gated behind GWSADM_ENABLE_TIMEOUT_PROBE (registered only when set). Tests whether emitting ``notifications/progress`` keeps a long (>60s) tool call alive through a gateway that would otherwise time out. ``ctx.report_progress`` is a no-op unless the client sent a ``progressToken`` in the request ``_meta``, so ``progress_token_present`` reports whether one arrived end-to-end (if false, progress cannot possibly help regardless of ``emit_progress``). ``seconds`` is clamped to ``0..600``; ``requested_seconds`…
user_activity
Everything ONE account did across Workspace in a window, newest first. The first question after an upstream identity provider reports an account as compromised: did the attacker get into Google, and what did they do there? ``login_audit`` cannot answer it — it is a domain-wide view of the events Google itself raised, so it shows neither one named account's logins nor the logins Google did not flag. This tool asks the Reports API for that one account (``userKey=<username>``, server-side) across several applications at once and merges the answers. Read ``flags`` first. It holds the events that…
user_oauth_tokens
List third-party OAuth apps one user has granted account access to. Account-compromise triage tool for the case ``login_audit`` and ``suspended_accounts`` are both blind to: a malicious app used a previously-granted OAuth token to read/delete mail or Drive files without ever generating a fresh login event. Check each entry's ``scopes`` for Gmail/Drive access on an unrecognized ``client_id``/``display_text`` — Google's own apps (e.g. iOS/Android account sync) show up too and are normal noise. Read-only (Directory API ``tokens().list``; never ``tokens().delete()``). Requires the ``admin.direct…
workspace_status
Is a Google Workspace service down? Open and recent incidents from Google's status dashboard. Reads the public Google Workspace Status Dashboard feed (no credential, no DWD scope): the incidents Google has declared for Gmail, Drive, Meet, Calendar, Chat and the other Workspace products. ``open`` lists the incidents not yet resolved; ``recent`` those that ended within the last ``hours``. Each row: ``service``, ``affected_products``, ``severity``, ``status_impact``, ``begin`` / ``end`` (UTC), ``summary`` (the latest update's summary line), ``last_update`` and the incident's ``url``. The dashboa…

Signals

Stars: 0
Forks: 0
Open issues: 10
Weekly downloads: 673
Last commit: Oct 24, 2026 (4 days ago)
Last release: Oct 26, 2026 (2 days ago)
Last package publish: Oct 24, 2026 (4 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.shigechika/gwsadm-mcp
Version: 0.23.1
Auth: No auth
Packages: pypi gwsadm-mcp
License: MIT
Repository: github.com/shigechika/gwsadm-mcp
First seen: Oct 24, 2026
Last checked: Oct 26, 2026
Source: Official MCP Registry github-graphql

More from shigechika

Cite this page

Google Workspace Admin Security-Audit MCP. Agent Mart. https://agentmart.dev/connectors/shigechika-gwsadm-mcp (last updated 2026-10-26)