GAM

You can manage Google Workspace users, groups, and organizational structure through an MCP server powered by the GAM CLI. This server exposes GAM capabilities to MCP clients like Claude Desktop, enabling programmatic administration and automation while keeping your tooling aligned with MCP protocols.

How to use

You interact with this server from an MCP client to perform common Google Workspace administration tasks. The server exposes a set of GAM-based actions you can invoke through standard MCP tool calls. Use it to list users and groups, retrieve details, create or update entities, and move users between organizational units. Each tool corresponds to a GAM command, and inputs are validated to prevent unsafe operations.

How to install

Prerequisites you need before running the server include the GAM CLI and Node.js. Ensure GAM is installed and authenticated, then install the MCP server runtime and build the project.

#!/bin/sh
# Prerequisites check (example commands you will run)
gam version
gam oauth create

# Install dependencies and build the MCP server
# Clone or copy this repo

npm install
npm run build

# Run the server (standalone)
GAM_PATH=/path/to/gam node dist/index.js

# Or rely on GAM in your system PATH
node dist/index.js

Claude Desktop configuration

To connect Claude Desktop to the GAM MCP server, include a config entry under mcpServers that points to the local/server process you run.

{
  "mcpServers": {
    "gam-workspace": {
      "command": "node",
      "args": ["/absolute/path/to/gam-mcp-server/dist/index.js"],
      "env": {
        "GAM_PATH": "/path/to/gam"
      }
    }
  }
}

Additional configuration notes

The server is designed to be run as a local process that the MCP client can spawn and communicate with. You can customize the GAM path via the GAM_PATH environment variable. When you start the server, it will listen for MCP tool calls and translate them into GAM commands under the hood.

Troubleshooting

If GAM cannot be found, ensure GAM_PATH is set correctly or that gam is available in your system PATH. For authentication issues, re-run the authorization flow with gam oauth create. If you hit quota or rate limit messages from Google Admin APIs, wait and retry according to Google API quotas. All inputs to the MCP server are validated; review error messages for details about invalid parameters.

Security considerations

Access to GAM commands is restricted to whitelisted operations. All inputs are validated and sanitized to avoid arbitrary command execution. Sensitive data in logs is redacted, and the server includes rate limiting and robust error handling to protect against abuse.

Extending

To add new capabilities, implement additional GAM-based actions in your local environment and expose them through the MCP interface. You can extend the server by introducing new tools that map to GAM commands and updating the tool registry accordingly.

Available tools

gam_list_users

List users in the domain with optional filters like domain, query, and maxResults.

gam_get_user

Retrieve detailed information for a specific user by email.

gam_create_user

Create a new user with email, firstName, lastName, password, and organizational unit.

gam_update_user

Update user attributes such as name, password, or orgUnit.

gam_suspend_user

Suspend a user account.

gam_unsuspend_user

Unsuspend a user account.

gam_move_user_orgunit

Move a user to a different organizational unit.

gam_list_groups

List groups in the domain with optional maxResults.

gam_get_group

Get details for a specific group by groupEmail.

gam_create_group

Create a new group with groupEmail, groupName, and description.

gam_add_group_member

Add a member to a group (groupEmail, memberEmail, role).

gam_remove_group_member

Remove a member from a group (groupEmail, memberEmail).

gam_list_orgunits

List organizational units in the domain.

gam_move_user_orgunit

Move a user between organizational units.

gam_get_domain_info

Get information about the Google Workspace domain.