[BUG] Gmail connector OAuth missing write/modify scopes for label operations

[lewistaylor]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

The Gmail connector's OAuth flow should request the gmail.modify scope (or equivalent) so that all exposed tools — including label_thread and label_message — work correctly. If a tool requires a scope that isn't currently granted, either the scope should be added to the OAuth request, or the tool should not be exposed in the UI.

What Should Happen?

The Gmail connector's OAuth flow should request the gmail.modify scope (or equivalent) so that all exposed tools — including label_thread and label_message — work correctly. If a tool requires a scope that isn't currently granted, either the scope should be added to the OAuth request, or the tool should not be exposed in the UI.

Error Messages/Logs

This connector requires additional permissions. The user needs to reconnect it with the appropriate access.

Steps to Reproduce

1. Open Cowork mode in Claude Desktop
2. 2. Connect the Gmail connector
3. 3. Search for email threads using search_threads — this works fine (read access is granted)
4. 4. Attempt to apply a label to a thread using label_thread
5. 5. Observe error: "This connector requires additional permissions. The user needs to reconnect it with the appropriate access."
6. 6. Disconnect, delete, and reconnect the Gmail connector
7. 7. Check Google's third-party access permissions screen — only "See your profile info", "Manage drafts and send emails", and "View your email messages and settings" are listed. No modify/write scope for labels.
8. 8. Retry label_thread — same error persists

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

Cowork mode (Claude Desktop) — April 2026

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

This bug was encountered in Cowork mode (not Claude Code CLI). The label_thread and label_message tools appear to have been recently added to the Gmail connector, but the OAuth app registration was not updated to include the gmail.modify scope. Screenshot of Google's third-party permissions screen confirms only read + drafts/send scopes are granted. The Terminal/Shell field above is not applicable — this is a Cowork desktop issue.

[artifactperception]

+1 on this. I built a full email-triage workflow in Cowork around the Gmail connector — pulling threads, drafting replies, filing to Notion, archiving. Dropped it into daily use. Then label_thread / unlabel_thread disappeared from the tool surface and the whole second half of the workflow (archive, star, label) went dead.
Reconnecting doesn't fix it. The tools aren't even registered in my session now.

[perlierely]

+1 Bug encountered in the Claude Code scheduled agent (remote trigger) + interactive sessions

Tools missing from registered MCP tools: label_thread, unlabel_thread — not present in the deferred tools list at all, unlike create_label, list_labels, search_threads which are available.

Error when attempting label operations via cloud trigger: 403 Permission Denied

Attempted fixes (all ineffective):

Reconnected Gmail integration via claude.ai > Settings > Integrations — repeated 8+ times across multiple sessions

• Deleted and recreated scheduled remote trigger
• Switched from cloud trigger to local scheduled task — same result; the tools simply aren't registered regardless of execution context

Analysis: Reconnecting never helped because it re-grants the same OAuth scope each time. The issue isn't the connection — it's that gmail.modify is absent from the OAuth app registration, so label_thread/unlabel_thread can't be requested or executed regardless of how many times the user reconnects. The tools appear to be implemented server-side but are effectively dead without the scope.

[tanishg98]

+1, reproduced today in Claude Code (Opus 4.7). What's the solution here?

Adding a scope breakdown in case it's useful for triage:

Working (read + compose scopes):

• list_labels — ✅
• search_threads — ✅
• create_draft — ✅

Failing with Request had insufficient authentication scopes (needs gmail.modify / gmail.labels):

• create_label — ❌
• label_thread — ❌
• unlabel_thread — ❌

A couple of notes that refine the previous comment:

• In my interactive Claude Code session label_thread and unlabel_thread are registered and callable — they just fail
  at runtime with the 403 scope error. So the tools are wired up; it's purely the OAuth scope set that's missing
  gmail.modify.
• Full revoke at myaccount.google.com/permissions + uninstall + reinstall does not re-prompt for new scopes,
  confirming the connector's OAuth client registration itself doesn't request them.
• Claude.ai Settings → Connectors → Gmail shows "Write/delete tools" as "Always allow", so the Claude-side permission
  gate is fine.