v3.2.1

Changed

• --dump-schemas also prints the server's instructions.
• For contributors: a pull request that changes the tool surface, a description, annotation or the instructions included, needs a commit footer naming each item (CONTRIBUTING.md).
• For contributors: make docs holds the docs to their references: decision IDs, heading links, named paths and live steps. make check runs it.
• For contributors: a decision in docs/architecture.md is D-NN. Cite it by ID, never by section number, and take a new ID from Next ID:.
• For contributors: record a verified Google behavior in the comment at the code that depends on it, with its source link and live step.
• For contributors: every live driver step has a name, printed above its call; a comment cites a step by that name.
• For contributors: depguard refuses an import of google.golang.org/api; extend the wire types in internal/gdrive instead.

Fixed

• search_files said several words in name must be adjacent and in order; Drive matches each word's beginning, in any order.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v3.2.0

Changed

• The nine tools that change or remove something now say destructiveHint: true, as the MCP spec reads false as "only additive updates": update_file, move_file, trash_file, restore_file, share_file, unshare_file, manage_drive, manage_approval and resolve_access_request. claude.ai, ChatGPT and Codex may now ask before these; if you run them unattended there, allow them again. They still need no GDRIVE_ENABLE_DESTRUCTIVE and no confirm.

Fixed

• Google writes a time it does not have as 1970-01-01. A file's, a comment's, a revision's or a grant's time is now left out in that case rather than shown as 1970.
• The README and the configuration guide said every app must list its scopes on the consent screen. Google asks for that list only from External apps, so an Internal app can skip the step, and the labels and activity tools' refusal says so.
• The configuration scan reads a whole variable name joined before another operand, such as EnvPrefix + "NAME" + suffix, which it used to skip, so a misspelling built that way is caught. Nothing a person running the server sees changes.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v3.1.2

Fixed

• GDRIVE_CONFIG_DIR and GDRIVE_REFRESH_TOKEN drop the spaces around their value, as every other setting does, so a refresh token with a stray space is no longer sent to Google with it.
• logout no longer warns that GDRIVE_REFRESH_TOKEN is set when it holds spaces alone, which the server reads as unset.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v3.1.1

Changed

• The bundle's OAuth client file is optional, so a person who signed in with google-drive-mcp login does not pick it again; left empty, the server uses the client that login recorded for the profile.
• The bundle's profile field, and the refusal of a name the server does not accept, say what a profile name is: up to 64 characters from a to z, 0 to 9, - and _, starting with a letter or digit.

Fixed

• A profile name with a character that Unicode lowers into a to z, such as the Kelvin sign (U+212A), is refused rather than read as another profile's name.
• A variable set to spaces alone is unset, as an empty one is, the profile directory and the refresh token included; a bundle field cleared to a space no longer stops the server.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v3.1.0

Added

• The Claude Desktop bundle asks for the profile, read-only, enable_destructive, the sharing tools, the download and upload folder, the largest download, labels and activity, each off or empty unless you set it, names Google's privacy policy, and needs Claude Desktop 0.10.0 or later.

Changed

• The bundle stages its binaries as server/google-drive-mcp-darwin, server/google-drive-mcp.exe, server/google-drive-mcp-linux-amd64 and server/google-drive-mcp-linux-arm64, and its Linux launcher as server/launch-linux.sh.

Fixed

• The bundle's description said download_file and upload_file are not registered without a download folder. Both are registered and refuse every call until you set one.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v3.0.0

Added

• share_by_link, share_outside_organization, transfer_ownership and lift_drive_restriction, registered only with GDRIVE_ENABLE_DESTRUCTIVE=true (and GDRIVE_SHARING=all), each needing confirm: true: a link for anyone or a whole domain, a person or group outside the organization, a new owner, and turning a shared drive's domain_users_only off. Each also needs the item's name, file_name or drive_name, so the call you approve names what it opens up; a name that is not the one Drive has is refused with the new error class [stale], dry run included.
• approve_file, which approves a review you were asked for, marked destructive: Drive cannot withdraw an approval, and it can lock the file for good.
• The README gives Claude Code permissions.ask rules for the writes that share, publish, sign off or delete, and says what each client prompts for. The staleness gate holds every tool named there to the registered tools.

Changed

• Breaking: the Go module path is now github.com/mmedum/google-drive-mcp/v3, as Go requires from v3; install with go install github.com/mmedum/google-drive-mcp/v3/cmd/google-drive-mcp@latest.
• Breaking: the server no longer asks the person before a write; your MCP client approves each call. GDRIVE_REQUIRE_PROMPT and --require-prompt are removed, and the server refuses to start while GDRIVE_REQUIRE_PROMPT is set to anything but false: unset it, keep GDRIVE_ENABLE_DESTRUCTIVE off for a client that runs unattended, and list the writes to approve under your client's ask rules.
• Breaking: share_file grants only named people and groups inside your organization, and takes no allow_anyone, allow_domain, transfer_ownership or discoverable. A link for anyone or a domain, someone outside the organization and a new owner are refused [blocked], naming share_by_link, share_outside_organization or transfer_ownership. On a personal Google account every address counts as outside, so share_file shares with nobody there.
• Breaking: move_file, copy_file, and update_file with limited_access: false refuse [blocked], dry run included, when they would let anyone with the link, a domain or someone outside the organization reach a file, naming who, or when who they would reach cannot be read. Reaching more people inside the organization is an ordinary write.
• Breaking: resolve_access_request refuses [blocked] to accept a request from someone outside your organization; deny it, or grant it with share_outside_organization or in Drive.
• Breaking: manage_drive refuses [blocked] to turn domain_users_only off; lift_drive_restriction does it.
• Breaking: manage_approval no longer approves; approve_file does.
• Breaking: Claude Code's requiresUserInteraction is now on delete_file, empty_trash, delete_drive and share_by_link for every client, so Claude Code prompts on every such call and refuses it where it cannot prompt; it came off delete_revision and delete_comment.
• share_file's description and a group grant's result say who a group reaches: everyone in it, including people added later, and a member outside your organization too if its sharing policy lets them in. This server cannot see who is in a group.
• reply_comment and manage_labels are marked destructive, since an edit replaces a comment's text and a set replaces a label field's value, so a client that prompts by destructiveHint prompts for them.
• The schema diff lets through a break that a **Breaking:** entry under [Unreleased] names, with its tool in backticks; recording the baseline still takes a new major version.
• update_content on a Markdown file reads only the revision ids from the version history when it looks for a save its upload replaced. It asked for every field of every revision, which on a file with a long history is most of the response for nothing.

Security

• Built with Go 1.27.3, which fixes GO-2026-6809 in crypto/x509, which govulncheck found reachable: intermediate certificates known to be compromised are no longer trusted.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v2.2.0

Added

• update_content takes allow_comment_changes. Google Docs now opens a Markdown file stored in Drive and edits it in place, and it keeps the comments made on it there in the file's own text: a marker on each side of the passage, and an entry in a gdoc_comments block that ends the file. Replacing such a file with content that drops an entry or a marker, changes an entry's status, or goes on after the block, or sending it as a type that is not Markdown, is refused with [invalid], naming each comment it would lose, unless allow_comment_changes is set. A file stored under the older type text/x-markdown, which the Docs API reads as Markdown too, is checked the same way. The file and the new content are each read as a stream to check them, and the result says the text still holds them. A file that cannot be read, or is too large to check, is refused too, and the refusal names allow_comment_changes.
• update_content on a Markdown file looks at its head revision once more just before uploading and refuses with [exists] if someone saved it meanwhile, and afterwards names any save that landed between that look and the upload, which the upload replaced and Drive keeps for 30 days unless it is pinned. keep_previous_revision pins the revision the upload actually replaced, which is that save when there was one.
• update_content says when an upload changed the file's type, which Drive takes from the type the upload is sent as.
• read_file, get_file and list_comments on a Markdown file say that the comments made on it in Google Docs are in its text, and that list_comments does not show them.

Changed

• create_file without mime_type takes the type from the name when its extension is one this server knows as a kind of text: notes.md is a Markdown file and rows.csv is csv, the same on every machine. With convert_to, the name's type is used only when Google imports it as the kind asked for, so rows.csv made into a Doc still goes as plain text. Inline text was always plain text, so a notes.md written here was not a Markdown file.

Fixed

• go run ./scripts/gates leaks history had been failing since mid-September 2026, unnoticed, because it is not part of make check. It read Signed-off-by: and Co-authored-by: trailers, which git and GitHub write to credit a commit, as addresses a person typed; it skips them now as it skips the author header, takes GitHub's users.noreply.github.com addresses as safe, and allows the two remaining items by name with a reason each. It is a step in closing a phase, and CONTRIBUTING asks contributors to commit under their no-reply address.
• update_content from local_path without mime_type keeps the file's type, as its description said. It took the type from the local file's name instead, and Drive makes the uploaded type the file's: a Markdown file replaced from a .txt became a plain text file, and Drive ignores setting the type back.
• manage_revision said a pinned version could be unpinned again. Drive unpins only the current revision, so a pin on any other, including the one keep_previous_revision makes, is for good, and only deleting the revision removes it. Both descriptions and results say so now, and an unpin Drive refuses is explained, naming delete_revision, where it read as a bare 400.
• upload_file gives a file the same type on every machine for the extensions of the types this server reads or converts, such as .md, .csv, .docx and .pdf. Go's own type table has no .md, and a machine's tables can override the entries it has, so the type depended on the machine, and one without a mapping for .md sent Markdown as plain text.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v2.1.0

Added

• move_file takes files, up to 50 items, moved to one destination. Each item gets its own outcome in items: moved, unchanged, refused with the reason, or failed with Drive's answer, and a failure does not undo the moves before it. A call that moves none because each failed or was refused reports the action failed. dry_run lists what would happen to each. The person is asked once for the whole call, naming every item that would reach more people.
• search_files takes order_by: shared, which puts the files most recently shared with you first. With no scope it searches only the files shared with you, and the title says so.
• A file card, and a row in a search or a listing, says when a file was shared with you and by whom.
• search_files takes visibility: anyone (anyone on the internet, by link or by search), link (anyone with the link), domain (everyone in the organization) or limited (only the people and groups it is shared with).
• search_files takes shared_with, an address: only the files shared with that person or group, as viewer, commenter or editor.
• search_files takes under_folder: only items in that folder or any folder below it. It walks the folders first, one listing per level, covers at most 100 folders and refuses a larger tree, and does not follow shortcuts. It names the folders it could not list. A page_token from such a search continues only a search under the same folder, over the same folders.
• update_file takes restrict_download: none, viewers (viewers and commenters cannot download, print or copy the file) or editors (editors cannot either). It is Drive's current download restriction, which can stop editors as well. With GDRIVE_SHARING=off, lifting it is refused.
• update_file takes limited_access for a folder: only the people added to it directly can open it, and those who reach it from above see it without opening it. Turning it off is put to the person first when the client can ask, naming who could then open the folder. With GDRIVE_SHARING=off, turning it off is refused.
• manage_approval takes on_content_change with start: reset_approval, the default, clears answers given when the content changes and locks the file once it is approved; no_action does neither. The result says what Drive reports the approval will do, and a listing says it for each approval.
• A file card says who cannot download, print or copy the file, counting the shared drive's restriction and the organization's rules, and when that is more than the file's own setting. It says when a folder has limited access.
• list_permissions marks a grant a limited-access folder keeps out as one that "can see it but not open it", and the sharing summary counts those people apart from the ones who can view.
• extract_text reads the text in a PDF or an image (JPEG, PNG, GIF or BMP) with Google's OCR. Drive reads such text only while converting a file into a Google Doc, so it copies the file as a Doc into the root of My Drive, exports the text and deletes the copy for good, naming its id so get_file can show it is gone; keep_copy keeps it and gives its id and link. It takes ocr_language, and offset and max_chars to page through the text, which is kept for a few minutes, apart from what other reads keep, so paging makes no second copy; the next window's call names ocr_language when it was given. A call canceled while Google makes the copy waits for Google's answer and deletes the copy. A copy Google did not confirm is reported as [ambiguous_outcome] with the search that finds it, and is not retried; a copy that could not be deleted is named in the result. A file this account may not copy, or one over 50 MB, is refused before anything is written, and one over the 2 MB Google asks for is read with a warning. It is not registered in read-only mode, and get_account names its copy as the one thing deleted for good while the destructive tools are off. 40 tools in all, 32 in a default build.
• read_file reads Word, Excel and PowerPoint files, and their OpenDocument counterparts (.docx, .xlsx, .pptx, .odt, .ods, .odp), as text. A document reads in order, with headings, list items and table rows marked. A workbook's first sheet reads as csv, or tsv with format: tsv: numbers as stored, dates and times as ISO 8601, a formula as its last value. A deck reads slide by slide, under a line naming each slide. The file is read here, through byte ranges, so only its text parts are fetched; nothing is converted, copied or written to disk, and it works in read-only mode. The gdrive:// resource returns the same text. The old .doc, .xls and .ppt formats are refused with the ways forward, and so is a file whose content is another kind than its type says. A file over the limits that guard against a file built to exhaust a reader is refused, and text past 10 MB is cut short with a note.

Changed

• read_file refusing a PDF or an image names extract_text as the first way forward. In read-only mode it no longer suggests copy_file, which that mode does not register.
• update_file's copy_requires_writer_permission is described as Drive's legacy switch. Since July 2025 Drive turns it off for editors too, and the result now says so. It is refused together with restrict_download, since Google warns the two can conflict.
• Breaking: a move_file into a folder or shared drive that more people can reach, or that gives them more access, is put to the person first when the client can ask, naming who it adds. A client that declares elicitation but has no person to answer, such as claude -p, can no longer make such a move.
• Breaking: with GDRIVE_SHARING=off, move_file refuses a move that would let more people reach an item, or give them more access. That setting promises nothing here widens access, and such a move does. With files, each such item is refused with the reason and the rest move. A move whose reach cannot be read is refused too. Under that setting list_permissions and get_account now say nothing here can widen who can see a file, where they said nothing here could change it, since a move can still narrow it.
• search_files with no filter at all returns everything you can see, in the order order_by names. It used to be refused.
• Breaking: copy_file follows the move's rule. A copy takes on who can reach the folder it lands in and none of the original's sharing, so a copy that more people could reach than the original, or with more access, is put to the person first when the client can ask, and with GDRIVE_SHARING=off it is refused. A folder's copy is checked for the folder and for each folder inside it with limited access. A client that declares elicitation but has no person to answer can no longer make such a copy, and a deployment with GDRIVE_SHARING=off that copies into shared folders has to copy elsewhere. The result says who can reach the original and who can reach the copy. A copy only this account can reach asks nothing. create_file and upload_file are unchanged.
• A delete asks once in Claude Code, not twice. In a client that can ask the person, delete_file, empty_trash, delete_drive, delete_revision and delete_comment no longer carry the requiresUserInteraction mark; the server's own question, which shows what the delete destroys, is the confirmation. To see only that question, add the five tools to Claude Code's allow list. A Claude Code Elicitation hook that accepts now confirms these deletes alone, where the mark used to stop the call before it reached the server.
• search_files' page_token continues only the search it came from: the same filters, order, scope and drive, and with under_folder the same folder over the same folders. A continuation with any of them different is refused, and so is a token this server did not give out. It used to pass Drive's token on beside whatever filters the call carried. A token from before this release is refused: search again.
• The schema diff compares the tool surface with the newest release's, recorded in testdata/schema-baseline.json, and checks input and output fields at any depth with their types, in the direction a caller would notice: an input that takes fewer types or loses a listed value fails, as does an output that may return another type or may now be missing, while an input that may now be null passes. It used to rebuild the last tag and compare top-level inputs only, so a dropped output field passed. A release commit records the baseline with make schema-baseline VERSION=vX.Y.Z, which refuses a break unless the release is a new major version.

Fixed

• search_files with scope: my_drive and drive, or with under_folder in a shared drive, searched the shared drive and called it My Drive. It is refused now.
• search_files with in_folder sends the folder's resource key, so a folder shared by a link from before 2021 is searched rather than found empty.
• read_file's line saying how to read the next window names format when it was given. Without it the next window of a tsv read was cut from the csv text.
• move_file says who could reach the item before the move and who can after, in sharing_before and sharing_after. A moved item takes on the destination's sharing and loses what it had through its old folder, and the result used to report only the new location. dry_run shows the same without moving. After the move the result reads who can reach the item from Drive, and says so when that differs from what was worked out beforehand.
• A sharing summary for a My Drive item that people reach through a folder above it says "through a folder above it". It said "inherited from the shared drive".
• A share_file or unshare_file dry run says what the grant would do. Under "NOTHING WAS CHANGED" it said the link was open, mail was sent or the link was dead.
• list_approvals says "no answer ...

v2.0.1

Fixed

• The transcript redactor's tests and comments use an invented name and address in place of a real person's name and an account address.
• A write that may have reached Google and is not repeated, such as share_file or add_comment after a 5xx or a connection cut, is now reported as [ambiguous_outcome]: Google did not confirm it, so read it back before repeating it. It was reported as [server] or [network], which invited a second copy. The ambiguous message no longer assumes the connection dropped.
• A delete retried after a 5xx that then finds nothing is reported as [ambiguous_outcome] rather than [not_found]: the first attempt may have deleted it.
• A network failure, including a token refresh that fails mid-request, no longer quotes the request URL, so a search's terms or a looked-up file name stay out of the error. A refresh that failed on the network is [network], not a refused login.
• A create carrying its own id that got a 5xx and then finds the id taken is [ambiguous_outcome], not [exists]: the earlier attempt may have made the file.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.

v2.0.0

Added

• The server asks the person, through the MCP client, before the destructive five, before a share to anyone, a domain:, a new owner or a person or group outside the account's organization, before accepting an access request, and before manage_drive turns a restriction off. Anything but Accept is [blocked] and changes nothing. A client without elicitation gets no question.
• GDRIVE_REQUIRE_PROMPT=true refuses those writes when the client cannot ask.
• delete_comment takes dry_run.

Changed

• Breaking: the Go module path is now github.com/mmedum/google-drive-mcp/v2, as Go requires from v2; install with go install github.com/mmedum/google-drive-mcp/v2/cmd/google-drive-mcp@latest.
• Breaking: a domain: grant in share_file needs allow_domain: true, as anyone needs allow_anyone: true.
• Breaking: a client that declares elicitation but has no person to answer, such as claude -p, can no longer make the writes that ask.
• Breaking: with GDRIVE_SHARING=off, manage_drive refuses to turn a shared drive's restriction off, and update_file refuses to let viewers copy a file or editors reshare it.
• Reversible writes (move_file, trash_file, restore_file, update_file, unshare_file, manage_drive) now say destructiveHint: false, and manage_revision says true, since unkeep lets Drive purge a revision; an unset hint reads as destructive.
• update_content says destructiveHint: true, and its description says an unpinned old revision lasts about 30 days, or fewer once a file has 100.
• download_file is no longer marked read-only, since it writes a local file; read-only mode still registers it.

Fixed

• copy_file with dry_run on a single file copied it; it now copies nothing.
• manage_drive restrict failed with Bad Request since 1.1.0: it sent the drive's downloadRestriction back, which Drive refuses. It now sends only the switches that change.
• manage_drive restrict could never turn a restriction off, and said it had: a switch set to false was left out of the patch, and Drive keeps a switch it is not sent. The result now reads what changed from Drive's answer.

---

Built by GoReleaser from the tag. Every archive carries the binary,
LICENSE and README, and ships an SBOM beside it.

Verify a download before you run it:

sha256sum -c checksums.txt --ignore-missing
cosign verify-blob checksums.txt --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github\.com/mmedum/google-drive-mcp/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify google-drive-mcp_*.tar.gz --repo mmedum/google-drive-mcp

.mcpb is the Claude Desktop bundle: open it and Claude Desktop
installs the server and asks for your OAuth client JSON, with no
config file to edit. It covers macOS, Windows and Linux on both
architectures. It does not log you in — install the binary as
well, run google-drive-mcp login once, and the bundle picks up the
same credentials. Its SHA-256 is in the same signed checksums.txt.