Google Workspace

Google Workspace

Comstar does not ship a custom Gmail/Calendar/Drive MCP. It pairs OAuth once (device code + QR), stores a per-userid refresh token, runs pinned mcp-server-google-workspace via LocalMcpHost.startNpxPackage, and tunnels it to AO as client.google_workspace.

---

Setup

1. Create a Google Cloud OAuth client (TVs / Limited Input or Desktop). Enable Gmail, Calendar, and Drive APIs.
2. Export GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on the bridge host (see config/comstar.mac.env.example). Never commit them. Desktop OAuth callbacks share bridge port :8781 at /oauth/google/* (same process as the Admin Console; OAuth paths never require the admin LAN token).
3. As a known face, say "connect my Google". Enter the spoken code on your phone or scan the on-screen QR (pairing.qr message to kiosk).
4. Tokens land in ~/.local/share/comstar/google/<userid>.json (0600).
5. Voice agent allowlist: overlays/comstar/agent_providers/voice_responder.yaml → client.google_workspace.
6. Unlink: say "disconnect Google". Soft-fail if tokens are revoked — voice still works.

Guests never get Google MCP ids and cannot start pairing.

---

Pieces in the repo

Piece	Location
MCP definition	overlays/comstar/mcp_providers/google_workspace.yaml
Bootstrap	ComstarMcpBootstrap → extraMcps
Kiosk QR	pairing.qr on Bridge ↔ Kiosk

AO disk config/mcp_providers/ is not used for this path — session-overlay only. No AO code changes.

---

Optional Mac spike

GOOGLE_CLIENT_ID=… GOOGLE_CLIENT_SECRET=… GOOGLE_REFRESH_TOKEN=… \
  npx -y mcp-server-google-workspace@0.2.6

---

Troubleshooting

Symptom	Fix
Google tools missing	Pair as known user; check GOOGLE_CLIENT_*; tokens under data dir
Pairing QR never shows	Redeploy kiosk; confirm bridge logs google_pairing_start

→ Runbook · Contracts — MCP