// SCAN REPORT

Google Workspace Drive (gws CLI)

57 tools. 27 can modify or destroy data without limits.

8 destructive tools with no built-in limits. Policy required.

Last updated:

27 can modify or destroy data
30 read-only
57 tools total
// TOOL MAP
Read (30) Write / Execute (19) Destructive / Financial (8)
// WHAT CAN GO WRONG
✕

Destructive tools (drive_comments_delete, drive_drives_delete, drive_files_delete) permanently delete resources. There is no undo. An agent calling these in a retry loop causes irreversible damage.

✕

Write operations (drive_accessproposals_resolve, drive_channels_stop, drive_comments_create) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

One command. Full control.

Intercept sits between your agent and Google Workspace Drive (gws CLI). Every tool call checked against your policy before it executes — so your agent can do its job without breaking things.

npx -y @policylayer/intercept scan -- npx -y @gws mcp -s drive
Scans every tool. Generates a policy. Starts enforcing.
Works with Claude Code · Cursor · Claude Desktop · Windsurf · any MCP client
// RECOMMENDED RULES
Deny destructive operations
drive_comments_delete:
  rules:
    - action: deny

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
drive_accessproposals_resolve:
  rules:
    - rate_limit: 30/hour

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
drive_about_get:
  rules:
    - rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// ALL 57 GOOGLE WORKSPACE DRIVE (GWS CLI) TOOLS
DESTRUCTIVE 8 tools
Destructive drive_comments_delete Destructive drive_drives_delete Destructive drive_files_delete Destructive drive_files_emptyTrash Destructive drive_permissions_delete Destructive drive_replies_delete Destructive drive_revisions_delete Destructive drive_teamdrives_delete
WRITE 19 tools
Write drive_accessproposals_resolve Write drive_channels_stop Write drive_comments_create Write drive_comments_update Write drive_drives_create Write drive_drives_hide Write drive_drives_unhide Write drive_drives_update Write drive_files_copy Write drive_files_create Write drive_files_modifyLabels Write drive_files_update Write drive_permissions_create Write drive_permissions_update Write drive_replies_create Write drive_replies_update Write drive_revisions_update Write drive_teamdrives_create Write drive_teamdrives_update
READ 30 tools
Read drive_about_get Read drive_accessproposals_get Read drive_accessproposals_list Read drive_approvals_get Read drive_approvals_list Read drive_apps_get Read drive_apps_list Read drive_changes_getStartPageToken Read drive_changes_list Read drive_changes_watch Read drive_comments_get Read drive_comments_list Read drive_drives_get Read drive_drives_list Read drive_files_download Read drive_files_export Read drive_files_generateIds Read drive_files_get Read drive_files_list Read drive_files_listLabels Read drive_files_watch Read drive_operations_get Read drive_permissions_get Read drive_permissions_list Read drive_replies_get Read drive_replies_list Read drive_revisions_get Read drive_revisions_list Read drive_teamdrives_get Read drive_teamdrives_list
// FAQ
Can an AI agent delete data through the Google Workspace Drive (gws CLI) MCP server? +

Yes. The Google Workspace Drive (gws CLI) server exposes 8 destructive tools including drive_comments_delete, drive_drives_delete, drive_files_delete. These permanently remove resources with no undo. Intercept blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Google Workspace Drive (gws CLI)? +

The Google Workspace Drive (gws CLI) server has 19 write tools including drive_accessproposals_resolve, drive_channels_stop, drive_comments_create. Set rate limits in your policy file -- for example, rate_limit: 10/hour prevents an agent from making more than 10 modifications per hour. Intercept enforces this at the transport layer.

How many tools does the Google Workspace Drive (gws CLI) MCP server expose? +

57 tools across 3 categories: Destructive, Read, Write. 30 are read-only. 27 can modify, create, or delete data.

How do I add Intercept to my Google Workspace Drive (gws CLI) setup? +

One line change. Instead of running the Google Workspace Drive (gws CLI) server directly, prefix it with Intercept: intercept -c google-workspace-drive.yaml -- npx -y @@gws mcp -s drive. Download a pre-built policy from policylayer.com/policies/google-workspace-drive and adjust the limits to match your use case.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies available for each. Same risk classification, same one-command setup.

Mcp Api 310 tools
admin
Aibtc 288 tools
admin
Google Super 200 tools
admin
Trello 200 tools
admin
Propresenter 177 tools
admin
Leaper Vision Toolkit 169 tools
admin
Apiosk 160 tools
admin
Mcp Sitecore 153 tools
admin
policylayer/intercept

Control every MCP tool call
your agent makes.

Set budgets, approvals, and hard limits across MCP servers.

npx -y @policylayer/intercept init
Protect your agent in 30 seconds. Scans your MCP config and generates enforcement policies for every server.
// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.