Critical-risk tools in Mcp Google Drive
5 of the 15 tools in Mcp Google Drive are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
delete_file_foreverDestructivePERMANENTLY deletes a file, BYPASSING the trash — there is no undo, no 30-day grace period, and a folder takes every descendant with it. This is NOT the same as trash_file: when...
-
manage_commentsDestructiveManages Drive comments on a file (Docs, Sheets, Slides, PDFs, images...). action=list pages through comments with their replies and resolved state (page_token; include_deleted s...
-
manage_permissionsDestructiveManages who can access a file. action=list shows the grants (id, type, role, emailAddress/domain, expirationTime, pendingOwner). action=share grants access: type=user/group (nee...
-
raw_requestDestructiveEscape hatch to call any Google Drive API v3 path directly, for requests the typed tools don't cover — e.g. revisions ("drive/v3/files/<fileId>/revisions"), changes ("drive/v3/c...
-
trash_fileDestructiveaction=trash moves a file (or folder, with everything inside) to the Drive trash; action=restore brings it back. Trashing is REVERSIBLE — the file stays recoverable until the tr...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.