# manage_comments

Manages Drive comments on a file (Docs, Sheets, Slides, PDFs, images...). action=list pages through comments with their replies and resolved state (page_token; include_deleted shows tombstones); get fetches one (needs comment_id). create adds a comment (needs content; quoted_text attaches the passage it refers to — display only; positional anchoring inside a Doc's text is not possible through this API, such comments appear file-level). reply answers a thread (needs comment_id + content). resolve / reopen close or reopen a thread (need comment_id; optional content adds a closing note). delete removes a comment and its replies permanently (needs comment_id; author only). Comments carry author, createdTime/modifiedTime, resolved and quotedFileContent. Not for Docs suggestions — those are a Docs feature this API cannot touch.

Agent View of the PolicyLayer registry record for `manage_comments`. HTML page: https://policylayer.com/tools/a1-x-tech-mcp-google-drive/manage-comments

## Facts

- Tool: `manage_comments`
- Server: Mcp Google Drive (`@a1-x-tech/mcp-google-drive`) — https://policylayer.com/tools/a1-x-tech-mcp-google-drive.md
- Install: `npx -y @a1-x-tech/mcp-google-drive`
- Homepage: https://github.com/A1-x-Tech/mcp-google-drive
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 9 (2 required)
- Recommended policy verdict: Hidden

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | string | yes | What to do with the file's comments. |
| `anchor` | string | no | create only: a Drive anchor JSON string for region-anchorable media (rarely needed). |
| `content` | string | no | create/reply: the comment text (plain text). Optional closing note for resolve/reopen. |
| `file_id` | string | yes | The file id — the long id from the Drive URL (drive.google.com/file/d/<fileId> or docs.google.com/.../d/<fileId>/edit) or from search_files/get_file output. Fol |
| `page_size` | integer | no | list: comments per page (1..100; API default 20). |
| `comment_id` | string | no | get/reply/resolve/reopen/delete: the comment id (from action=list). |
| `page_token` | string | no | list: nextPageToken from the previous page. |
| `quoted_text` | string | no | create only: the file passage the comment refers to (shown as a quote; does not position the comment). |
| `include_deleted` | boolean | no | list: include deleted comments as tombstones (default false). |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manage_comments",
    "arguments": {
      "action": "<action>",
      "file_id": "<file_id>"
    }
  }
}
```

## Why manage_comments is rated Critical

An AI agent that decides to call manage_comments doesn't hesitate, doesn't double-check, and doesn't stop at one. Whatever it removes from Mcp Google Drive is gone. There is no undo for destructive operations.

Risk signals: Accepts raw HTML/template content (content)

## Use case

AI agents call manage_comments to permanently remove resources in Mcp Google Drive, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp Google Drive:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "manage_comments"
  ]
}
```

## Other tools on Mcp Google Drive (14)

- `delete_file_forever` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/delete-file-forever.md
- `manage_permissions` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/manage-permissions.md
- `raw_request` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/raw-request.md
- `trash_file` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/trash-file.md
- `download_file` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/download-file.md
- `get_file` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/get-file.md
- `list_shared_drives` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/list-shared-drives.md
- `search_files` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/search-files.md
- `copy_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/copy-file.md
- `create_folder` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/create-folder.md
- `export_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/export-file.md
- `move_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/move-file.md
- `update_file_metadata` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/update-file-metadata.md
- `upload_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/upload-file.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=a1-x-tech-mcp-google-drive · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/a1-x-tech-mcp-google-drive