uploadFile

SERVERGoogle Drive SOURCE@ark7/google-drive-mcp

Medium RISK CLASS

Category Write

Parameters 80 required

Recommended Rate-limitedsee the rule below

Registry record Grade F, identity unverified Pull the record →

This record as markdown: /tools/ark7-google-drive-mcp/uploadfile.md

WHAT IT DOES

What uploadFile does on Google Drive

AI agents use uploadFile to create or update resources in Google Drive, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Google Drive environment.

Parameter	Type	Required	Description
`name`	string	—	File name in Drive (defaults to local filename; required when creating a new file from contentBase64)
`fileId`	string	—	ID of an existing Drive file to update in place: the uploaded content becomes a new version of this file (same ID, revision history preserved). Omit to create a
`account`	string	—	Alias of the Google account to target. Optional — defaults to the session/global default account, or the sole authenticated account. Run manage_accounts list to
`mimeType`	string	—	MIME type (auto-detected from extension if omitted)
`localPath`	string	—	Absolute path to the local file to upload (on the machine running this server). Provide either localPath or contentBase64.
`contentBase64`	string	—	Base64-encoded file content. Alternative to localPath for clients without access to the server's filesystem. Provide either localPath or contentBase64.
`parentFolderId`	string	—	Parent folder ID or path (e.g., '/Work/Projects'). Creates folders if needed. Defaults to root. Not allowed with fileId (use moveItem to move a file).
`convertToGoogleFormat`	boolean	—	Convert uploaded file to Google Workspace format (e.g., .docx to Google Doc, .xlsx to Google Sheet, .pptx to Google Slides). Defaults to false. Not allowed with

Parameters from the server's own tool schema.

RISK

Why uploadFile is rated Medium

This tool modifies cloud storage by creating or updating files, which is characteristic of Write category. It is not Destructive because uploads are reversible (files can be deleted or versions reverted).

From the tool's definition uploadFile creates new files or modifies existing files in-place via version updates. Description states: 'Upload a file...to Google Drive' and 'uploads the content as a new version of that existing file (in-place update)'.

Attacks that exploit this kind of access

RECOMMENDED RULE

The rule that runs uploadFile safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Google Drive, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For uploadFile, this is the rule to start with:

uploadFile Rate-limited

uploadFile stays usable, but capped: an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "uploadFile": {
      "limits": [
        {
          "counter": "uploadfile_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL → Instant setup, no code required.

The button opens the PolicyLayer dashboard: create your workspace, connect Google Drive, apply this rule, and every uploadFile call is checked against it from then on.

FAQ

Questions about uploadFile

What does the uploadFile tool do? +

Upload a file (any type: image, audio, video, PDF, etc.) to Google Drive, either from a local path on the server or from base64-encoded content. When fileId is provided, uploads the content as a new version of that existing file (in-place update) instead of creating a new file. It is categorised as a Write tool in the Google Drive MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

What parameters does uploadFile accept? +

uploadFile accepts 8 parameters: name, fileId, account, mimeType, localPath, contentBase64, parentFolderId, convertToGoogleFormat. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on uploadFile? +

Register the Google Drive MCP server in PolicyLayer and add a rule for uploadFile: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Google Drive. Nothing to install.

What risk level is uploadFile? +

uploadFile is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit uploadFile? +

Yes. Add a rate_limit block to the uploadFile rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block uploadFile completely? +

Set action: deny in the PolicyLayer policy for uploadFile. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides uploadFile? +

uploadFile is provided by the Google Drive MCP server (@ark7/google-drive-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

KEEP EXPLORING

More on Google Drive, and thousands of servers like it.

This server

All 131 Google Drive tools →

Across the catalogue

The MCP Attack Database →

Guides

Govern customer-ops agents →Argument validation →Scoped token →