Last verified
Gap map: Google Workspace admin & security APIs without solid MCP coverage
Google's hosted Workspace MCP servers cover productivity apps (Gmail, Drive, Calendar, Docs, Sheets, Slides, Chat, People) — no admin or security APIs. (Google docs)
Solid = active MCP coverage Dashed = unserved security gap (0 verified or read-only MCPs)
Full 9-surface breakdown in the HTML table below
Admin & Security API Coverage Matrix Updated
| Admin / security API | Conduit trace | Official Google MCP | Community MCP (as of ) | Gap assessment |
|---|---|---|---|---|
| Alert Center API alertcenter.googleapis.com, scope apps.alerts | | None | Tracecat registry tools; ag2 auto-generated prototype (no license, 0 stars) | Large — no maintained, read-only-by-default MCP |
| Admin SDK Reports API (login, token, admin audit logs) | | None | None found | Largest — forensic layer missing entirely |
| Admin SDK Directory API (users, suspend, tokens) | | None | securityfortech/google-admin-mcp (inactive since ), keyserfaty/mcp-google-workspace-admin | Medium — exists but small/unaudited |
| Directory users.tokens (revoke OAuth grants) | | None | None verified | Large |
| Gmail admin-side remediation (DWD message removal) | | None | General Gmail servers only (user-scoped) | Large |
| Security Investigation Tool | | No public REST API for bulk remediation | — | Not addressable via MCP today |
| DLP / rules | | None | None found | Large |
| Vault API | | None | None found | Large |
| Google SecOps / SCC | | — | google/mcp-security (official open source + remote server) | Covered, but requires SecOps |
Builder & SecOps Architecture Opportunity
Opportunity: a read-only composite MCP (Alert Center + Reports + Directory read) with remediation tools behind out-of-band human approval.
Sources:
Alert Center REST reference
, repositories linked in src/data/servers.json.
Updated: