Google Drive
7 reviewed Dtwo policies for Google Drive MCP servers — egress + ingress controls for governing what AI agents can do with Google Drive.
On this page
Reusable DTwo policies for Google Drive MCP servers (Google's official Drive MCP server, the Anthropic-hosted Claude "Google Drive" connector, and compatible community forks such as isaacphi/mcp-gdrive and piotr-agier/google-drive-mcp). The MCP surface spans read tools (search, list, metadata, permissions, content reads, downloads), write tools (create/upload files, doc/sheet edits, moves, renames, copies, comments), and — in the broadest community fork only — destructive tools (deleteItem, deleteSheet, deleteRange, deleteGoogleSlide, deleteCalendarEvent). Risk profile: Drive is a de-facto dumping ground for PII, PHI, payroll, contracts, and board decks, so the dominant risks are bulk read/exfiltration and search-driven recon; MCP responses bypass classic DLP entirely, and destructive writes on the community server are hard to undo past version history.
Available policies
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| cap-bulk-export | ingress | Clamp the page size of Drive search and listing calls to 25 results (transform-only) to slow bulk enumeration. | soc2, hipaa, gdpr-ccpa |
| exclude-personal-drives | egress | Withhold files living in personal Drives from search/list/metadata responses; shared-drive material passes (transform + deny on metadata lookups). | — |
| fence-restricted-folders | ingress | Fence an admin-maintained denylist of restricted file/folder IDs off the agent channel for both reads and writes. | soc2, hipaa, gdpr-ccpa, sox |
| freeze-destructive-ops | ingress | Deny destructive Drive tool calls (delete file/folder/sheet/range/slide) unless the caller is in the admin group. | soc2, hipaa, gdpr-ccpa, sox |
| guard-acl-recon | ingress | Deny get_file_permissions ACL-reconnaissance calls unless the caller's IdP groups claim contains infosec. |
soc2 |
| redact-pii-egress | egress | Redact PII from Drive file-content responses to fixed tokens before they reach the agent (transform-only). | soc2, hipaa, gdpr-ccpa |
| role-gate-writes | ingress | Gate every write-class Drive tool behind an authorized IdP group; read-class tools pass through freely. | soc2, hipaa, pci-dss, gdpr-ccpa, sox |
Tool naming on the DTwo gateway
DTwo prefixes tool names with the MCP server name configured on the gateway, and the Google Drive ecosystem has no shared naming convention: Google uses snake_case verbs (search_files, read_file_content), isaacphi/mcp-gdrive prefixes by product (gdrive_*, gsheets_*), piotr-agier/google-drive-mcp uses bare camelCase (deleteItem, uploadFile), and the legacy Claude integration used google_drive_*. The policies in this directory match on the suffix so they stay portable across the gateway prefix — but because generic verbs (search, copyFile) can collide once the prefix is stripped, always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.
Identity claims
The group-gated policies (freeze-destructive-ops, guard-acl-recon, role-gate-writes) read input.subject.claims.groups and fail closed: a missing, empty, or wrong-shaped claim means no exemption / no write grant. Group names (drive-admins, infosec, and the write-authorized group) are placeholders — replace them with your IdP's group names at import time. cap-bulk-export, fence-restricted-folders (its denylist) and redact-pii-egress require no identity claims.
Contributing
To add a Google Drive policy:
- Create
apps/google-drive/<policy-slug>/withpolicy.mdand atests.yamltest file. - Add a row to the table above.
- Declare
apps: ["google-drive"]in the policy frontmatter, plus any industry / bundle slugs that apply. - If the policy fits a framework bundle (e.g.
bundles/soc2orbundles/hipaa), link to it from the matching landing page. - Run
pnpm manifestfrom the repo root.
See CONTRIBUTING.md for the full process.