Google Drive MCP Authorization Friction

Google Antigravity
1

Feedback Report: Google Drive MCP Authorization Friction

Summary: The current setup flow for Google Drive MCP (drivemcp.googleapis.com) on Antigravity CLI introduces significant user friction. Bypassing developer preview blocks requires creating custom GCP projects and OAuth configurations, which is out of reach for a typical user.

1. Friction Points & Friction Log

Friction Step Detail Impact
1. OAuth Consent Screen (Testing Status) The default OAuth client ID is in a “Testing” status, completely blocking anyone not manually whitelisted as a test user with Error 403: access_denied. Blocked standard authentication out-of-the-box.
2. PKCE Callback Handling When the browser OAuth flow was bypassed, the client threw Missing code verifier and no pending auth state errors due to a mismatch between loopback redirects and manual input. Users cannot easily copy/paste codes if the TUI state closes.
3. Developer Preview API Restrictions The drivemcp.googleapis.com service is restricted to whitelisted participants of the Workspace Developer Preview. Direct API calls work, but the MCP endpoint rejects requests. Even custom GCP client IDs failed with The caller does not have permission over the remote MCP gateway.
4. Lack of Standard Local Fallback The default client relies entirely on the remote hosted SSE gateway instead of a local stdio wrapper utilizing the standard Drive API. Forced implementing a custom stdio wrapper script to make it work.

2. Comparison: Antigravity vs. Claude Code / Cursor

  • Claude Code / Cursor: Standard integrations typically ship with a pre-verified OAuth client or fall back cleanly to a local helper using user-owned credentials (e.g. personal access tokens or gcloud context), completely avoiding Google Cloud Console project creation.
  • Antigravity CLI: Forces the user to interact directly with GCP developer consoles, enable hidden API gateways (drivemcp.googleapis.com), configure redirect URIs, and manage OAuth client type mappings just to perform basic file reading.

3. Product Recommendations

  1. Pre-Verify the Default App: Promote the default antigravity.google OAuth client ID to Production (even if unverified) so users only see a bypassable warning rather than a hard 403 block.
  2. Local Stdout/Stderr Fallback: If the remote hosted drivemcp.googleapis.com server blocks a project due to Developer Preview status, the CLI should fall back to a local shim using standard gcloud context tokens and public APIs.
  3. Improved CLI Prompts: Ensure the CLI keeps the loopback receiver state open longer to avoid the no pending auth state mismatch when pasting codes.