Repository navigation
MCP tools for Drive and WorkDrive connector grants #15
Description
Summary
Add MCP tools so an authenticated user/agent can inspect and manage per-instance Google Drive and Zoho WorkDrive folder grants without using the console UI.
Why
Connector sync triggers can now be created over MCP, but sync_connector requires a grantId. Today that grant id is only discoverable/configurable from the console or direct REST calls. This leaves the account-level connection + per-agent grant model incomplete for MCP-first operation.
Scope
- Add read tools for connector status:
drive_statusworkdrive_status
- Add per-instance grant tools:
list_instance_connector_grantsgrant_instance_connector_folderdelete_instance_connector_grant
- Support providers:
google_drive,zoho_workdrive. - Use existing API routes and server-side grant validation.
- Respect MCP scopes:
- list/status:
read - grant folder:
write - delete grant:
destructivewith exact confirm.
- list/status:
- Add audit entries for mutations and dry runs.
- Update MCP landing text/docs/tool count.
Acceptance Criteria
- A user can list Drive and WorkDrive connection status through MCP.
- A user can list grants for an instance through MCP and receive grant ids, resource names, provider, type, and URLs where present.
- A user can grant a Drive/WorkDrive folder by URL or resource id through MCP.
- A user can delete a connector grant only with
confirm: "delete_instance_connector_grant". - MCP read-only mode blocks grant creation/deletion.
- Unit tests cover status/list/grant/delete happy path and permission failures.
- Docs show the full MCP flow: connect account in console once -> grant folder -> create
sync_connectortrigger.
Activity
feat(mcp): Drive/WorkDrive connector grants over MCP (#15)
serge-ivo commentedon Aug 6, 2026
Shipped in 565d8cf, MCP worker deployed.
Four tools, thin proxies over routes that already existed — all validation, folder-vs-file checking and token minting stay server-side:
connector_statuslist_instance_connector_grantsgrant_instance_connector_folderdelete_instance_connector_grantOne
providerenum instead of the eightdrive_*/workdrive_*tools the ticket listed. The two connectors differ only in their API base, so splitting them would double the tool count and the drift for no gain. If you specifically wantdrive_status/workdrive_statusas separate names, say so and I'll alias them.Two things worth noting:
connector_statusreportsconfiguredseparately fromconnected, so an operator can distinguish "this deployment has no OAuth client for Drive" from "you haven't connected yet". The first is not fixable by clicking.Grant listing doubles as an audit surface: an agent can only read a folder that appears in it, so the grant IS the permission.
Tests cover registration, per-provider routing, the grant id being surfaced, missing-argument refusal without a network call, read-only blocking, exact-confirm on delete, and dry-run. 2849 green.
Docs (the console → grant →
sync_connectorflow) not written — flagging rather than claiming it.