OAuth scope upgrade needed: spreadsheets.readonly → spreadsheets for write tools

[tuannvm]

Summary

Implementing Google Sheets write tools (create, update, append, clear, add/delete sheet) requires upgrading the OAuth scope from spreadsheets.readonly to spreadsheets (full read/write access).

The current scope is defined in workspace-server/src/index.ts:

'https://www.googleapis.com/auth/spreadsheets.readonly',

This needs to become:

'https://www.googleapis.com/auth/spreadsheets',

Why this matters

This scope change requires updating the Google OAuth consent screen configuration — it cannot be shipped as a code-only change. The Google Cloud project's OAuth consent screen must be configured to request the broader spreadsheets scope, and users will need to re-authorize to grant the new permission.

What this unblocks

There are several open feature requests that all depend on Sheets write access:

• feature request: sheets.insertText #232 — sheets.insertText
• feature request: sheets.create #242 — sheets.create
• feature request: sheets.batchInsertText #244 — sheets.batchInsertText
• [Feature Request] Support Direct Appending to Google Sheets #87 — Support direct appending to Google Sheets

We have a working implementation ready (with tests) for the following tools, pending this scope change:

Tool	Description
sheets.updateRange	Write values to a specific range
sheets.appendRange	Append rows after last data
sheets.clearRange	Clear values from a range
sheets.createSpreadsheet	Create a new spreadsheet
sheets.addSheet	Add a new tab to an existing spreadsheet
sheets.deleteSheet	Delete a tab by its numeric sheet ID

Considerations

• Per Feature Request: Add Support for Customizable OAuth Scopes to Prevent Unintended Email Operations #111, some users may want granular control over scopes. This change should ideally be paired with a mechanism to opt in/out of write scopes.
• Per Gemini CLI Workspace Extension wants additional access to your Google Account #86, changing scopes triggers a re-authorization prompt for existing users — the UX for this should be considered.

Action needed

The Google Cloud project owner / team needs to:

1. Update the OAuth consent screen to include the spreadsheets scope
2. Ensure the scope is approved for production use (if the app is verified)

[allenhutchison]

I'm open to expanding the scopes on the project, but the thing you need to understand is that doing that on the official mcp project will take time. Every time I ask to expand the scopes I have to go through a set of internal (to google) reviews before I can add a new scope. Those review take time. If you want to experiment with the app with additional scopes that aren't supported by default you can self-host the GCP project. Instructions are here: https://gemini-cli-extensions.github.io/workspace/GCP-RECREATION.html

[allenhutchison]

See #255 for discussion on a feature that would enable us to move forward with asymmetric scopes between the official GPC project and self-hosted projects.

[Andrej730]

We have a working implementation ready (with tests) for the following tools, pending this scope change:

Tool Description
sheets.updateRange Write values to a specific range
sheets.appendRange Append rows after last data
sheets.clearRange Clear values from a range
sheets.createSpreadsheet Create a new spreadsheet
sheets.addSheet Add a new tab to an existing spreadsheet
sheets.deleteSheet Delete a tab by its numeric sheet ID

@tuannvm hi! is there some pending PR to try it out?

[tuannvm]

@Andrej730 thanks! this is the draft PR I have a while ago #326

Will resolve the conflict and see how it goes.

[tuannvm]

@Andrej730 @allenhutchison, could you take a look at the PR once you have time? Thanks!