Google AI Releases CLI Tool (gws) for Workspace APIs: Provides a Unified Interface for Humans and AI Agents

Integrating Google Workspace APIs—such as Drive, Gmail, Calendar, and Sheets—for applications and data pipelines often requires writing boilerplate code to handle REST endpoints, integrations, and OAuth 2.0 flows. The Google AI team recently released the CLI Tool (gws) for Google Workspace. Open source googleworkspace/cli (written in gws command) provides a unified, powerful command-line interface to manage these services.

Designed for both human developers and AI agents, gws eliminates the need for a custom wrapper script by providing structured JSON output, native Model Context Protocol (MCP) support, and automated validation workflows.

Dynamic API Discovery Architecture

Unlike traditional CLI tools that include a list of static commands, gws constructs its own command space dynamically at runtime.

When it is killed, gws uses a two-stage classification strategy:

1. Reads the first argument to identify the target service (eg. drive).
2. Downloads the Google Discovery Document for that service (cached for 24 hours).
3. Create a command tree with the resources and methods of the document.
4. It resolves the remaining arguments, authenticates, and makes the HTTP request.

Because of this structure, gws automatically supports Google Workspace API endpoints when they are added to the Discovery service.

Key Characteristics of Software Engineers and Data Scientists

The CLI can be installed via npm (npm install -g @googleworkspace/cli) or generated from source (cargo install --path .). Once installed, it provides several built-in tools for data extraction and automation:

• Self-testing and pre-testing: Every resource includes --help scripts generated from the Discovery API. You can view the schema of any method (eg gws schema drive.files.list) or use the --dry-run flag to preview a specific HTTP request before executing.
• Scheduled Data Release: By default, the entire response—including errors and metadata—is returned as structured JSON.
• Automatic Navigation: For devs pulling large datasets, i --page-all flag automatically handles API pointers. Streams hashed results as NDJSON (Newline Delimited JSON), which can be passed to JSON:Bash command line processorsgws drive files list --params '{"pageSize": 100}' --page-all | jq -r '.files[].name'

Integration with AI Agents and MCP

The main use case is this gws serves as the basis for calling a tool in large language models (LLMs).

• Model Context Protocol (MCP) Server: By running gws mcp -s drive,gmail,calendarthe CLI restarts the MCP server stdio. This exposes the Workspace APIs as structured tools that any MCP-compatible client (such as Claude Desktop or VS Code) can call natively.
• Pre-built Agent Capabilities: The repository includes over 100 Agent Capabilities covering all supported APIs and common workflows. AI developers can install these directly into the agents’ environments using npx skills add github:googleworkspace/cli.
• Gemini CLI extension: Developers using the Gemini CLI can install the gws extension (gemini extensions install https://github.com/googleworkspace/cli), which allows a local Gemini agent to inherit gws verify and manage Workplace resources natively.
• Weapons Model (Cleaning Answers): To reduce the risk of rapid injection when providing API data to LLM, gws supports Google Cloud Model Armor. Exceeding the --sanitize the tag scans API responses for malicious payloads before the data reaches your agent.

Verify Workflow

The CLI securely handles authentication across domains, replacing the need for manual token management in custom scripts. First are given transparent tokens, followed by authentication files, and finally key storage.

• Local Desktop: Running gws auth setup starts the interactive flow to configure the Google Cloud project, enables the necessary APIs, and handles OAuth login. Authentication is encrypted at rest using AES-256-GCM and stored in the OS key.
• Headless / CI/CD: In server environments, developers can complete active auth locally and issue plain text credentials:Bashgws auth export --unmasked > credentials.json On a headless machine, point the CLI to this file using an environment variable: export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/credentials.json.
• Service Accounts: gws natively supports Server-to-Server Service Account files and Domain Wide Deployment with GOOGLE_WORKSPACE_CLI_IMPERSONATED_USER flexible.

Check it out Repo here. Also, feel free to follow us Twitter and don’t forget to join our 120k+ ML SubReddit and Subscribe to Our newspaper. Wait! are you on telegram? now you can join us on telegram too.