Configuration
Configuration
Settings come from four places: the plugin options in Claude Code, the environment variables the servers read, the policy.json file in the token directory, and the confirmation setting. This page names them and says what each one does. It never shows a value for a secret-like setting.
Plugin options
Every Claude Code plugin has four options. Set them with /plugin configure in Claude Code, or from a terminal with claude plugin configure <plugin>@google-services-mcps and --values-stdin. Options you leave out keep their values.
| Option | Purpose | Default |
|---|---|---|
allow_writes | lists the tools that create, change, delete or send | off |
confirmation | when to ask before a change: every-change, destructive-only or off | every-change |
toolset | which tools the server lists: all, google or curated | all |
token_dir | the folder for tokens and the OAuth client | empty, which means ~/.google-services-mcps |
Two products add options. gadmin adds admin_subject (the super admin's address) and service_account_key_file (the key file's path). gads adds ads_developer_token (optional) and ads_login_customer_id (the manager account's id, when you reach client accounts through one).
Environment variables
The plugin passes its options to the server as environment variables. The names below are the ones the code reads; the values are yours and are never shown here.
| Name | What it controls | Read by |
|---|---|---|
GSM_ALLOW_WRITES | whether write and destructive tools are listed | the server |
GSM_CONFIRMATION | the confirmation mode: every-change, destructive-only or off | the server and the gate |
GSM_TOOLSET | the toolset: all, google or curated | the server |
GSM_TOKEN_DIR | the token directory | the server and the hook |
GSM_MAX_RESULT_CHARS | the result budget in characters; a longer result is cut at whole items | the server |
GSM_ADMIN_SUBJECT | the super admin's address for the workspace-admin group | the gadmin server |
GSM_SERVICE_ACCOUNT_KEY_FILE | the service account key file for the workspace-admin group | the gadmin server |
GSM_ADS_DEVELOPER_TOKEN | the optional Google Ads developer token | the gads server |
GSM_ADS_LOGIN_CUSTOMER_ID | the manager account id for Google Ads calls | the gads server |
GSM_HOOK_ACTIVE | marks a hook process for the server | the server |
GSM_VERBOSE | writes notices that are normally silent to standard error | the server |
GSM_API_KEY_INPUT | the API key for setup-apikey, read instead of standard input | the installer |
GOOGLE_APPLICATION_CREDENTIALS | a service account key used when none is set up for gplay or gmerchant | the server |
GSM_DIR | the download folder for the one-line installers | the installers |
GSM_REF | the branch, tag or commit the one-line installers download | the installers |
The hook receives the plugin options as CLAUDE_PLUGIN_OPTION_<KEY> variables, not as the server's names. The hook resolves the token directory in the same order as the server: GSM_TOKEN_DIR, then the plugin's token_dir option, then the default. That way the hook and the gate read the same policy.json.
The policy file
policy.json in the token directory holds allow, ask and deny rules. A rule matches a tool name or a method id, by glob (*, ?) or by a regular expression written re:.... The order is fixed: a matching deny wins, then a matching ask, then a matching allow. An allow rule skips the default question for a change or a delete, and never overrides a deny. A broken policy file makes the gate ask, and the error is shown.
Match narrowly. A rule for a whole product, such as mcp__plugin_gcloud_gcloud__* with allow, also skips the prompt for every gcloud change and delete.
The token directory
The default is ~/.google-services-mcps, in your home folder. It holds the OAuth client file, one token file per login group, the API key, the workspace-admin setup, policy.json, audit.log and, when a service account is set up, the record of its key path. Files are written with mode 0600 where the platform supports it; on Windows the folder's access list is limited to your user, SYSTEM and Administrators, and doctor checks it.
npx google-services-mcps protect can move the saved secrets into the operating system's store: DPAPI on Windows, with Keychain and libsecret implemented but not run in this release. protect --off moves them back to plain files. Secret values are passed to the store on standard input, never in a command line.
The audit log
Each gated action writes one JSON line to audit.log in the token directory. The line holds the time, tool, method, decision and outcome, and a 16-character hash of the arguments. The arguments themselves are never written. Reads are not logged. The log is plain text and is not tamper-evident.
The architecture page shows where these settings sit in the request path. The troubleshooting page covers the messages a refused call prints.