Google drops an open-source Workspace CLI built for AI agents

gws is an open-source unified command-line tool released by the Google Workspace team. It wraps Drive, Gmail, Calendar, Sheets, Docs, and Chat into a single terminal executable designed from day one for both developers and autonomous AI agents.

What it actually does

Instead of making you dig through REST docs and write fragile curl commands, gws offers built-in help flags for every resource, request previewing via dry-run flags, and automatic pagination streaming as NDJSON.

It also introduces hand-crafted helper commands prefixed with a plus sign for everyday routines. You can run gws gmail +triage for an unread inbox summary, gws calendar +agenda to pull upcoming events in your account timezone, or gws workflow +standup-report to combine meetings and tasks into a morning brief.

For agentic workflows, every single command returns clean structured JSON. The repository ships with dozens of pre-configured agent skills compatible with frameworks like OpenClaw and the Gemini CLI extension, allowing LLMs to orchestrate office tasks without custom tooling.

It also factors in agent-specific safety risks. gws integrates Google Cloud Model Armor, letting you sanitize API responses against prompt injection attempts before that data ever reaches your LLM context window.

How it works under the hood

Rather than maintaining a static list of commands that rots over time, gws queries Google's Discovery Service at runtime. It constructs its entire command surface dynamically, meaning whenever Google Workspace releases a new API method, gws picks it up immediately.

Authentication covers everything from local laptops to headless CI runners. You can run gws auth setup alongside gcloud to automate project configuration, encrypting credentials on disk with AES-256-GCM via your OS keyring, or simply pass access tokens via environment variables.

There is one crucial trap to watch out for during setup. If your Google Cloud OAuth app is unverified and sitting in testing mode, Google limits consent to around 25 scopes. The tool's full preset asks for 85 scopes, which will trigger an access blocked error on personal Gmail accounts unless you scope down explicitly to specific services like Drive and Gmail.

Setup and gotchas

You can grab gws via pre-built binaries on GitHub Releases, through Homebrew, Nix, Cargo, or global npm install. All you need on your machine is a Node.js 18+ runtime or the raw binary, alongside a Google Cloud project with OAuth enabled.

Google notes upfront that this is not an officially supported Google product. It is under active development, and breaking changes should be expected as it moves toward a 1.0 release.

Why it matters

In our view, gws takes the most annoying part of building productivity agents—writing and maintaining brittle REST wrappers for Google's sprawling APIs—and turns it into a standardized terminal interface. Pairing runtime Discovery generation with structured JSON output is a remarkably clean architectural choice.

If you are an independent hacker or engineer building autonomous agent pipelines, this is definitely worth trying right now. Just keep in mind that its experimental status and OAuth testing limits make it better suited for developer tooling and prototypes rather than mission-critical enterprise workflows today.